OpenSSF warns of Open Source Social Engineering Threats
Linux dodged a bullet. If the XZ exploit had gone undiscovered for only a few more weeks, millions of Linux systems would have been compromised with a backdoor. We were lucky. But can we stay lucky? The Open Source Security Foundation (OpenSF) and the OpenJS Foundation revealed that a similar hackling attempt had targeted several […]
Securing Open Source Software, the Cyber Resilience Act Way
The Eclipse Foundation is spearheading an effort to create a unified framework for secure software development.
Your AI Might be Lying to You
Simple tests can demonstrate whether a code generator is actually doing what you ask.
AISecOps: Expanding DevSecOps to Secure AI and ML
AISecOps, the application of DevSecOps principles to AI/ML and generative AI, means integrating security into models’ life cycles.
Cycode Acquires Bearer to Extend ASPM Platform
Cycode has acquired Bearer, a provider of a set of tools for SAST, API discovery and identification of sensitive data.
Survey Sees Limited DevSecOps Progress Being Made as Vulnerabilities Mount
A recent survey found that, on average, organizations have 55.5 security vulnerabilities each day in their remediation queue, with at least one critical.
Securing the DevOps Pipeline: Tools and Best Practices
Because of the critical nature of the DevOps pipeline, security is becoming a top priority. Here’s how to integrate DevSecOps.
Why DevOps is Key to Software Supply Chain Security
Organizations can maintain their DevOps momentum while protecting the software supply chain by shifting security left.
Cycode Brings Generative AI to App Security Posture Management
Cycode’s generative AI capabilities in its ASPM platform make it simpler for DevSecOps teams to identify the root cause of vulnerabilities.
ReversingLabs Applies AI to Better Secure Application Binaries
ReversingLabs launched a binary analysis tool that uses machine learning algorithms to identify risks before and after apps are deployed.
Veracode Report Shines Spotlight on Massive Application Security Debt
In an analysis of more than a million applications, Veracode found 42% contained flaws that remained unfixed for longer than a year.
Squaring the Circle: How to Make Public APIs Private
Many API attacks are effectively zero-day, novel attacks that exploit recent and unique changes to specific APIs. Here’s how to stop them.
Legit Security Adds Sensors to Detect Usage of Gen AI Tools to Write Code
Legit Security updated its ASPM platform with the ability to detect when developers use generative AI tools to write code.
Survey: Cyberattacks Aimed at Software Supply Chains are Pervasive
A survey found the vast majority of respondents work for organizations that experienced a software supply chain incident in the past 12 months.
GitGuardian Allies With CyberArk to Better Protect App Secrets
GitGuardian has allied with CyberArk to streamline secrets detection and management by making it easier to share insights.
OX Security Optimizes DevSecOps to Improve Application Security
OX Security updated its ASPM platform to enable DevSecOps teams to instantly identify applications with vulnerable code.
Cycode Discloses GitHub Actions Vulnerability in Google Bazel Project
Cycode discovered a command injection vulnerability in the way GitHub Actions updated Google’s open source Bazel project.
Snyk Acquires Helios to Extend Reach of ASPM Platform
With its Helios acquisition, Snyk plans to add an ability to capture application runtime data to extend the capabilities of its ASPM platform.
5 Security Threats DevOps Teams Should Know
DevOps security (DevSecOps) is about breaking down silos and promoting open collaboration across teams.
Survey: Widespread Inability to Remediate App Vulnerabilities
A survey found only 20% of IT and security professionals are confident in their ability to detect a vulnerability before an app is released.
Venafi Adds Ability to Prevent Unauthorized Code From Running
Venafi added an ability to prevent unauthorized code from running in IT environments that make use of its machine identity management platform.
Mobb Extends DevSecOps Reach of Tool to Generate Patches
Mobb added an ability to instantly surface patches for vulnerabilities at the time when code is being committed during a DevSecOps workflow.
Legit Security Applies AI to Detect Vulnerable Application Secrets
Legit Security expanded the scope of its ASPM platform to make use of AI to discover vulnerable application secrets more accurately.