Tag: programming
-
Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
Attackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some industrial control products, to install a Linux bot and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/
-
How CISOs Can Secure AI-Driven Software Development
JFrog CISO Paul Davis on Coding Agent Visibility, Vulnerabilities and Guardrails. AI coding tools are increasing code volume and compressing security timelines. JFrog Field CISO Paul Davis discusses how CIOs and CISOs can improve life cycle visibility, prioritize vulnerabilities in operational context, govern coding agents and manage costs without slowing delivery. First seen on govinfosecurity.com…
-
PHP-ocalypse: How two critical web bugs almost broke the internet
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet, and it’s unlikely to be the last major software scare. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/
-
The race to fix huge PHP code flaw at the heart of the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
The race to fix huge PHP flaw at the heart of the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
Pretty Huge Problem with the internet The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
Critical PHP Vulnerabilities Spark Global Security Alert: Industry Experts React
Two critical PHP vulnerabilities, the widely used programming language underpinning millions of websites and web applications, have prompted urgent warnings from cybersecurity authorities worldwide. Following reports on the 20th October that details of the vulnerabilities had leaked ahead of their scheduled disclosure, PHP developers released emergency security updates on 21 October. The UK’s National Cyber…
-
What is PHP and how serious is the computer language flaw causing website shutdowns?
Tags: attack, computer, cyber, data, exploit, flaw, government, hacker, open-source, programming, vulnerabilityAn estimated 70% of websites use the open-source language. What is the identified vulnerability in it?Website owners faced millions of attempts to exploit a serious security vulnerability in their programming language, it has emerged, triggering a rush by governments and businesses to fix the problem.The <a href=”https://www.theguardian.com/technology/2026/oct/21/flaw-in-php-computer-language-leads-to-shutdown-of-websites-around-world”>newly discovered vulnerabilities in PHP, a programming language that…
-
Pretty Huge Problem with the internet – The Latest
Tags: attack, computer, control, cybersecurity, data, exploit, flaw, government, hacker, Internet, programming, technology, vulnerabilityWebsites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue…
-
Websites across world hit by millions of attempts to exploit PHP code flaw
Tags: computer, control, cybersecurity, data, exploit, flaw, government, Internet, programming, update, vulnerabilityProblem in language that underpins 70% of sites has led governments and companies to pull sites offline to patch faultWebsites around the world have been hit by millions of attempts to exploit a recently discovered vulnerability in their code, cybersecurity companies have said, as the US National Security Agency warned the flaw could allow attackers…
-
PHP releases emergency fixes for 2 critical vulnerabilities
The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw. First seen on cyberscoop.com Jump to article: cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
-
Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities
The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw. First seen on cyberscoop.com Jump to article: cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
-
OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/artificial-intelligence/openai-says-gpt-61-sol-is-dramatically-better-at-migrating-legacy-code/
-
Close Identity Gaps in Software Development Before Unleashing AI
Artificial Intelligence is complicating security in the software development lifecycle, but a Dark Reading roundtable found collaboration, better identity visibility, and reduced testing costs offer CISOs a way ahead. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/close-identity-gaps-sdlc-before-ai
-
Guide to Compliance and Cybersecurity in Healthcare Software Development
Compare five healthcare software development firms and learn how to build secure, compliant products under HIPAA, GDPR and FDA requirements. First seen on hackread.com Jump to article: hackread.com/compliance-cybersecurity-healthcare-software-development/
-
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package known as “tensorlake,” a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.The malicious version 0.5.144 “contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code,” Socket said First seen on thehackernews.com…
-
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling.”Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel,” Nozomi Networks said in a…
-
NIST Issues New Guidance to Protect SSO and API Tokens From Theft and Forgery
