Tag: software
-
Secure coding principles explained for product teams
For many UK SMEs, software is now part of the business model rather than just a support tool. It handles customer data, takes payments, automates operations, and shapes the customer experience. That means coding mistakes are not just technical issues. They can lead to downtime, data loss, customer complaints, rework, and damage to reputation. Secure……
-
Russian Cyber Espionage Infrastructure Uses Evilginx and OAuth Phishing to Steal Accounts
Tags: access, authentication, credentials, cyber, espionage, exploit, flaw, infrastructure, phishing, russia, softwareRussian-linked cyber espionage operators are expanding account-compromise operations by combining OAuth abuse, device-code phishing, credential-harvesting infrastructure, and suspected Evilginx reverse-proxy setups. GTIG assesses with moderate confidence that UNC6293 is an initial-access subcluster of ICE RELIC, formerly tracked as APT29, Cozy Bear, and Midnight Blizzard. Rather than exploiting a software flaw, the operators abuse legitimate authentication…
-
A Reported Log4j RCE Is More Complicated Than It Looks
<div cla TL;DR A recently circulated Log4j finding demonstrates a reproducible bypass of a defense-in-depth deserialization control involving FilteredObjectInputStream. Sonatype does not currently consider this a clear-cut Log4j vulnerability. Apache explicitly warns that deserializing untrusted data is unsafe and treats these filters as hardening measures rather than complete security boundaries. Exploitation requires uncommon, legacy-style application…
-
A Reported Log4j RCE Is More Complicated Than It Looks
<div cla TL;DR A recently circulated Log4j finding demonstrates a reproducible bypass of a defense-in-depth deserialization control involving FilteredObjectInputStream. Sonatype does not currently consider this a clear-cut Log4j vulnerability. Apache explicitly warns that deserializing untrusted data is unsafe and treats these filters as hardening measures rather than complete security boundaries. Exploitation requires uncommon, legacy-style application…
-
A Reported Log4j RCE Is More Complicated Than It Looks
<div cla TL;DR A recently circulated Log4j finding demonstrates a reproducible bypass of a defense-in-depth deserialization control involving FilteredObjectInputStream. Sonatype does not currently consider this a clear-cut Log4j vulnerability. Apache explicitly warns that deserializing untrusted data is unsafe and treats these filters as hardening measures rather than complete security boundaries. Exploitation requires uncommon, legacy-style application…
-
A Reported Log4j RCE Is More Complicated Than It Looks
<div cla TL;DR A recently circulated Log4j finding demonstrates a reproducible bypass of a defense-in-depth deserialization control involving FilteredObjectInputStream. Sonatype does not currently consider this a clear-cut Log4j vulnerability. Apache explicitly warns that deserializing untrusted data is unsafe and treats these filters as hardening measures rather than complete security boundaries. Exploitation requires uncommon, legacy-style application…
-
Iran-Linked Hackers Abuse Legitimate Developer Tool to Hide Dindoor Backdoor
Threat actors are increasingly turning legitimate software into part of their attack chains. Instead of deploying an obviously malicious executable, attackers can abuse trusted tools that already have legitimate uses on Windows systems, making malicious activity harder to distinguish from normal software behavior. According to Cybersecurity News, Iran-linked operators are abusing the legitimate Deno JavaScript…
-
The Toolchain Is the Target: Securing Software Development in the Agentic Era
JFrog finds AI development tools are expanding the software supply chain and creating new attack paths for organizations. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/the-toolchain-is-the-target-securing-software-development-in-the-agentic-era/
-
Ab dem 11. September steht Europas Software-Lieferkette unter einer 24-Stunden Meldefrist
Ab dem 11. September 2026 gilt die Anwendung von Artikel 14 des Cyber-Resilience-Act (CRA). Dann müssen Software-Hersteller aktiv schwerwiegende Sicherheitsvorfälle und ausgenutzte Schwachstellen über die Single-Reporting-Platform der <> melden. Diese Plattform ist zwar noch nicht geöffnet. Dennoch können fast alle Entscheidungen, die für eine reibungslose Erstellung des ersten Berichts gemäß den von ENISA im Juli…
