Supply Chain Security
More details have come to light on the recent supply chain attack targeting GitHub Actions, including its root cause.
Hi, what are you looking for?
SecurityWeek
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Supply Chain Security
Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.
Supply Chain Security
LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users.
Application Security
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure.
Malware & Threats
The websites of over 100 auto dealerships were found serving malicious ClickFix code in a supply chain compromise.
Application Security
The tj-actions/changed-files GitHub Action, which is used in 23,000 repositories, has been targeted in a supply chain attack.
Supply Chain Security
Report from the Department for Science, Innovation & Technology (DSIT) finds weaknesses in current practices.
Application Security
Opengrep is a new consortium-backed fork of Semgrep, intended to be and remain a true genuine OSS SAST tool.
Supply Chain Security
Join Us in Shaping the Future of Supply Chain Security - Don’t miss this chance to be part of the conversation addressing one of...
Supply Chain Security
Open source software (OSS) is a prime target for supply chain cyberattacks and protecting it remains a major challenge.
Funding/M&A
The deal includes certain Phylum assets, including its malicious package analysis, detection, and mitigation technology.
Supply Chain Security
The recent compromise of Cyberhaven’s Chrome extension appears to be part of a broad campaign that started over a year ago.
Supply Chain Security
Cyberhaven and other Chrome extensions were compromised in a supply chain attack targeting Facebook advertising users.
Supply Chain Security
Supply chain attack leads to decentralized application developers downloading backdoored versions of the Solana Web3.js library.
Supply Chain Security
ESET warns of a new reality: “UEFI bootkits are no longer confined to Windows systems alone.”
Ransomware
Supply chain management software provider Blue Yonder has been targeted in a ransomware attack that caused significant disruptions for some customers.
Supply Chain Security
LottieFiles has confirmed that Lottie-Player has been compromised in a supply chain attack whose goal is cryptocurrency theft.
Funding/M&A
Socket has raised $40 million in a Series B funding round to work on open source software supply chain security technology.
Government
The SEC announces penalties against Unisys, Avaya, Check Point and Mimecast for downplaying the impact of the SolarWinds Orion hack.
Supply Chain Security
A Pyongyang-aligned APT was caught exploiting a recent zero-day in Internet Explorer in a supply chain attack.
Supply Chain Security
Entry points in packages across multiple programming languages are susceptible to exploitation in supply chain attacks.
Data Breaches
A breach at Rackspace exposes the fragility of the software supply chain, triggering a blame game among vendors over an exploited zero-day.
Risk Management
As organizations have fortified their defenses against direct network attacks, hackers have shifted their focus to exploiting vulnerabilities in the supply chain to gain...
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)