Tag: programming

Cybersecurity Snapshot: Security Lags Cloud and AI Adoption, Tenable Report Finds, as CISA Lays Out Vision for CVE Program’s Future

Sep 12, 2025 5:16 PM

Tags: access, ai, api, attack, automation, best-practice, breach, bug-bounty, business, cisa, cloud, communications, computer, control, cve, cyber, cybersecurity, data, data-breach, defense, encryption, exploit, framework, google, governance, government, identity, infrastructure, intelligence, international, Internet, linkedin, mitre, network, nist, office, open-source, privacy, programming, RedTeam, resilience, risk, risk-management, service, skills, software, strategy, tactics, technology, threat, tool, update, vulnerability

Check out Tenable’s report detailing challenges and best practices for cloud and AI security. Plus, CISA rolled out a roadmap for the CVE Program, while NIST updated its guidelines for secure software patches. And get the latest on TLS/SSL security and AI attack disclosures! Here are five things you need to know for the week…
Brazil lesbian dating app shuts down after security flaw exposes sensitive user data

Sep 9, 2025 5:08 PM

Tags: data, flaw, programming

On Monday, independent researchers revealed that the app’s application programming interface (API) reportedly contained a flaw that allowed outsiders to retrieve photos and personal details from other users’ accounts without authorization. First seen on therecord.media Jump to article: therecord.media/brazil-lesbian-dating-app-shuts-down-vulnerability
71% of CISOs hit with third-party security incident this year

Sep 9, 2025 10:08 AM

Tags: access, ai, application-security, attack, backdoor, breach, ceo, cisa, ciso, cloud, compliance, control, credentials, cyber, cybersecurity, data, defense, exploit, incident response, intelligence, malicious, malware, open-source, penetration-testing, phishing, programming, pypi, resilience, risk, risk-management, sbom, security-incident, service, software, startup, supply-chain, threat, tool

Software supply chain threats: The software supply chain is heavily reliant on code developed by third-party developers, something only likely to increase with the advent of AI.Brian Fox, co-founder and CTO of open-source software security vendor Sonatype, says that “enormously complex” software supply chains pose a growing threat.”Too many organizations have no idea what open-source…
71% of CISOs hit with third-party security incident this year

Sep 9, 2025 10:08 AM

Tags: access, ai, application-security, attack, backdoor, breach, ceo, cisa, ciso, cloud, compliance, control, credentials, cyber, cybersecurity, data, defense, exploit, incident response, intelligence, malicious, malware, open-source, penetration-testing, phishing, programming, pypi, resilience, risk, risk-management, sbom, security-incident, service, software, startup, supply-chain, threat, tool

Software supply chain threats: The software supply chain is heavily reliant on code developed by third-party developers, something only likely to increase with the advent of AI.Brian Fox, co-founder and CTO of open-source software security vendor Sonatype, says that “enormously complex” software supply chains pose a growing threat.”Too many organizations have no idea what open-source…
71% of CISOs hit with third-party security incident this year

Sep 9, 2025 10:08 AM

Tags: access, ai, application-security, attack, backdoor, breach, ceo, cisa, ciso, cloud, compliance, control, credentials, cyber, cybersecurity, data, defense, exploit, incident response, intelligence, malicious, malware, open-source, penetration-testing, phishing, programming, pypi, resilience, risk, risk-management, sbom, security-incident, service, software, startup, supply-chain, threat, tool

Software supply chain threats: The software supply chain is heavily reliant on code developed by third-party developers, something only likely to increase with the advent of AI.Brian Fox, co-founder and CTO of open-source software security vendor Sonatype, says that “enormously complex” software supply chains pose a growing threat.”Too many organizations have no idea what open-source…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
UltraViolet Adds AppSec Services Depth With Black Duck Deal