-
Debt-Relief-Phishing-Kampagne gegen mehr als 9.000 Organisationen
Check Point Software Technologies hat eine groß angelegte E-Mail-Phishing-Kampagne identifiziert und blockiert. In dieser werden betrügerische Angebote zur finanziellen Entlastung und Schuldenerleichterung genutzt, um Empfänger zu Anrufen bei vom Angreifer kontrollierten Telefonnummern zu verleiten. In den vergangenen 14 Tagen beobachtete Check Point rund 24.700 E-Mails im Zusammenhang mit der Kampagne, die sich an Nutzer in…
-
Cyberangriff auf KI- und Daten-Unternehmen
Jüngst wurde das das KI- und Daten-Unternehmen Alation Ziel eines Cyberangriffs. Das Unternehmen, dessen Software von etwa die Hälfte der Fortune-1000-Unternehmen genutzt wird, untersucht den Vorfall derzeit. Er reiht sich ein in einen ansteigenden Trend, bei dem Hacker es auf Anbieter abgesehen haben, die große Mengen an Unternehmensdaten verwahren und verwalten. Ein Kommentar von Raymond…
-
Core Werewolf Hackers Deploy New CoreRAT Malware Against Russian Government and Defense Organizations
The Core Werewolf espionage cluster has introduced a previously undocumented remote access trojan dubbed CoreRAT in targeted attacks on Russian public-sector bodies and defense-industry organizations. The shift is notable because Core Werewolf, previously associated with the abuse of legitimate UltraVNC remote-access software and smaller custom backdoors, now operates a full-featured C++ RAT of its own.…
-
Car Infotainment Malware Builds Criminal Proxy Botnet
DoFun Software Updates Exploited to Infect Android Head Units. Attackers are exploiting legitimate software updates to infect Android-based car infotainment systems, or head units, turning them into reverse proxies. Kaspersky linked the malware campaign to the MoYu Group, a threat actor linked to BADBOX and BADBOX 2.0. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/car-infotainment-malware-builds-criminal-proxy-botnet-a-32652
-
Android Car Systems Infected With Malware Through Software Updates
Kaspersky uncovered malware spreading via software updates on Android-based car head units, turning infected systems into proxy nodes in a botnet. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity-threats/news-android-car-malware-software-update-botnet/
-
CISA orders agencies to fix exploited Zimbra vulnerability
The collaboration software’s developer took almost a full month to patch the flaw after disclosing it. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-zimbra-flaw-patch-mandate-kev/828718/
-
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo has addressed a high-severity security flaw in its notebook software that allowed an attacker to execute an attacker-supplied Model Context Protocol (MCP) command in a specially crafted notebook, according to VulnCheck’s CVE Numbering Authority (CNA) record.The CNA record says the command can run as a local subprocess when the notebook is opened in edit…
-
Generating and verifying SLSA build provenance for artifacts
Tags: softwareFor UK SMEs shipping software, the question is no longer just whether a build passed tests. It is whether you can prove what was built, from which source, by which system, and with which inputs. That is the purpose of SLSA build provenance. In practical terms, provenance is machine-readable evidence that links an artefact back……
-
91 Spring CVEs Impact Over 209,000 Software Components Across the Supply Chain
Broadcom has disclosed 91 Common Vulnerabilities and Exposures (CVEs) affecting the Spring Framework and related projects, triggering a software supply chain remediation event that Sonatype estimates impacts 209,569 software components. The advisory issued on August 20 highlights the widening gap between AI-accelerated vulnerability discovery and organizations’ ability to identify, fix, rebuild, and deploy affected software.…
-
91 Spring CVEs Impact Over 209,000 Software Components Across the Supply Chain
Broadcom has disclosed 91 Common Vulnerabilities and Exposures (CVEs) affecting the Spring Framework and related projects, triggering a software supply chain remediation event that Sonatype estimates impacts 209,569 software components. The advisory issued on August 20 highlights the widening gap between AI-accelerated vulnerability discovery and organizations’ ability to identify, fix, rebuild, and deploy affected software.…
