Tag: software
-
Notepad++ says Chinese government hackers hijacked its software updates for months
The developer of the popular text editor Notepad++ said hackers associated with the Chinese government hijacked its software update mechanism to deliver tainted software to users for months. First seen on techcrunch.com Jump to article: techcrunch.com/2026/02/02/notepad-says-chinese-government-hackers-hijacked-its-software-updates-for-months/
-
Hanging Up on ShinyHunters: Experts Detail Vishing Defenses
Sophisticated Voice Phishing Campaigns Don’t Exploit Any Software Vulnerabilities. Amidst persistent voice phishing campaigns designed to trick employees and steal sensitive corporate data, security experts recommend organizations deploy phishing-resistant multifactor authentication, monitor for attacks and use live video verification to safeguard authentication changes. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hanging-up-on-shinyhunters-experts-detail-vishing-defenses-a-30657
-
Notepad++ hijacked by suspected state-sponsored hackers
In a security update posted on the project’s website, the development team said the attack did not exploit a flaw in the editor’s source code itself. Instead, the compromise occurred at the infrastructure level, involving systems used to deliver software updates. First seen on therecord.media Jump to article: therecord.media/popular-text-editor-hijacked-by-suspected-state-sponsored-hackers
-
How state-sponsored attackers hijacked Notepad++ updates
Suspected Chinese state-sponsored attackers hijacked the Notepad++ update mechanism by compromising the software project’s shared hosting server and intercepting and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/02/2025-notepad-supply-chain-compromise/
-
How state-sponsored attackers hijacked Notepad++ updates
Suspected Chinese state-sponsored attackers hijacked the Notepad++ update mechanism by compromising the software project’s shared hosting server and intercepting and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/02/2025-notepad-supply-chain-compromise/
-
Google Uncovers Major Expansion in ShinyHunters Threat Activity Using New Tactics
Tags: authentication, corporate, credentials, cyber, cybercrime, extortion, google, identity, mfa, phishing, service, software, tactics, threatA substantial expansion in cybercrime operations using tactics consistent with ShinyHunters-branded extortion campaigns. These sophisticated operations employ advanced voice phishing (vishing) and victim-branded credential harvesting websites to compromise corporate environments by stealing single sign-on (SSO) credentials and multi-factor authentication (MFA) codes. While the methodology of targeting identity providers and Software-as-a-Service (SaaS) platforms remains consistent with…
-
When responsible disclosure becomes unpaid labor
Tags: ai, bug-bounty, ciso, cloud, compliance, control, credentials, cve, cvss, cybersecurity, data, email, exploit, finance, flaw, governance, healthcare, incident response, infrastructure, jobs, open-source, ransom, risk, security-incident, service, software, threat, tool, update, vulnerability, warfaresupposed to function and how it increasingly does in practice. Enter the gray zone of ethical disclosure: The result is a growing gray zone between ethical research and adversarial pressure. Based on years of reporting on disclosure disputes, that gray zone tends to emerge through a small set of recurring failure modes.Silent treatment and severity…
-
Pompelmi: Open-source secure file upload scanning for Node.js
Software teams building services in JavaScript are adding more layers of defense to handle untrusted file uploads. An open-source project called Pompelmi aims to insert … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/02/pompelmi-open-source-secure-file-upload-scanning-node-js/
-
The Great Shift: Cybersecurity Predictions for 2026 and the New Era of Threat Intelligence
<div cla As we look back on 2025, AI and open source have fundamentally changed how software is built. Generative AI, automated pipelines, and ubiquitous open source have dramatically increased developer velocity and expanded what teams can deliver, while shifting risk into the everyday decisions developers make as code is written, generated, and assembled. First…
-
Ivanti patches two actively exploited critical vulnerabilities in EPMM
install rpm url [patch_url] command.The RPM_12.x.0.x patch is applicable to EPMM software versions 12.5.0.x, 12.6.0.x, and 12.7.0.x. It is also compatible with the older 12.3.0.x and 12.4.0.x versions. Meanwhile the RPM_12.x.1.x patch is applicable to versions 12.5.1.0 and 12.6.1.0.”The RPM script does not survive a version upgrade,” the company warns. “If after applying the RPM…
-
Startup Amutable plotting Linux security overhaul to counter hacking threats
Tags: attack, backdoor, ceo, cloud, computer, computing, container, cve, cybercrime, data, exploit, fortinet, hacking, infrastructure, kubernetes, linux, microsoft, open-source, skills, software, startup, supply-chain, technology, threat, tool, training, vpn, vulnerabilitysystemd, he has alongside him two other ex-Microsoft employees, Chris Kühl as CEO, and Christian Brauner as CTO.A clue to Amutable’s plans lies in the announcement’s emphasis on some of its founders’ backgrounds in Kubernetes, runc, LXC, Incus, and containerd, all connected in different ways to the Linux container stack. Computing is full of security…