Sep 5, 2025 11:20 PM

Tags: application-security, cyber, defense, programming, service, software

Black Duck AppSec Services Buy Marks Shift Toward Offensive Assessment Services. UltraViolet Cyber’s acquisition of Black Duck’s application security testing services deepens its offensive capabilities and adds 400 people to its global workforce. The deal enables greater integration of assessment and defense across the software development lifecycle. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ultraviolet-adds-appsec-services-depth-black-duck-deal-a-29377
Alert: Exploit available to threat actors for SAP S/4HANA critical vulnerability

Sep 5, 2025 5:21 AM

Tags: access, attack, authentication, business, ciso, credentials, data, exploit, malicious, monitoring, password, programming, sans, sap, service, threat, vulnerability, zero-day

delete and insert data directly in the SAP Database;creating SAP users with SAP_ALL; download password hashes; modify business processes.”Historically, it has been difficult to apply patches to these complex systems, and many organizations will require careful (and slow) testing before the patches are deployed in production,” Johannes Ullrich, dean of research at the SANS Institute, told CSO.”ERP…
Five habits of highly secure development teams

Sep 3, 2025 7:19 AM

Tags: privacy, programming, software

In this Help Net Security video, Brendon Collins, Principal Consultant at Optiv, explores how organizations can embed security and privacy into the software development … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/03/devsecops-in-sdlc-secure-development-teams-video/
AI Governance and Risk in Securing Software Supply Chains

Sep 2, 2025 9:20 PM

Tags: ai, governance, intelligence, programming, risk, software, supply-chain
AI Governance and Risk in Securing Software Supply Chains

Sep 2, 2025 9:20 PM

Tags: ai, governance, intelligence, programming, risk, software, supply-chain
Electronics Manufacturer Data I/O Suffers Ransomware Breach

Aug 28, 2025 6:23 PM

Tags: attack, breach, cyber, cybersecurity, data, incident response, infrastructure, programming, ransomware, threat

Data I/O Corporation, a well-known electronics firm that specializes in device programming and security provisioning solutions, revealed a ransomware attack that penetrated its internal IT infrastructure in a major cybersecurity event. The incident, detected on August 16, 2025, prompted an immediate activation of the company’s incident response protocols, highlighting the persistent threat of ransomware in…
AI, Malware, and the Rise of Software Development Infiltration

Aug 27, 2025 9:23 PM

Tags: ai, malicious, malware, open-source, programming, software
TDL001 – Cybersecurity Explained: Privacy, Threats, and the Future – Chester Wisniewski

Aug 27, 2025 8:23 PM

Tags: access, ai, attack, backdoor, breach, business, ciso, computer, country, crime, crimes, cyber, cybercrime, cybersecurity, data-breach, defense, detection, edr, email, finance, firewall, gartner, government, guide, hacker, hacking, Hardware, infosec, Internet, jobs, linkedin, mail, malicious, microsoft, military, monitoring, network, password, phishing, phone, privacy, programming, ransomware, risk, russia, scam, skills, software, sophos, spam, sql, strategy, switch, technology, threat, update, virus, vulnerability, wifi, windows

Summary “The Defenders Log” Episode 1 features host David Redekop and guest Chet Wisniewski discussing the dynamic world of cybersecurity. Wisniewski, with decades of experience, traces his journey from early BBS and phone network exploration to becoming a cybersecurity expert. They delve into the evolution of hacking, the emergence of profitable cybercrime like email spam,…
TDL003 – Breaking Barriers: IPv6 Adoption and DNS Transformation with Tommy Jensen

Aug 27, 2025 5:23 AM

Tags: access, ai, apple, attack, backup, banking, browser, business, ceo, chrome, ciso, compliance, computer, computing, control, country, credentials, cybersecurity, data, data-breach, ddos, dns, encryption, endpoint, google, government, group, international, Internet, jobs, law, microsoft, mobile, network, phishing, phone, privacy, programming, radius, risk, service, smishing, strategy, switch, technology, threat, update, vpn, windows, zero-trust

