Supply Chain Security
Self-hosted GitHub Actions runners could allow attackers to inject malicious code into repositories, leading to supply chain attacks.
Hi, what are you looking for?
SecurityWeek
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Supply Chain Security
Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.
Supply Chain Security
LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users.
Application Security
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure.
Application Security
NSA has published guidance to help organizations incorporate SBOM to mitigate supply chain risks.
Malware & Threats
US, UK, and Poland warn of Russia-linked cyberespionage group’s broad exploitation of recent TeamCity vulnerability.
Supply Chain Security
North Korean hackers breached a Taiwanese company and used its systems to deliver malware to the US, Canada, Japan and Taiwan in a supply...
Cloud Security
Researchers at Aqua call urgent attention to the public exposure of Kubernetes configuration secrets, warning that hundreds of organizations are vulnerable to this “ticking...
Supply Chain Security
CISA, NSA, and ODNI issue new guidance on managing open source software and SBOMs to maintain awareness on software security.
Cybersecurity Funding
UK-based Risk Ledger has raised £6.25 million (~$7.65 million) in Series A funding to prevent supply chain attacks.
Application Security
Washington startup Chainguard banks $61 million in new financing as investors make hefty wagers on software supply chain security companies.
Supply Chain Security
Multiple North Korean hacking groups have exploited a recent TeamCity vulnerability and Microsoft warns of potential supply chain attacks.
ICS/OT
Flaw poses a direct threat to the SOCKS5 proxy handshake process in cURL and can be exploited remotely in some non-standard configurations.
Government
CISA, FBI, NSA, and US Treasury published new guidance on improving the security of open source software in OT and ICS.
Supply Chain Security
Taiwan authorities are investigating four Taiwan-based companies suspected of helping China’s Huawei Technologies to build semiconductor facilities.
Cloud Security
GitHub beefs up its secret scanning feature, now allowing users to check the validity of exposed credentials for major cloud services.
Identity & Access
The Linux Foundation has announced OpenPubkey, an open source cryptographic protocol that should help boost supply chain security.
Government
CISA unveils a new Hardware Bill of Materials (HBOM) framework for buyers and sellers to communicate about components in physical products.
Artificial Intelligence
Exposed data includes backup of employees workstations, secrets, private keys, passwords, and over 30,000 internal Microsoft Teams messages.
Supply Chain Security
Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.
Malware & Threats
A new APT group called Carderbee has been observed deploying the PlugX backdoor via a supply chain attack targeting organizations in Hong Kong.
Application Security
Google sprinkles magic of generative-AI into its open source fuzz testing infrastructure and finds immediate success with code coverage.
Government
The US government's cybersecurity agency describes UEFI as "critical attack surface" that requires urgent security attention.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)
Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop.
(Torsten George)
Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk.
(Tod Beardsley)
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)