Application Security
OWASP has added two new categories to the revised version of its Top 10 list of the most critical risks to web applications.
Hi, what are you looking for?
SecurityWeek
Application Security
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
Application Security
CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained.
Application Security
The previous GPG signing subkey was inadvertently added to a GitHub repository and Mozilla decided to revoke it.
Application Security
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure.
Application Security
Three more VS Code extensions were infected last week and the malware has emerged in GitHub repositories as well.
Application Security
Arbitrary command/code execution has been demonstrated through the exploitation of CVE-2025-11953 on Windows, macOS and Linux.
Application Security
Bugcrowd said the acquisition of Mayhem has nearly doubled its valuation — previously reported at over $1 billion.
Application Security
Kolter leads a panel at OpenAI that has the authority to halt the ChatGPT maker’s release of new AI systems if it finds them...
Application Security
Get practical guidance to protect APIs against the threats attackers are using right now.
Application Security
GitHub will implement local publishing with mandatory 2FA, granular tokens that expire after seven days, and trusted publishing.
Application Security
The packages were injected with malicious code to harvest secrets, dump them to a public repository, and make private repositories public.
Application Security
Designed to intercept cryptocurrency transactions, the malicious code reached 10% of cloud environments.
Application Security
A supply chain attack called GhostAction has enabled threat actors to steal secrets and exploit them.
Application Security
SBOM adoption will drive software supply chain security, decreasing risks and costs, and improving transparency.
Application Security
CISA has updated the Minimum Elements for a Software Bill of Materials (SBOM) guidance and is seeking public comment.
Application Security
CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained.
Application Security
Taking place August 12-13, CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured,...
Application Security
Taking place August 12-13, CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured,...
Application Security
Base44 owner Wix quickly patched a critical authentication bypass vulnerability discovered by researchers at Wiz.
Application Security
The open source security firm will use the investment to enhance go-to-market efforts and accelerate platform expansion.
Application Security
HeroDevs has received a $125 million strategic growth investment from PSG to secure enterprise security stacks.
Application Security
RevEng.ai has raised $4.15 million in seed funding for an AI platform that automatically detects malicious code and vulnerabilities in software.
Application Security
New research suggests more than 10,000 SaaS apps could remain vulnerable to a nOAuth variant despite the basic issue being disclosed in June 2023.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)