Collecting Cyber-News from over 60 sources

Tag: programming

The Risks of AI-Generated Software Development

Oct 2, 2025 8:41 PM

Tags: ai, programming, risk, software
Chinese hackers breached critical infrastructure globally using enterprise network gear

Sep 29, 2025 3:08 PM

Tags: access, backdoor, breach, business, china, communications, control, cve, defense, exploit, framework, germany, government, group, hacker, infrastructure, Internet, korea, law, malware, military, monitoring, network, open-source, penetration-testing, programming, service, threat, tool, update, vpn, vulnerability

72-hour vulnerability exploitation window: RedNovember demonstrated the ability to weaponize newly disclosed vulnerabilities faster than most organizations could deploy patches, researchers found. When researchers published proof-of-concept code for Check Point VPN vulnerability CVE-2024-24919 on May 30, 2024, RedNovember was attacking vulnerable systems by June 3.That campaign hit at least 60 organizations across Brazil, Germany, Japan,…
AI coding assistants amplify deeper cybersecurity risks

Sep 25, 2025 9:49 AM

Tags: access, ai, api, application-security, attack, authentication, business, ceo, ciso, cloud, compliance, control, cybersecurity, data, data-breach, detection, fintech, flaw, governance, injection, leak, LLM, metric, open-source, programming, radius, risk, risk-management, service, software, startup, strategy, threat, tool, training, vulnerability

‘Shadow’ engineers and vibe coding compound risks: Ashwin Mithra, global head of information security at continuous software development firm Cloudbees, notes that part of the problem is that non-technical teams are using AI to build apps, scripts, and dashboards.”These shadow engineers don’t realize they’re part of the software development life cycle, and often bypass critical…
Google DORA Research: Software Developers Use AI ‘Heavily’

Sep 24, 2025 5:16 AM

Tags: ai, dora, google, programming, software

Google’s State of AI-assisted Software Development Report 2025 reveals AI adoption increased, but trust in AI is still uneven. The post Google DORA Research: Software Developers Use AI ‘Heavily’ appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-dora-ai-report-2025/
Apple’s New Memory Integrity Enforcement

Sep 23, 2025 3:16 PM

Tags: apple, computer, data, iphone, programming, software, spyware, tool, unauthorized, vulnerability

Apple has introduced a new hardware/software security feature in the iPhone 17: “Memory Integrity Enforcement,” targeting the memory safety vulnerabilities that spyware products like Pegasus tend to use to get unauthorized system access. From Wired: In recent years, a movement has been steadily growing across the global tech industry to address a ubiquitous and insidious…
CSO Awards winners highlight security innovation and transformation

Sep 22, 2025 10:16 AM

Tags: ai, attack, automation, awareness, best-practice, business, ciso, cloud, compliance, conference, control, cyber, cybersecurity, data, defense, detection, finance, flaw, framework, governance, group, guide, infrastructure, intelligence, login, malicious, metric, mitre, network, penetration-testing, phishing, privacy, programming, risk, risk-management, service, siem, skills, soc, software, technology, threat, tool, training, update, vulnerability, vulnerability-management

FSU tackles third-party risk with tighter vendor management program: Organization: Florida State UniversityProject: Third-Party Risk Management ProgramSecurity leader: Bill Hunkapiller, CISOOfficials at Florida State University wanted to ensure that data shared with outside entities was well protected. To achieve that, CISO Bill Hunkapiller and his team revamped its third-party risk management program so that the…
Using Smartphone Cameras for Easy Eye Vein Verification

Sep 21, 2025 4:16 PM

Tags: authentication, cctv, programming, software

Discover how smartphone cameras can be used for easy eye vein verification. Learn about the software development, security, and future trends of this biometric authentication method. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/using-smartphone-cameras-for-easy-eye-vein-verification/
DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams

Sep 21, 2025 2:16 PM

Tags: crypto, gitlab, hacker, jobs, korea, malware, programming, scam, software, threat

Threat actors with ties to the Democratic People’s Republic of Korea (aka DPRK or North Korea) have been observed leveraging ClickFix-style lures to deliver a known malware called BeaverTail and InvisibleFerret.”The threat actor used ClickFix lures to target marketing and trader roles in cryptocurrency and retail sector organizations rather than targeting software development roles,” GitLab…
How AI Is Changing the Software Development Process, and Product

Sep 20, 2025 2:15 PM

Tags: ai, programming, software
Top 10 Best API Security Testing Companies in 2025