-
PavinLoader Uses ClickFix and Fake Downloads to Deploy Amatera Stealer via Blockchain C2
PavinLoader, a multi-stage .NET malware loader, operating across ClickFix, fake software-download, and malicious game campaigns. The activity shows how attackers are moving beyond a single delivery vector. A victim may be lured to a fake Cloudflare or Google verification page and instructed to paste a command, persuaded to install apparently legitimate software, or tricked into…
-
What Is MCP in Software Development and Why Does It Matter
What MCP is in software development, how it connects AI models to tools and data, and why it matters for building scalable AI-powered applications. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/what-is-mcp-in-software-development-and-why-does-it-matter/
-
Russian Backdoor Found in Slovak Traffic Cameras
SMS Messages Could Enable Remote Access to Live Traffic Feeds. Slovakian cyber authorities have suspended the rollout of high-speed traffic cameras after a security investigation uncovered backdoors and multiple software weaknesses. The devices were reportedly rebranded versions of Russian-made cameras sold through a Cyprus-based company. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/russian-backdoor-found-in-slovak-traffic-cameras-a-32645
-
Tracking PavinLoader across ClickFix and fake download campaigns
Tags: softwareWe found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns/
-
North Korean Hackers Hide AnyDesk on Victim PCs to Maintain Secret Remote Access
Tags: access, cyber, email, hacker, korea, malicious, north-korea, phishing, powershell, software, spear-phishing, theft, windowsNorth Korea-linked Kimsuky operators have targeted organizations in South Korea and Japan with spear-phishing campaigns that install and conceal AnyDesk, giving attackers persistent, interactive remote access while blending into legitimate software activity. The operation combines OneDrive-hosted lures, malicious Windows shortcut files, scheduled-task persistence, PowerShell payloads, and email theft across Thunderbird, Outlook, and Gmail. The archives…
-
Android car head units infected with proxy botnet malware through built-in software updaters
A newly discovered Android malware, distributed through the built-in updaters in affected Android-based car head units, turns infected devices into ad-fraud tools and nodes in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/24/android-malware-car-head-unit-badbox/
-
Hospital for Sick Children discloses employee data breach due to third-party software flaw
First seen on scworld.com Jump to article: www.scworld.com/brief/hospital-for-sick-children-discloses-employee-data-breach-due-to-third-party-software-flaw
-
Microsoft patches flaw in Entra ID identity software
First seen on scworld.com Jump to article: www.scworld.com/news/microsoft-patches-flaw-in-entra-id-identity-software
-
NASA ground control software vulnerability could allow spacecraft access
First seen on scworld.com Jump to article: www.scworld.com/brief/nasa-ground-control-software-vulnerability-could-allow-spacecraft-takeover
-
Digitalisierung ohne Insellösungen Wie Unternehmen ihre Systeme und Prozesse besser miteinander verbinden
Tags: softwareNeue Software ist schnell eingeführt. Schwieriger wird es, wenn sie mit dem zusammenspielen muss, was im Unternehmen bereits vorhanden ist. Während Kundendaten beispielsweise im CRM liegen und Aufträge über das ERP laufen, werden Dokumente oder Informationen aus der Buchhaltung oft an anderer Stelle verarbeitet. In den einzelnen Bereichen wirkt die Arbeit damit zunächst digital. Reibungsverluste…
-
6 NIST Software Criteria for Financial Institutions
Tags: compliance, cyber, cybersecurity, dora, finance, framework, nist, regulation, software, threat<div cla Financial institutions face overlapping requirements from SEC cyber disclosure rules, NYDFS cybersecurity regulations, and sector-specific mandates like DORA in Europe. When your compliance team juggles multiple frameworks while your security operations center monitors threats in real time, the gap between technical findings and boardroom reporting grows wider by the day. First seen on…