Summary This episode of the Defender’s Log features special guest Tommy Jensen, an internet technologist specializing in IPv6, Zero Trust, and standards. Jensen’s career path, from an AppleCare contractor to a key figure in advancing internet technologies, is explored. The discussion highlights the critical importance and challenges of migrating to IPv6 and the necessity of…
Key findings from “The State of Embedded Software Quality and Safety 2025” report

Aug 26, 2025 4:54 PM

Tags: ai, programming, sbom, software

Discover key trends and challenges in embedded software development, from AI integration to SBOM compliance. Learn how Black Duck’s solutions can help ensure quality and safety. The post Key findings from “The State of Embedded Software Quality and Safety 2025” report appeared first on Blog. First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/08/key-findings-from-the-state-of-embedded-software-quality-and-safety-2025-report/
Key findings from “The State of Embedded Software Quality and Safety 2025” report

Aug 26, 2025 4:54 PM

Tags: ai, programming, sbom, software

Discover key trends and challenges in embedded software development, from AI integration to SBOM compliance. Learn how Black Duck’s solutions can help ensure quality and safety. The post Key findings from “The State of Embedded Software Quality and Safety 2025” report appeared first on Blog. First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/08/key-findings-from-the-state-of-embedded-software-quality-and-safety-2025-report/
2025 CSO Hall of Fame: Meg Anderson on AI, strategic security investments, and life after InfoSec

Aug 25, 2025 6:54 PM

Tags: ai, automation, business, ciso, conference, cyber, cybersecurity, finance, infosec, jobs, metric, phishing, programming, risk, risk-management, software, strategy, technology, threat, tool

Which technologies are you most cautious about from a CISO’s point of view, and why?: Meg Anderson: I’m cautious of “solutions” that don’t solve a strategic problem. CISOs only have so much budget and mindshare. You need to understand where a tool fits in your investment and strategic roadmap. There were times when my team…
Report Surfaces Increased Number of API Security Issues Involving AI

Aug 25, 2025 4:54 PM

Tags: ai, api, cve, intelligence, programming, threat, vulnerability

A report published today by Wallarm finds that of the 639 Common Vulnerabilities and Exposures (CVEs) pertaining to application programming interfaces (APIs) reported in Q2 2025, 34 involved issues relating to some type of use case tied to artificial intelligence (AI). Overall, two-thirds of the API CVEs represent either critical or high severity threats, according..…
What is the cost of a data breach?

Aug 22, 2025 9:54 AM

Tags: access, ai, api, attack, automation, breach, business, ciso, compliance, cyber, cyberattack, cybersecurity, data, data-breach, detection, finance, fraud, healthcare, ibm, identity, incident response, india, infrastructure, insurance, intelligence, jobs, law, metric, privacy, programming, ransom, ransomware, regulation, risk, security-incident, service, skills, software, supply-chain, technology, theft, threat, tool, vulnerability

Canada ($4.84 million) and the UK ($4.14million) remain in the top 10 hardest hit, with ASEAN or Association of Southeast Asian Nations ($3.67 million), Australia ($2.55 million), and India ($2.51 million) among the top 15. Breaches by industry: Healthcare remains the industry hit with the highest costs per breach by far, at $7.42 million despite…
Threat Actors Exploiting Victims’ Machines for Bandwidth Monetization

Aug 21, 2025 10:54 PM

Tags: cve, cvss, cyber, cybersecurity, exploit, flaw, programming, remote-code-execution, software, threat, vulnerability

Cybersecurity researchers have uncovered an ongoing campaign where threat actors exploit the critical CVE-2024-36401 vulnerability in GeoServer, a geospatial database, to remotely execute code and monetize victims’ bandwidth. This remote code execution flaw, rated at a CVSS score of 9.8, enables attackers to deploy legitimate software development kits (SDKs) or modified applications that generate passive…
ASPM buyer’s guide: 7 products to help secure your applications