Sep 19, 2025 4:16 PM

Tags: api, attack, business, cyber, defense, programming, service

In today’s rapidly evolving digital landscape, APIs (Application Programming Interfaces) have become the backbone of online business, connecting services, and enabling new customer experiences. However, as the API footprint grows, so does the attack surface making robust API security testing a critical pillar of enterprise cyber defense in 2025. Whether you’re a security analyst, DevSecOps…
Top 10 Best API Security Testing Companies in 2025

Sep 19, 2025 4:16 PM

Tags: api, attack, business, cyber, defense, programming, service

In today’s rapidly evolving digital landscape, APIs (Application Programming Interfaces) have become the backbone of online business, connecting services, and enabling new customer experiences. However, as the API footprint grows, so does the attack surface making robust API security testing a critical pillar of enterprise cyber defense in 2025. Whether you’re a security analyst, DevSecOps…
Top 10 Best API Security Testing Companies in 2025

Sep 19, 2025 4:16 PM

Tags: api, attack, business, cyber, defense, programming, service

In today’s rapidly evolving digital landscape, APIs (Application Programming Interfaces) have become the backbone of online business, connecting services, and enabling new customer experiences. However, as the API footprint grows, so does the attack surface making robust API security testing a critical pillar of enterprise cyber defense in 2025. Whether you’re a security analyst, DevSecOps…
Cloudflare Confirms API Outage Caused by React useEffect Overload Issue

Sep 19, 2025 9:15 AM

Tags: api, cyber, infrastructure, programming, service

Cloudflare experienced a significant outage on September 12, 2025, affecting its Tenant Service API, multiple APIs, and the Cloudflare Dashboard. The company has confirmed that the incident was primarily triggered by a React programming bug that caused excessive API calls, overwhelming critical infrastructure components. Technical Root Cause Identified The outage originated from a coding error…
Cloudflare Confirms API Outage Caused by React useEffect Overload Issue

Sep 19, 2025 9:15 AM

Tags: api, cyber, infrastructure, programming, service

Cloudflare experienced a significant outage on September 12, 2025, affecting its Tenant Service API, multiple APIs, and the Cloudflare Dashboard. The company has confirmed that the incident was primarily triggered by a React programming bug that caused excessive API calls, overwhelming critical infrastructure components. Technical Root Cause Identified The outage originated from a coding error…
Microsoft and Cloudflare execute ‘rugpull’ on massive phishing empire

Sep 17, 2025 4:15 PM

Tags: access, ai, attack, blockchain, breach, computer, credentials, crime, crimes, crypto, cybercrime, data, detection, exploit, extortion, finance, fraud, infrastructure, international, law, microsoft, phishing, programming, scam, service, strategy, threat, tool

Legal victory with limitations: Microsoft’s investigation identified Joshua Ogundipe, based in Nigeria, as the operation’s leader and primary architect. The company filed a lawsuit against Ogundipe and four associates listed as John Does in late August, then obtained a court order from the US District Court for the Southern District of New York in early…
No More Blind Spots: Achieving Complete SDLC Visibility in a Multi-Cloud World

Sep 17, 2025 1:15 AM

Tags: access, attack, breach, business, ciso, cloud, compliance, container, control, data, exploit, identity, infrastructure, least-privilege, monitoring, programming, risk, service, software, threat, vulnerability

Struggling with a messy, multi-cloud environment? Learn how Tenable’s unified cloud security approach helps you eliminate dangerous blind spots, attain complete visibility and control, and secure your assets from the first line of code to full production. Key takeaways Fragmented multi-cloud environments create risky blind spots, making unified visibility essential to identify and manage security…
Managing AI Risks in the Modern Software Supply Chain

Sep 17, 2025 12:15 AM

Tags: ai, intelligence, programming, risk, software, supply-chain
Top 10 Best Dynamic Application Security Testing (DAST) Platforms in 2025

Sep 16, 2025 5:16 PM

Tags: application-security, cyber, programming, software, tool

In today’s fast-paced software development world, where applications are released at an unprecedented rate, ensuring their security is more critical than ever. Dynamic Application Security Testing (DAST) has emerged as a fundamental practice for modern development teams. DAST tools, often referred to as >>black box
Cybersecurity Snapshot: Security Lags Cloud and AI Adoption, Tenable Report Finds, as CISA Lays Out Vision for CVE Program’s Future

Sep 12, 2025 5:16 PM

Tags: access, ai, api, attack, automation, best-practice, breach, bug-bounty, business, cisa, cloud, communications, computer, control, cve, cyber, cybersecurity, data, data-breach, defense, encryption, exploit, framework, google, governance, government, identity, infrastructure, intelligence, international, Internet, linkedin, mitre, network, nist, office, open-source, privacy, programming, RedTeam, resilience, risk, risk-management, service, skills, software, strategy, tactics, technology, threat, tool, update, vulnerability

