Cybersecurity Funding
Software supply chain security startup Lineaje has raised $20 million in a Series A funding round that brings the total to $27 million.
Hi, what are you looking for?
SecurityWeek
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Supply Chain Security
Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.
Supply Chain Security
LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users.
Application Security
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure.
Funding/M&A
Software supply chain security startup Chainguard raises a $140 million Series C round that values the company at $1.2 billion.
CISO Strategy
Judge dismissed SEC lawsuit charging SolarWinds and CISO Timothy Brown with hiding security problems before and after the SUNBURST supply chain compromise.
Supply Chain Security
GitLab issues an advisory for a critical-severity vulnerability that allows an attacker to trigger a pipeline as another user.
Malware & Threats
Namecheap shut down polyfill.io amid reports of malicious activity, but the Chinese owner claims it has good intentions.
Supply Chain Security
More than 100,000 websites are affected by a supply chain attack injecting malware via a Polyfill domain.
Supply Chain Security
Five WordPress plugins were injected with malicious code that creates a new administrative account.
Supply Chain Security
Attackers are getting more sophisticated, better armed, and faster. Nothing in Rapid7's 2024 Attack Intelligence Report suggests that this will change.
Supply Chain Security
The discovery of the XZ Utils backdoor reminds an F-Droid developer of a similar incident that occurred a few years ago.
Supply Chain Security
Urgent security alerts issued as malicious code was found embedded in the XZ Utils data compression library used in many Linux distributions.
Malware & Threats
Maintainers of the Python Package Index (PyPI) repository were forced to suspend new project creation and new user registration to mitigate a malware upload...
Funding/M&A
Los Angeles firmware and software supply chain firm banks $10.5 million in seed-stage funding led by Two Bear Capital.
Supply Chain Security
Join the fully immersive virtual event us as we explore the critical nature of software and vendor supply chain security issues. (Login Now)
Artificial Intelligence
SecurityWeek talks to hundreds of industry experts from dozens of companies covering seven primary topics.
Supply Chain Security
Supply chain security insights: A successful attack against a supplier can lead to multiple opportunities against the supplier’s downstream customers.
Supply Chain Security
AnyDesk is revoking certificates and passwords in response to a significant security breach impacting production systems.
Supply Chain Security
Two new products aim to secure the traditional OSS supply chain, and the new AI model software supply chain.
Cybersecurity Funding
Kusari has raised $8 million to help organizations gain visibility into and secure their software supply chain.
Network Security
Quarkslab finds serious, remotely exploitable vulnerabilities in EDK II, the de-facto open source reference implementation of the UEFI spec.
Application Security
Researchers detail a CI/CD attack leading to PyTorch releases compromise via GitHub Actions self-hosted runners.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)