Incident Response
Rapid7 says unauthorized third-party accessed source code, customer data during Codecov supply chain breach
Hi, what are you looking for?
SecurityWeek
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Supply Chain Security
Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.
Supply Chain Security
LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users.
Application Security
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure.
Application Security
The massive blast radius from the Codecov supply chain attack remains shrouded in mystery as security teams continue to assess the fallout from the...
Incident Response
In a joint document published this week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST)...
Incident Response
Supply Chain Security
It’s a bigger problem than is immediately apparent, and has the potential for hacks as big as Equifax and as widespread as SolarWinds.
Risk Management
The U.S. government is working to draw attention to supply chain vulnerabilities, an issue that received particular attention late last year after suspected Russian...
Supply Chain Security
Join Intel on Wednesday, March 10, at SecurityWeek’s Supply Chain Security Summit, where industry leaders will examine the current state of supply chain attacks....
Cybercrime
Ukraine’s National Security and Defense Council (NSDC) this week published two press releases describing cyberattacks aimed at the country.
Cyberwarfare
Researchers at cybersecurity firm ESET say they have uncovered an espionage campaign that has targeted online gamers in Asia through a compromised software company.
Cybercrime
The elite Russian hackers who gained access to computer systems of federal agencies last year didn’t bother trying to break one by one into...
Cybercrime
CrowdStrike, one of the cybersecurity companies called in by IT management firm SolarWinds to investigate the recently disclosed supply chain attack, on Monday shared...
Cybercrime
It is believed that the recently disclosed attack targeting Texas-based IT management solutions provider SolarWinds resulted in threat actors gaining access to the networks...
Risk Management
Organizations Need to Monitor and Manage IT Security Risks Downstream in the Supply Chain
Incident Response
U.S. Agency Says SolarWinds Orion Supply Chain Compromise is Not the Only Initial Infection Vector Leveraged by APT Actor
Cybercrime
Tampered Versions of SolarWinds Orion IT Monitoring Software Used to Compromise Global Organizations
Data Protection
Dell Technologies on Thursday announced new security offerings designed to address threats targeting the supply chain, a device’s boot process, and sensitive data.
Malware & Threats
The North Korea-linked threat actor known as Lazarus has been targeting users in South Korea through a supply chain attack that involves software typically...
Cybercrime
GitHub revealed on Thursday that tens of open source NetBeans projects hosted on its platform were targeted by a piece of malware as part...
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)