Check out Tenable’s report detailing challenges and best practices for cloud and AI security. Plus, CISA rolled out a roadmap for the CVE Program, while NIST updated its guidelines for secure software patches. And get the latest on TLS/SSL security and AI attack disclosures! Here are five things you need to know for the week…
Brazil lesbian dating app shuts down after security flaw exposes sensitive user data

Sep 9, 2025 5:08 PM

Tags: data, flaw, programming

On Monday, independent researchers revealed that the app’s application programming interface (API) reportedly contained a flaw that allowed outsiders to retrieve photos and personal details from other users’ accounts without authorization. First seen on therecord.media Jump to article: therecord.media/brazil-lesbian-dating-app-shuts-down-vulnerability
71% of CISOs hit with third-party security incident this year

Sep 9, 2025 10:08 AM

Tags: access, ai, application-security, attack, backdoor, breach, ceo, cisa, ciso, cloud, compliance, control, credentials, cyber, cybersecurity, data, defense, exploit, incident response, intelligence, malicious, malware, open-source, penetration-testing, phishing, programming, pypi, resilience, risk, risk-management, sbom, security-incident, service, software, startup, supply-chain, threat, tool

Software supply chain threats: The software supply chain is heavily reliant on code developed by third-party developers, something only likely to increase with the advent of AI.Brian Fox, co-founder and CTO of open-source software security vendor Sonatype, says that “enormously complex” software supply chains pose a growing threat.”Too many organizations have no idea what open-source…
71% of CISOs hit with third-party security incident this year

Sep 9, 2025 10:08 AM

Tags: access, ai, application-security, attack, backdoor, breach, ceo, cisa, ciso, cloud, compliance, control, credentials, cyber, cybersecurity, data, defense, exploit, incident response, intelligence, malicious, malware, open-source, penetration-testing, phishing, programming, pypi, resilience, risk, risk-management, sbom, security-incident, service, software, startup, supply-chain, threat, tool

Software supply chain threats: The software supply chain is heavily reliant on code developed by third-party developers, something only likely to increase with the advent of AI.Brian Fox, co-founder and CTO of open-source software security vendor Sonatype, says that “enormously complex” software supply chains pose a growing threat.”Too many organizations have no idea what open-source…
71% of CISOs hit with third-party security incident this year

Sep 9, 2025 10:08 AM

Tags: access, ai, application-security, attack, backdoor, breach, ceo, cisa, ciso, cloud, compliance, control, credentials, cyber, cybersecurity, data, defense, exploit, incident response, intelligence, malicious, malware, open-source, penetration-testing, phishing, programming, pypi, resilience, risk, risk-management, sbom, security-incident, service, software, startup, supply-chain, threat, tool

Software supply chain threats: The software supply chain is heavily reliant on code developed by third-party developers, something only likely to increase with the advent of AI.Brian Fox, co-founder and CTO of open-source software security vendor Sonatype, says that “enormously complex” software supply chains pose a growing threat.”Too many organizations have no idea what open-source…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
UltraViolet Adds AppSec Services Depth With Black Duck Deal

Sep 5, 2025 11:20 PM

Tags: application-security, cyber, defense, programming, service, software

Black Duck AppSec Services Buy Marks Shift Toward Offensive Assessment Services. UltraViolet Cyber’s acquisition of Black Duck’s application security testing services deepens its offensive capabilities and adds 400 people to its global workforce. The deal enables greater integration of assessment and defense across the software development lifecycle. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ultraviolet-adds-appsec-services-depth-black-duck-deal-a-29377
Alert: Exploit available to threat actors for SAP S/4HANA critical vulnerability

Sep 5, 2025 5:21 AM

Tags: access, attack, authentication, business, ciso, credentials, data, exploit, malicious, monitoring, password, programming, sans, sap, service, threat, vulnerability, zero-day

delete and insert data directly in the SAP Database;creating SAP users with SAP_ALL; download password hashes; modify business processes.”Historically, it has been difficult to apply patches to these complex systems, and many organizations will require careful (and slow) testing before the patches are deployed in production,” Johannes Ullrich, dean of research at the SANS Institute, told CSO.”ERP…
Five habits of highly secure development teams

Sep 3, 2025 7:19 AM

Tags: privacy, programming, software

In this Help Net Security video, Brendon Collins, Principal Consultant at Optiv, explores how organizations can embed security and privacy into the software development … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/03/devsecops-in-sdlc-secure-development-teams-video/
AI Governance and Risk in Securing Software Supply Chains

Sep 2, 2025 9:20 PM

Tags: ai, governance, intelligence, programming, risk, software, supply-chain