
Bad Actor Targets Linux, macOS Developers with Typosquatted Go Packages
The attacker published at least seven malicious packages on the Go Module Mirror that, if installed, will deliver a backdoor.

North Korean Bad Actor’s Fake Job Offer Scam Targets Developers
Freelance developers around the world are being targeted by North Korean bad actors posing as job recruiters who as part of the fake application process entice them to run software jobs that actually compromise their systems with infostealer malware.

North Korea’s Lazarus Group Targets Developers, Supply Chain
North Korea’s notorious Lazarus Group is using an advanced malicious implant to target cryptocurrency wallets and spreading it via legitimate GitHub profile and possibly through npm packages. The ongoing campaign, dubbed Operation Marstech Mayhem, is the example of a threat group using open-source code repositories like GitHub, npm, and Python Package Index (PyPI) in software supply […]

Typosquat Supply Chain Attack Targets Go Developers
A backdoor that impersonates a widely used database module in the popular Go programming language can give hackers control of infected systems, according to a senior threat intelligence analyst with developer-focused platform provider Socket. The malicious package, which the threat actor first published in November 2021 and remains in the Go Module Proxy, typosquats the […]

CISA Pushes Steps to Better Secure Software and Product Designs
The country’s top cybersecurity agency is urging developers to take steps to ensure the software they’re building and the products they roll out are secure and protect end users. The Cybersecurity and Infrastructure Security Agency (CISA) this week rolled out a series of recommendations that it wants businesses and critical infrastructure organizations to adopt to […]

Fake Stars in GitHub a Growing Security Threat, Analysis Finds
There was a surge of inauthentic stars on code repositories in 2024, ramping up the threat of software supply chain attacks.

Developers’ Enthusiasm for Generative AI is Growing: Survey
Programmers say that adopting generative AI is a top priority for their companies and that such investments create openings for new products.

CISA: Critical Jenkins Flaw Exploited in Ransomware Attacks
The security vulnerability in the popular open-source development tool helps threat actors gain initial access into victims’ systems.

White House to Spend $11 Million to Study Open Source Software Use
Hardening the security around open source software has been a key part of the White House’s larger cybersecurity efforts since President Biden released his executive order for improving the United States’ security posture in May 2021, only months after taking office. Now the Biden Administration and the Department of Homeland Security (DHS) are putting $11 […]

DARPA Turns to AI to Help Turn C and C++ Code Into Rust
DARPA will lean on emerging AI capabilities to deal with the costly and time-consuming challenge of rewriting C and C++ code to Rust in a move designed to meet the push for federal agencies and private organizations to adopt memory-safe programming languages.

CrowdStrike CEO: 97% of Windows Systems Back Online After Crash
More than 97% of the Windows desktops that were suddenly disrupted a week ago by a problematic software update from CrowdStrike are back online, according to the cybersecurity company’s top executive, but the pain from the worldwide outage will continue to be felt.

More Than 3,000 ‘Ghost’ Accounts Spreading Malware on GitHub
GitHub and similar open-source code and project repositories have become a common target of cybercriminals looking to lure developers into unknowingly downloading malicious scripts.

CrowdStrike: Faulty Test Software Led to Global Windows Crash
A tool for validating Rapid Response Content updates to the Falcon software improperly let one with “problematic content” get through.

CrowdStrike Software Update Sparks Microsoft Outage, Global Chaos
Airlines, hospitals, banks and other businesses were disrupted when a faulty software update knocked Windows users of their systems.

GitLab Fixes Security Flaw That Lets Attackers Run Pipeline Jobs
If left unpatched, the vulnerability in the code repository could let threat actors run malicious code and access sensitive information.

Polyfill Becomes a Supply-Chain Risk to 100,000 Websites
A Chinese company in February bought the domain and GitHub account for Polyfill, a popular open-source library used by more than 100,000 websites to deliver JavaScript code.

Most Critical Open Source Projects Lack Memory-Safe Code, CISA Says
The country’s top cybersecurity agency is continuing to urge software developers to adopt memory-safe programming languages to help reduce the number of vulnerabilities in their products.
AI a Key Driver Behind HPE’s $14 Billion Deal for Juniper
HPE’s proposed Juniper buy hopes to center around its networking business with AI capabilities and its GreenLake edge-to-cloud platform at its foundation.