AI coding is a big security problem when most security teams are still relying on tools designed for a world where human-written code remains prevalent.
Read More about CyberScoop: The dual reality of AI-augmented development: innovation and risk
At ReversingLabs, we’ve identified seven critical risks that plague commercial software, or what we call Commercial Software’s Seven Deadly Sins.
Read More about Information Security Buzz: Commercial Software’s Seven Deadly Sins
As package registries find better ways to combat cyberattacks, threat actors are finding other methods for spreading their malware to developers.
Read More about Dark Reading: Hackers Post Dozens of Malicious Copycat Repos to GitHub
ReversingLabs' analysis of ethers-provider2 has revealed that it's nothing but a trojanized version of the widely-used ssh2 npm package.
Read More about The Hacker News: Malicious npm Package Modifies Local 'ethers' Library to Launch Reverse Shell Attacks
Microsoft Security’s artificial intelligence (AI) security team recently shared its findings from a multi-year study that involved red teaming 100 generative AI (GenAI) products.
Read More about SC Media: AI has become the supply chain
Researchers have spotted two machine learning (ML) models containing malicious code on Hugging Face Hub, the popular online repository for datasets and pre-trained models.
Read More about HelpNetSecurity: Malicious ML models found on Hugging Face Hub
Companies pursing internal AI development using models from Hugging Face and other open source repositories need to focus on supply chain security and checking for vulnerabilities.
Read More about Dark Reading: Open Source AI Models: Perfect Storm for Malicious Code, Vulnerabilities
The popular Python Pickle serialization format offers ways for attackers to inject malicious code that will be executed on computers when loading models with PyTorch.
Read More about CSO Online: Attackers hide malicious code in Hugging Face AI model Pickle files
Researchers at Reversing Labs have discovered two malicious machine learning (ML) models available on Hugging Face, the leading hub for sharing AI models and applications.
Read More about Infosecurity: Malicious AI Models on Hugging Face Exploit Novel Attack Technique
A widely used python module for machine-learning developers can be loaded with malware and bypass detection measures.
Read More about Cyberscoop: Hugging Face platform continues to be plagued by vulnerable ‘pickles’
Olympic scammers go for gold.
Read More about CyberWire Daily: Crypto client or cyber trap?
Developers targeted by malicious Microsoft VSCode extensions
Read More about TechRadar: New attacks exploit VSCode extensions and npm packages
ReversingLabs explained how attackers often use multiple platforms to spread their malware, creating a more extensive attack surface that targets developers across ecosystems.
Read More about Forbes: Warning Crypto Investors—This Malicious Code Could Empty Your Wallet
In a report by Reversing Labs, researchers say the malicious extensions first appeared in the VSCode marketplace in October.
Read More about Bleeping Computer: Malicious Microsoft VSCode extensions target devs, crypto community
Lessons learned from the headline-grabbing cybersecurity incidents of 2024
Read More about The Last Watchdog: Lessons learned from the headline-grabbing cybersecurity incidents of 2024