Application Security
GitHub makes push protection generally available to warn developers whenever they include a secret in a commit.
Hi, what are you looking for?
SecurityWeek
Application Security
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
Application Security
CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained.
Application Security
The previous GPG signing subkey was inadvertently added to a GitHub repository and Mozilla decided to revoke it.
Application Security
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure.
Application Security
Open banking can be described as a perfect storm for cybersecurity. At one end, small startups with financial acumen but little or no security...
Application Security
CISA has opened proposed guidance for secure software development to public review and comment.
Application Security
Apiiro’s Risk Graph Explorer helps security teams to understand their application attack surface.
Application Security
GitHub this week introduced NPM package provenance and deployment protection rules and announced general availability of private vulnerability reporting.
Application Security
VMware warns of two critical vulnerabilities -- CVE-2023-20864 and CVE-2023-20865 -- in the VMware Aria Operations for Logs product.
Application Security
Boston-based Mobb has raised $5.4 million in seed funding for a product that automatically fixes vulnerabilities found in applications developed by customers.
Application Security
Adobe documents 56 security defects in multiple products, some serious enough to expose Windows and macOS users to code execution attacks.
Application Security
Consulting giant KPMG spins out a startup building technology to secure AI (artificial intelligence) applications and deployments.
Application Security
OpenSSL 1.1.1 will reach EoL in six months and users are instructed to either upgrade to a newer version or pay for extended support...
Application Security
Twitter sent a copyright notice to code hosting service GitHub to request the removal of a repository that contained Twitter source code.
Application Security
Backslash Security banks seed-stage capital to build new technology to identify and mitigate “toxic code flows” in cloud-native applications.
Application Security
Black Lantern Security introduces Badsecrets, an open source tool for identifying known or weak cryptographic secrets across multiple platforms.
Application Security
GitHub this week made secret scanning generally available and free for all public repositories.
Application Security
While there are many routes to application security, bundles that allow security teams to quickly and easily secure applications and affect security posture in...
Application Security
GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.
Application Security
PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.
Application Security
Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.
Application Security
A new report finds that barely 1% of all SBOMs being generated today meets the “minimum elements” defined by the U.S. government.
Application Security
A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)