Tag: software
-
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies.The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa.The preinstalled First seen…
-
Leading digital change when nobody prepared you for it
By Louise John, Head of IT Service Delivery at Virgin Active For IT managers, unexpected projects and changing business priorities are normal part of the job. You might have spent months planning your team’s workload, but only to be told with little warning that a new software solution needs to be implemented within six weeks.…
-
GitLab fixes critical vulnerability that exposed software environments to sabotage
The company urged customers to upgrade to the latest versions of its flagship products. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/gitlab-vulnerability-remote-code-execution/832736/
-
GitLab fixes serious vulnerability that exposed software environments to sabotage
The company urged customers to upgrade to the latest versions of its flagship products. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/gitlab-vulnerability-remote-code-execution/832736/
-
What makes some open source updates so difficult?
Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/12/google-open-source-maintenance-costs-report/
-
Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners
Attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS, the management console for Ahsay’s cloud backup software, to take over servers and quietly run cryptocurrency miners, according to researchers at Huntress. AhsayCBS (Cloud Backup Server) is mainly used by managed service providers (MSPs) and system integrators to create users and manage backup policies for their…
-
12 Best Software Supply Chain Security Tools Compared (2026): Features Pricing
Chainguard leads the eliminate-the-problem lane with hardened zero-CVE images, Sonatype the block-at-ingestion lane, and Scribe/Lineaje the provenance-attestation frontier. Selecting the best container registry security tools helps organizations establish baseline protection across four distinct attack surfaces dependencies, pipelines, artifacts, and base images because software supply chain security is a comprehensive strategy wearing a category name. Quick…
-
Anthropic Launches Cyber Mission to Protect Critical Infrastructure and Open-Source Software With Claude AI
Anthropic launched its Cyber Mission, a long-term initiative aimed at helping defenders secure critical infrastructure and open-source software. This initiative utilizes frontier Claude models, offers engineering support, conducts threat research, and provides funding. The Cyber Mission introduces two key components: the Critical Infrastructure Defense Program (CIDP) and the OSS Scanner, a free, opt-in service for…
-
Companies want autonomous IT operations but hesitate to let AI act alone
Ninety percent of companies want to move toward autonomous IT operations over the next two years, with agentic AI, software that plans and carries out multi-step tasks on its … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/move-toward-autonomous-it-operations/
-
Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software
The critical infrastructure defense program will seek to pair Claude models, Anthropic engineers and threat research with the expertise of cybersecurity companies. First seen on cyberscoop.com Jump to article: cyberscoop.com/anthropic-cybersecurity-program-critical-infrastructure-open-source/
-
Low-cost Android phones ship with residential proxy malware
A malware campaign dubbed ‘Midnight Mimosa’ has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/low-cost-android-phones-ship-with-residential-proxy-malware/
-
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said.The Tokyo-based center, which takes incident reports, based its October 8, 2026 alert on those reports and other information. The alert names no attacker and no affected organization.JPCERT/…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
Guter Code reicht auch im agentischen Zeitalter nicht
Agentische Softwareentwicklung verändert, wie Software entsteht: KI-Agenten übernehmen heute schon große Teile des Entwicklungsprozesses. Doch agentische Exzellenz entsteht nicht allein im Code. Sie entscheidet sich daran, wie gut Unternehmen ihre Rollen, Entscheidungswege und Führungsstrukturen anpassen. Für IT-Dienstleister und Softwareanbieter bedeutet das: Ihr eigenes Geschäftsmodell, das bislang auf der Arbeitszeit von Entwicklerinnen und Entwicklern beruht, muss…
-
Public sector risk and double standards over occupied Palestine
The UK bans cloud and software for Russia, but sanctions illegal Israeli settlements only narrowly while AWS, Google and Microsoft run the IT infrastructure for the occupation First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651837/Public-sector-risk-and-double-standards-over-occupied-Palestine
-
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package known as “tensorlake,” a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.The malicious version 0.5.144 “contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code,” Socket said First seen on thehackernews.com…
-
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available.The flaw is in LMCache’s multiprocess mode, where the cache runs as a standalone server that LLM workers reach over…
-
Clockwork.io erhält 31 Millionen US-Dollar für ausfallsichere KI-Infrastrukturen
Clockwork.io hat eine neue Finanzierungsrunde über 31 Millionen US-Dollar abgeschlossen. Gleichzeitig meldet der Anbieter produktive Einsätze seiner Fault-Tolerance-Software bei LinkedIn und Together AI sowie eine Ausweitung der Nutzung bei Whitefiber. Neue Funktionen für Torchpass sollen laufende KI-Workloads auch bei Infrastrukturfehlern schützen ohne Änderungen am Trainingscode. KI-Workloads werden immer größer und verteilter. Damit steigt auch […]…
-
Atlassian Warns of Critical Flaw Affecting Eight Self-Managed Products
Atlassian has disclosed CVE-2026-21589, a critical arbitrary file access vulnerability affecting Confluence Data Center and seven other self-managed products. The advisory, published on October 5, 2026, warns that every version of the affected software is exposed and urges administrators to act right away, either by upgrading or by putting temporary safeguards in place. First seen…
-
Verify it, don’t assume it: why untested security controls are making life easy for attackers
This year’s Cybersecurity Awareness Month theme, “Don’t Make It Easy for Them”, is usually read as advice for individuals. Cynthia Overby, director of strategic security solutions, ZCOE, at Rocket Software, says it should be read just as closely in the boardroom. “As Cybersecurity Awareness Month commences, the theme, ‘Don’t make it easy for them’ must…
-
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions.The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software First…
-
Fehlersuche per KI: IBM und Red Hat finden mehr als 400 Bugs in Java Code
Das gemeinsame Projekt Lightwell nutzt KI-Agenten zum Aufspüren von Schwachstellen in Open-Source-Software – und zur Entwicklung der benötigten Patches. First seen on golem.de Jump to article: www.golem.de/news/fehlersuche-per-ki-ibm-und-red-hat-finden-mehr-als-400-bugs-in-java-code-2610-213801.html
-
Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws
Anthropic on Tuesday said it’s expanding a program that allows vetted cybersecurity professionals to test its advanced artificial intelligence (AI) models with reduced safeguards and blocking classifiers, as the company claimed its Project Glasswing initiative uncovered at least 129,000 verified software vulnerabilities between April and July 2026.The company said it also found an additional First…
-
Automation, AI agents or people? Sorting out who handles each security finding
Just over half of the 200 senior security and technology leaders polled for ArmorCode say their organizations will struggle to simplify their software security programs if … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/07/software-security-vulnerability-management-survey/
-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection.Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the…
-
Google Pauses Open-Source Bug Bounty Program Amid AI Slop
Tech Giant Cites ‘Significant Rise in Automated Submissions’ Lacking Validity. Google has indefinitely paused a bug bounty program designed to reward researchers who find flaws in the open-source software it maintains, citing a significant rise in automated submissions, the vast majority of which are not valid. Other software maintainers report similar struggles. First seen on…
-
IBM’s AI-powered vulnerability clearinghouse finds hundreds of Java flaws
The tech giant’s announcement underscores the insufficiency of companies’ existing software supply-chain security practices. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ibm-ai-vulnerability-java-lightwell/832249/
-
LibreOffice says ‘no AI’ is now a software feature
The maker of the open source document editor says it has no plans to add AI to its software’s default configuration, citing user privacy. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/06/libreoffice-says-no-ai-is-now-a-software-feature/
-
How to secure RMM software: 8 controls MSPs should test
RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged access to recovery and tenant isolation. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/how-to-secure-rmm-software-8-controls-msps-should-test/