Application Security
VMware confirmed that exploit code for CVE-2023-20864 has been published, underscoring the urgency for enterprise network admins to apply available patches.
Hi, what are you looking for?
SecurityWeek
Application Security
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
Application Security
CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained.
Application Security
The previous GPG signing subkey was inadvertently added to a GitHub repository and Mozilla decided to revoke it.
Application Security
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure.
Application Security
SwSec 5D framework aims to provide a roadmap for secure software development, and its use would help improve security in the software supply chain.
Application Security
Hackers linked to the Truebot malware are exploiting a year-old Netwrix Auditor flaw to break into organizations in the U.S. and Canada.
Application Security
Use-after-free and OS command injection vulnerabilities reach the top five most dangerous software weaknesses in the 2023 CWE Top 25 list.
Application Security
Tel Aviv startup scores investment to build technology to secure in-house low-code/no-code custom applications.
Application Security
New guidance from CISA and the NSA provides recommendations on securing CI/CD pipelines against malicious attacks.
Application Security
Two critical-severity authentication bypass vulnerabilities in WordPress plugins with tens of thousands of installations.
Application Security
Fake security researcher accounts seen distributing malware disguised as Chrome, Signal, WhatsApp, Discord and Exchange zero-day exploits.
Application Security
Adobe ships urgent fixes for at least a dozen flaws that expose Adobe Commerce users to code execution attacks.
Application Security
OMB has published new guidance on federal agencies obtaining security guarantees from software vendors.
Application Security
Cybersecurity news that you may have missed this week: AI regulation, layoffs, US aerospace malware attacks, and post-quantum encryption.
Application Security
VMware ships urgent patches to cover security defects that expose businesses to remote code execution attacks.
Application Security
OWASP’s ranking for the major API security risks in 2023 has been published. The list includes many parallels with the 2019 list, some reorganizations/redefinitions,...
Application Security
NCC Group announces new open source tools for finding hardcoded credentials and for distributing cloud workloads.
Application Security
Google introduces Mobile VRP bug bounty program for vulnerabilities in its mobile applications.
Application Security
Red Hat rolls out a new suite of tools and services to help mitigate vulnerabilities across every stage of the modern software supply chain.
Application Security
Cloudflare introduces Secrets Store, a new solution to help developers and organizations securely store and manage secrets.
Application Security
Lineaje introduces SBOM360 Hub, an exchange allowing software producers, sellers, and consumers to publish, share and use SBOMs and related compliance artifacts.
Application Security
Former ByteDance executive said China government officials maintained access to all TikTok data, including information stored in the United States.
Application Security
OpenSSF has added four new members and is receiving $5 million in funding for its Alpha-Omega open source software security project.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)