The Week in Security: Okta says source code stolen. Also: SentinelSneak: PyPi moduel poses as security SDK

Welcome to the latest edition of The Week in Security, which brings you the latest headlines across the full stack of security: application security; cybersecurity; and beyond.

DraftKings fantasy? How YOU can prevent credential stuffing attacks

...

SentinelSneak: Malicious PyPI module poses as security software development kit

A malicious Python file found on the PyPI repository adds backdoor and data exfiltration features to what appears to be a legitimate SDK client from SentinelOne.

Expert panel: No ‘silver bullet’ for supply chain security

Experts and a top analyst discussed the state of software supply chain security in a recent Webinar. Here are key takeaways from their discussion.

Ahoy! More insecure code washes ashore with AlphaCode

Alphabet’s DeepMind brings us AlphaCode — another AI code-generating parlor trick. And, just like its large language model cousins, it can spit out buggy code.

How deep scanning protects your data in the cloud

The Week in Security: Software supply chain attack mines diamond industry, npm security boosted

Welcome to the latest edition of The Week in Security, which brings you the newest headlines from both the world and our team across the full stack of security: application security, cybersecurity, and beyond.

ChatGPT: Parlor trick or Stack Overflow replacement?

Conversational AI language model ChatGPT can write code. But is it any good?

New supply chain mandates: Uncle Sam wants you (to secure your software)!

Here are the key elements of Executive Order 14028, and software supply chain security guidance from the Enduring Security Framework working group.

Log4j one year in: Vulnerability fuels attacks — and a new urgency for software supply chain security

The Week in Security: Docker Hub leaks secrets, Black Basta ransomware gangs up on retailer

Welcome to the latest edition of The Week in Security, which brings you the newest headlines from both the world and our team across the full stack of security: application security, cybersecurity, and beyond.

W4SP continues to nest in PyPI: Same supply chain attack, different distribution method

Days after researchers for Phylum and Checkmarx revealed an ongoing software supply chain attack spreading the W4SP Stealer malware through malicious packages on the Python Package Index (PyPI), ReversingLabs researchers discovered 10 additional PyPI packages pushing modified versions of W4SP that were overlooked.

ZetaNile: Open source software trojans from North Korea

ReversingLabs Malware Researcher Joseph Edwards takes a deep dive into ZetaNile, a set of open-source software trojans being used by Lazarus/ZINC.

Meta’s GDPR fine: Why your DevOps needs red teaming

GitHub repojacking attack: 10 lessons for software teams

Software supply chain attacks are on the rise because of their reach. Here are 10 valuable lessons from the recent GitHub namespace attack.