Tag: software
-
Hospital for Sick Children discloses employee data breach due to third-party software flaw
First seen on scworld.com Jump to article: www.scworld.com/brief/hospital-for-sick-children-discloses-employee-data-breach-due-to-third-party-software-flaw
-
Microsoft patches flaw in Entra ID identity software
First seen on scworld.com Jump to article: www.scworld.com/news/microsoft-patches-flaw-in-entra-id-identity-software
-
NASA ground control software vulnerability could allow spacecraft access
First seen on scworld.com Jump to article: www.scworld.com/brief/nasa-ground-control-software-vulnerability-could-allow-spacecraft-takeover
-
Digitalisierung ohne Insellösungen Wie Unternehmen ihre Systeme und Prozesse besser miteinander verbinden
Tags: softwareNeue Software ist schnell eingeführt. Schwieriger wird es, wenn sie mit dem zusammenspielen muss, was im Unternehmen bereits vorhanden ist. Während Kundendaten beispielsweise im CRM liegen und Aufträge über das ERP laufen, werden Dokumente oder Informationen aus der Buchhaltung oft an anderer Stelle verarbeitet. In den einzelnen Bereichen wirkt die Arbeit damit zunächst digital. Reibungsverluste…
-
6 NIST Software Criteria for Financial Institutions
Tags: compliance, cyber, cybersecurity, dora, finance, framework, nist, regulation, software, threat<div cla Financial institutions face overlapping requirements from SEC cyber disclosure rules, NYDFS cybersecurity regulations, and sector-specific mandates like DORA in Europe. When your compliance team juggles multiple frameworks while your security operations center monitors threats in real time, the gap between technical findings and boardroom reporting grows wider by the day. First seen on…
-
Malware Hijacks Android Car Head Units
Malware is abusing car infotainment updates to install proxy software, turning Android head units into nodes for the BADBOX network. Kaspersky researchers found something in June 2026 that made them stop and look twice: an Android app with no interface at all, installed like any ordinary app but making zero effort to disguise itself as…
-
Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution
A critical flaw (CVSS 9.4) in NASA/JPL’s AIT-GUI let anyone send unauthenticated commands to spacecraft instruments. Cycode researchers found that AIT-GUI, the browser-based operator console in NASA/JPL open-source AMMOS Instrument Toolkit, shipped with no authentication, no session checks, and no CSRF protection on any of its state-changing endpoints. >>AIT-GUI, the web front end of NASA/JPL’s…
-
91 Spring CVEs: The AI Vulnerability Consumption Problem
Tags: access, advisory, ai, attack, cloud, cve, cvss, data, data-breach, framework, guide, injection, intelligence, open-source, risk, service, software, tool, update, vulnerability<div cla TL;DR Broadcom released a large batch of Spring security advisories on August 20, 2026, with Sonatype tracking 91 CVEs across Spring Framework and related projects. At the time of publishing, Sonatype Guide currently identifies 209,569 software components affected by the security event. The disclosure comes amid a dramatic rise in AI-assisted vulnerability discovery. Broadcom…
-
Using OWASP SAMM to measure secure development maturity
For many UK SMEs, secure development starts with a familiar pattern: a few coding standards, some security testing, and perhaps a checklist for releases. That is a useful foundation, but it does not tell you whether your software development capability is improving in a structured way. This is where OWASP SAMM, the Software Assurance Maturity……
-
Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point Research has disclosed a technique that uses Microsoft Defender’s own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine.The driver, BTR.sys (Boot Time Removal Tool),…
-
Canada’s Hospital for Sick Children attacked by cybercriminals again as employee data stolen
The Hospital for Sick Children, which was hit in a ransomware incident in 2022 that disabled some of its systems, released a statement on Thursday warning of a data theft incident they believe is tied to a third-party software application. First seen on therecord.media Jump to article: therecord.media/canada-hospital-for-sick-children-attacked-again-employee-data
-
The Cyber Express Weekly Roundup: Tax Data Breach, AI Security Risks, and Critical GitLab Flaw
Tags: ai, breach, cyber, cybersecurity, data, data-breach, exploit, flaw, gitlab, government, risk, software, threat, vulnerabilityThis weekly roundup highlights a broad range of cybersecurity threats affecting government agencies, businesses, enterprise AI systems, and software platforms. From a major French tax authority breach to a critical GitLab vulnerability, recent incidents demonstrate how attackers continue to exploit sensitive data, digital systems, and emerging technologies. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/weekly-roundup-tax-breach-ai-gitlab-flaw/
-
The Cyber Express Weekly Roundup: Tax Data Breach, AI Security Risks, and Critical GitLab Flaw
Tags: ai, breach, cyber, cybersecurity, data, data-breach, exploit, flaw, gitlab, government, risk, software, threat, vulnerabilityThis weekly roundup highlights a broad range of cybersecurity threats affecting government agencies, businesses, enterprise AI systems, and software platforms. From a major French tax authority breach to a critical GitLab vulnerability, recent incidents demonstrate how attackers continue to exploit sensitive data, digital systems, and emerging technologies. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/weekly-roundup-tax-breach-ai-gitlab-flaw/