Aug 20, 2025 10:56 AM

Tags: access, ai, api, application-security, attack, business, ceo, cloud, compliance, container, crowdstrike, data, detection, endpoint, exploit, gartner, google, guide, iam, identity, infrastructure, ivanti, marketplace, microsoft, monitoring, okta, open-source, oracle, programming, risk, software, supply-chain, threat, tool, vulnerability, vulnerability-management

Protect the software development lifecycle (SDLC) and supply chain pipelinesAutomate software testingIntegrate with various applications to mitigate and remove various risksFeatures offered by ASPMs vary widely. As a result, tools can prove difficult to evaluate in terms of exactly what is being protected, what data and metadata is being collected to inform security judgments, and…
Combining AI and APIs to close the risk visibility gap: A strategic framework

Aug 20, 2025 1:54 AM

Tags: ai, api, exploit, framework, intelligence, programming, risk, vulnerability

API integrations have become the backbone of modern digital interactions, yet they also introduce vulnerabilities that can be exploited if left unchecked. The convergence of artificial intelligence (AI) and application programming interfaces (APIs) offers a promising solution to what many refer to as the “risk visibility gap.” This critical gap is defined as the difference…The…
Secure Software Development Why It Matters

Aug 18, 2025 8:54 PM

Tags: programming, software

Secure Software Development Why It Matters to Every UK SMB (Even If You Don’t Write Code) When most small and medium-sized businesses (SMBs) hear “secure development,” they think: “That doesn’t apply to us, we don’t build apps or write code.” But that’s a dangerous misconception. In today’s interconnected digital ecosystem, secure software development isn’t… First…
UK’s Colt hit by cyberattack, support systems offline amid ransom threat

Aug 18, 2025 2:54 PM

Tags: api, attack, china, communications, cve, cyberattack, data, data-breach, exploit, finance, flaw, group, infrastructure, Internet, microsoft, network, programming, ransom, rce, remote-code-execution, russia, service, software, threat, update, vulnerability

with samples on a Russian Tor site.”We’ve seen already this year that telecom is particularly vulnerable to attacks, and I think this WarLock attack highlights some recurring issues that telecom and large-scale network service providers are starting to see,” said Gabrielle Hempel, Security Operations Strategist at Exabeam. “There’s this operational ripple effect when you’re a…
5 key takeaways from Black Hat USA 2025

Aug 12, 2025 10:12 AM

Tags: access, api, attack, authentication, botnet, business, cisco, cloud, container, control, credentials, data, endpoint, exploit, firmware, flaw, framework, Hardware, iam, login, malicious, malware, network, password, programming, rce, remote-code-execution, service, software, technology, tool, update, usa, vulnerability, windows

Vaults can be cracked open: Critical vulnerabilities in popular enterprise credential vaults were unveiled by security researchers from Cyata during Black Hat.The flaws in various components of HashiCorp Vault and CyberArk Conjur, responsibly disclosed to the vendors and patched before their disclosure, stemmed from subtle logic flaws in authentication, validation, and policy enforcement mechanisms, as…
Erlang/OTP SSH RCE Vulnerability Actively Exploited to Target OT Networks

Aug 11, 2025 7:11 PM

Tags: cve, cvss, cyber, exploit, flaw, network, programming, rce, remote-code-execution, vulnerability

A severe vulnerability, designated CVE-2025-32433 with a CVSS score of 10.0, has been identified in the Secure Shell (SSH) daemon of the Erlang programming language’s Open Telecom Platform (OTP). This flaw permits unauthenticated remote code execution (RCE) by allowing attackers to send SSH connection protocol messages with codes greater than or equal to 80 to…
How Secure Code Review Strengthen Web Apps Security?

Aug 9, 2025 4:11 PM

Tags: breach, data, data-breach, hacker, programming, threat

Twitter recently suffered a data breach due to misconfigured settings in its application programming interface (API). As a result, hackers accessed the personal data of 5.4 million users and leaked it on an online forum. The stolen data was later put up for sale by threat actors for $30,000. Incidents like this serve as a……