IAmReboot: Malicious NuGet packages exploit loophole in MSBuild integrations
ReversingLabs has highlighted threats in npm, PyPI and RubyGEMS in recent years. This finding shows NuGet is equally exposed to malicious activities by threat actors.
IAmReboot: Malicious NuGet packages exploit loophole in MSBuild integrations
How mature is your open-source risk management? S2C2F helps map dependencies
The OpenSSF's Secure Supply Chain Consumption Framework can be used to better discover the risks of open-source components — but remediation is left for organizations to figure out later.
App sec prioritization is priority No. 1 for CISOs
Application security veterans Mark Curphey and John Viega went on a CISO listening tour. Here's what they learned.
GitHub boosts secrets scanning: A necessary step, but supply chain security is key to managing risk
Extending validity checks is welcome, but secrets risk is bigger than that — and requires a holistic supply chain security approach.
Rust on Android goes bare metal: 3 key security benefits
Extending the language's bare-metal use from Linux will make Android a trusted platform — and have a broader impact on the Rust development community.
Are APIs the weak link in your supply chain security?
Here's why application programming interface security is critical to risk management — and the advances needed to move API security forward.
The state of OSS security: Changes in attack methods, policy
What’s to come for the security of open source software? ConversingLabs caught up with Mikaël Barbero of the Eclipse Foundation to answer that question. Watch (or listen) and learn.
Typosquatting campaign delivers r77 rootkit via npm
ReversingLabs discovered that one “s” was all that separated a legit npm package from a malicious twin that delivered the r77 rootkit — and was downloaded more than 700 times.
ReversingLabs A1000 Threat Analysis and Hunting Solution Update Drives SecOps Forward
Version 8.3 of RL's A1000 Malware Analysis Platform delivers better visuals, search, and an improved cloud sandbox. Here are all of the updates.
NIST supply chain security guidance for CI/CD environments: What you need to know
NIST's new guidelines are welcome, but some organizations may find it challenging to put them into practice.
NIST supply chain security guidance for CI/CD environments: What you need to know
NIST's new guidelines are welcome, but some organizations may find it challenging to put them into practice.
BlackCat (ALPHV): What we know about the MGM hack
Ransomware-as-a-service gang ALPHV (a.k.a. BlackCat) carried out a sophisticated attack on the hotel and casino company MGM. Here’s what the ReversingLabs threat team understands.
With growing threats to Apple devices, Kandji ramps up
Kandji Director of Threat Intelligence Devin Byrd talks about the growing enterprise threats to macOS and iOS endpoints.
EPSS vs. CVSS: Exploit prediction could move the needle on software risk
Will the Exploit Prediction Scoring System improve application security now — and software supply chain security in the future? Here's what you need to know.
The art of security chaos engineering
What if dev and app sec teams showed the same ingenuity, nimbleness and ruthless efficiency as cybercriminals? Fastly's Kelly Shortridge explains why that's essential to resilience.