The National Institute of Standards and Technology (NIST) has published new implementation guidance to safeguard identity tokens, access tokens, and assertions used in single sign-on, cloud federation, and application programming interface (API) environments. Released on September 15, 2026, NIST Internal Report 8587, titled >>Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for…
-
Malicious actors already using critical GitLab flaw, CISA and others warn
The vulnerability could let unauthenticated users access sensitive files from software-development environments. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/gitlab-vulnerability-exploitation-cisa-kev/830278/
-
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut on Thursday released a new security maintenance release that replaces all previously published emergency patches that were pushed to address two security flaws that have come under active exploitation.The software development company said PaperCut NG/MF versions 26.0.5, 25.0.13 and 24.1.10 are now available for customers to download.”These are Regular Maintenance Releases (MR) that First…
-
AI Agents Hijacked German Wiki to Cheat, OpenAI Delayed Disclosure
AI agents secretly took over a 25-year-old German wiki for two months to cheat on tests, and OpenAI sat on the news until reporters found it first OpenAI finally admitted this weekend that a swarm of its own AI agents hijacked a German programming wiki earlier this year, turning it into a private message board…
-
OpenAI’s German Wiki Hack Is Less About “Rogue AI” Than Failed Agent Containment
OpenAI’s latest foul-up was not a Hollywood-style AI “escape.” Instead, researchers say a swarm of OpenAI agents apparently found a way to turn web read access into write access on DseWiki, a collaboratively editable German programming wiki. The takeover of a German programming wiki, DseWiki, by agents linked to OpenAI is not evidence that AI..…
-
Download: The Agentic Software Development Guide
AI makes it easy to ship more code. It does not make that code easier to trust. Most teams don’t fail because their developers can’t use AI. They fail because the dev’s job … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/02/download-the-agentic-software-development-guide/
-
The Toolchain Is the Target: Securing Software Development in the Agentic Era
JFrog finds AI development tools are expanding the software supply chain and creating new attack paths for organizations. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/the-toolchain-is-the-target-securing-software-development-in-the-agentic-era/
-
Your Coding Assistant Is Shipping Security Vulnerabilities
Tags: access, ai, api, application-security, authentication, compliance, credentials, email, endpoint, framework, github, governance, LLM, programming, risk, service, tool, vulnerabilityYour Coding Assistant Is Shipping Security Vulnerabilities. Here’s How to Fix That. AI coding assistants have gotten remarkably good at writing functional code. Syntax correctness rates are approaching 100%. Developers are more productive than ever. And yet the security picture tells a very different story. Veracode recently evaluated over 150 large language models across vendors…
-
What Is MCP in Software Development and Why Does It Matter
What MCP is in software development, how it connects AI models to tools and data, and why it matters for building scalable AI-powered applications. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/what-is-mcp-in-software-development-and-why-does-it-matter/
-
Using OWASP SAMM to measure secure development maturity
For many UK SMEs, secure development starts with a familiar pattern: a few coding standards, some security testing, and perhaps a checklist for releases. That is a useful foundation, but it does not tell you whether your software development capability is improving in a structured way. This is where OWASP SAMM, the Software Assurance Maturity……
-
From Traditional Development to AI-Native Engineering: ISHIR’s AI Software Engineering Maturity Spectrum
Software development is going through a more fundamental change than adding another productivity tool to the developer stack. The question for CEOs, CIOs, CTOs, and…Read More First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2026/08/from-traditional-development-to-ai-native-engineering-ishirs-ai-software-engineering-maturity-spectrum/
-
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore
Tags: attack, cybersecurity, exploit, flaw, kaspersky, programming, russia, software, threat, vulnerabilityThe threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning instrumentation, electronics, transport, energy, IT, and software development sectors.Russian cybersecurity vendor Kaspersky said it detected the attacks in July 2026.The activity involves exploiting a vulnerability chain First seen on thehackernews.com…
-
Secure design reviews and architecture checkpoints in the SDLC
Secure design reviews and architecture checkpoints in the SDLC For many UK SMEs, security work becomes most effective when it is built into the way software is designed and delivered, rather than added at the end. A secure design review is one of the most useful points in the software development lifecycle (SDLC) to catch……