How bulk pull requests help scale open source bug fixes
Flaws quickly spread across the supply chain. Here's how researchers at Alpha Omega and beyond are automating fixes.
How bulk pull requests help scale open source bug fixes
VS Code hack shows how supply chain attacks can extend to other software development tools
A Visual Studio Code Extensions Marketplace flaw highlights the risk potential. Here's how the VS Code IDE can proliferate to npm.
From the Labs: YARA Rule for Detecting NB65
ReversingLabs YARA detection rule for NB65 can help you find this ransomware in your environment.
The Week in Security: NuGet hit by typosquatting, fake ChatGPT plug-in hijacks Facebook accounts
Welcome to the latest edition of The Week in Security, which brings you the newest headlines from both the world and our team across the full stack of security: application security, cybersecurity, and beyond.
Jenkins patches high-severity XSS vulnerabilities: Lessons learned from CorePlague
The vulnerabilities left the door open to malicious plug-in updates. Here's what you need to know.
How to mitigate secrets risk — and prevent future breaches
Software secrets are in the crosshairs of malicious actors. Here are three key steps to mitigate risk — and best practices your team can take to prevent future breaches.
.webp&w=3840&q=75)
Application security practices are maturing — but it's a work in progress
While best practices adoption for AppSec is up, many supply chain security problems remain, the OpenSSF SLSA framework survey shows.
The Week in Security: YoroTrooper steals credentials in Europe, AI-created videos spread malware
Welcome to the latest edition of The Week in Security, which brings you the newest headlines from both the world and our team across the full stack of security: application security, cybersecurity, and beyond.
GitHub enforces 2FA — it’s about time (given the state of supply chain security)
GitHub just got a little safer, by finally forcing users into two-factor authentication. What took you so long, Microsoft?
Introducing New Secrets Management Capabilities For Mitigating Software Supply Chain Risk
ReversingLabs is giving dev and app sec teams something new: broader visibility into software supply chain risks — and data-driven prioritization to automatically suppress third-party secrets and other false positive results.
Fixing secrets leaks requires holistic software stack protection
The recent hacks at CircleCI and other organizations show that your software supply chain may be a grab bag of software secrets. Only an end-to-end security approach can solve the problem.
When it comes to financial services, mind the gaps in your AppSec testing
Why you need to upgrade to software supply chain security: Adversaries can compromise your organization without comprehensive malware identification.
PyPI repo poisoned with "Colour-Blind" RAT
Here are the key takeaways from the Colour-Blind remote access trojan, with insights from supply chain security experts
The Week in Security: Lazarus attacks same South Korean entity twice, use of hard-coded secrets is up
Welcome to the latest edition of The Week in Security, which brings you the newest headlines from both the world and our team across the full stack of security: application security, cybersecurity, and beyond.
Why software transparency is critical
Understanding supply chain security is critical in a software-driven society. Here's an overview of our upcoming book.