-
Six Maximum-Severity Flaws Found in Cisco Products
Cisco patched nine critical flaws, including six rated CVSS 10.0, found during internal testing. None are known to be exploited. Cisco released another batch of security fixes for its Crosswork platforms and Secure Workload software, part of what it’s calling an ongoing internal security review, and the CVSS scores in this round are unusually severe.…
-
From Traditional Development to AI-Native Engineering: ISHIR’s AI Software Engineering Maturity Spectrum
Software development is going through a more fundamental change than adding another productivity tool to the developer stack. The question for CEOs, CIOs, CTOs, and…Read More First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2026/08/from-traditional-development-to-ai-native-engineering-ishirs-ai-software-engineering-maturity-spectrum/
-
Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal security review.Four of the security vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, regardless of the device configuration. A brief description of each of the flaws is below – First…
-
Quarkslab Says Anti-Reversing Software Should Return Plausible Wrong Answers Instead of Crashing
Quarkslab has argued that LLM-assisted reverse engineering does not make obfuscation obsolete, but it changes the defender’s threat model. Its latest experiment found that autonomous coding agents routinely avoid difficult deobfuscation, pivot to dynamic analysis, and often stop once they obtain an answer that appears credible even if it is wrong. The research firm tested…
-
Cl0p Targets 40+ Organizations Through PTC Windchill Flaw
Cl0p claims over 40 organizations fell victim to attacks exploiting a PTC Windchill and FlexPLM vulnerability. Cl0p is using a familiar strategy again: exploit one flaw in enterprise software to attack many companies, then publish the victims’ names if they refuse to pay. The group claims it has targeted more than 40 organizations through a…
-
Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials
Threat actors are exploiting interest in generative AI software to distribute the Vidar information stealer through a fake Google Gemini installer hosted via Google Colab. Darktrace investigated the July 2026 intrusion in an EMEA customer environment, where a user downloaded and executed a malicious file named Download_Google_Gemini_For_Windows.exe The campaign did not rely on a conventional…
-
The Feynman Bet: Why You Still Won’t Vibe Code Your SIEM (Today)
Gemini about this blog The Feynman Betting Strategy and the Inertia of Security Many years ago, I read a book by the legendary quantum physicist Richard Feynman. One story from his time at Los Alamos during the war has always stuck with me. Feynman entertained himself by making bets with his colleagues about various wartime events in Europe.…
-
The Feynman Bet: Why You Still Won’t Vibe Code Your SIEM (Today)
Gemini about this blog The Feynman Betting Strategy and the Inertia of Security Many years ago, I read a book by the legendary quantum physicist Richard Feynman. One story from his time at Los Alamos during the war has always stuck with me. Feynman entertained himself by making bets with his colleagues about various wartime events in Europe.…
-
The Feynman Bet: Why You Still Won’t Vibe Code Your SIEM (Today)
Gemini about this blog The Feynman Betting Strategy and the Inertia of Security Many years ago, I read a book by the legendary quantum physicist Richard Feynman. One story from his time at Los Alamos during the war has always stuck with me. Feynman entertained himself by making bets with his colleagues about various wartime events in Europe.…
-
Harness launches AI agents to find and fix software vulnerabilities
First seen on scworld.com Jump to article: www.scworld.com/brief/harness-launches-ai-agents-to-find-and-fix-software-vulnerabilities
-
Harness launches AI agents to find and fix software vulnerabilities
First seen on scworld.com Jump to article: www.scworld.com/brief/harness-launches-ai-agents-to-find-and-fix-software-vulnerabilities
-
6 Best Identity and Access Management (IAM) Software Solutions in 2026
Compare the 6 best IAM solutions for 2026, including JumpCloud, Okta, OneLogin, ManageEngine, CyberArk, and Microsoft Entra ID, features, pros, and cons. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/products/best-iam-software/
-
Palo Alto Launches Frontier AI Critical Defense Program to Scale Virtual Patching
Frontier AI’s ability to find vast numbers of previously unknown vulnerabilities has created a timing problem for defenders. How can they protect vulnerable software and devices when discovery is accelerating but permanent patching can still take hours, days or weeks? Palo Alto Networks is now betting on virtual patching as a way to cut that..…
-
JFrog Artifactory Flaws Enable Software Supply Chain Attacks
Two Artifactory flaws allowed attackers to poison package metadata across software repositories First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/jfrog-flaws-software-supply-chain/