-
U.S. convicts ex-Google engineer for sending AI tech data to China
A U.S. federal jury has convicted Linwei Ding, a former software engineer at Google, for stealing AI supercomputer data from his employer and secretly sharing it with Chinese tech firms. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/us-convicts-ex-google-engineer-for-sending-ai-tech-data-to-china/
-
Agentic AI and Non”‘Human Identities Demand a Paradigm Shift In Security: Lessons from NHIcon 2026
In the race to innovate, software has repeatedly reinvented how we define identity, trust, and access. In the 1990’s, the web made every server a perimeter. In the 2010’s, the cloud made every identity a workload. Here in 2026, agentic AI makes every action autonomous. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/agentic-ai-and-non%e2%80%91human-identities-demand-a-paradigm-shift-in-security-lessons-from-nhicon-2026/
-
Trump Administration Rescinds Biden-Era Software Guidance
Federal agencies will no longer be required to solicit software attestations that they comply with NIST’s Secure Software Development Framework (SSDF). What that means long term is unclear. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/trump-administration-rescinds-biden-era-sbom-guidance
-
NIS2: Lieferketten als Risikofaktor
Tags: awareness, ciso, cloud, compliance, cyberattack, cyersecurity, firewall, incident response, monitoring, nis-2, risk, service, software, supply-chain, updateNIS2 verpflichtet CISOs die Sicherheit der Supply Chain stärker in den Blick zu nehmen. Viele Unternehmen investieren heute erhebliche Mittel, um ihre interne IT abzusichern. Firewalls, Monitoring, Incident-Response-Pläne und Awareness-Programme sind etabliert. Gleichzeitig wächst eine gefährliche Illusion: Die Annahme, dass sich Risiken innerhalb der eigenen Systemgrenzen kontrollieren lassen. Die Realität sieht anders aus. Moderne Geschäftsmodelle…
-
SmarterTools patches critical SmarterMail flaw allowing code execution
SmarterTools fixed two SmarterMail flaws, including a critical bug (CVE-2026-24423) that could allow arbitrary code execution. SmarterTools fixed two security bugs in its SmarterMail email software, including a critical vulnerability, tracked as CVE-2026-24423 (CVSS score of 9.3) that could let attackers run malicious code on affected systems. >>SmarterTools SmarterMail versions prior to build 9511 contain…
-
Ex-Google engineer found guilty of stealing AI secrets
A federal jury in California convicted former Google software engineer Linwei Ding, also known as Leon Ding, on seven counts of economic espionage and seven counts of theft of … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/30/ex-google-engineer-espionage/
-
Agentic AI for Test Workflows. Why Our QA Team Built It and How Testing Changed as a Result
Quality assurance teams across modern software development face a new reality. AI enabled applications do not behave like traditional systems. Outputs shift based on context….Read More First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2026/01/agentic-ai-for-test-workflows-why-our-qa-team-built-it-and-how-testing-changed-as-a-result/
-
SmarterMail Fixes Critical Unauthenticated RCE Flaw with CVSS 9.3 Score
SmarterTools has addressed two more security flaws in SmarterMail email software, including one critical security flaw that could result in arbitrary code execution.The vulnerability, tracked as CVE-2026-24423, carries a CVSS score of 9.3 out of 10.0.”SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API First seen…
-
Cyberangriffe 2025: Deutschland besonders betroffen
Der aktuelle Cyber Security Report 2026 von Check Point Software Technologies zeichnet ein klares Bild: Unternehmen weltweit sind zunehmend Ziel automatisierter und KI-gesteuerter Angriffe. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/cyberangriffe-2025-deutschland
-
Cyberangriffe 2025: Deutschland besonders betroffen
Der aktuelle Cyber Security Report 2026 von Check Point Software Technologies zeichnet ein klares Bild: Unternehmen weltweit sind zunehmend Ziel automatisierter und KI-gesteuerter Angriffe. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/cyberangriffe-2025-deutschland
-
Trump Administration Rescinds Biden-Era SBOM Guidance
Federal agencies will no longer be required to solicit software bills of material (SBOMs) from tech vendors, nor attestations that they comply with NIST’s Secure Software Development Framework (SSDF). What that means long term is unclear. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/trump-administration-rescinds-biden-era-sbom-guidance
-
Report: Open Source Malware Instances Increased 73% in 2025
ReversingLabs this week published a report that finds there was a 73% increase in the number of malicious open source packages discovered in 2025 compared with the previous year. More than 10,000 malicious open source packages were discovered, most of which involved node package managers (npms) that cybercriminals were using to compromise software supply chains……
-
Federal pivot on software security oversight could complicate vendor strategies
Software companies cheered the elimination of a government-wide attestation mandate. What comes next could be messy. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/white-house-software-security-attestation-elimination/810765/
-
Marquis blames ransomware breach on SonicWall cloud backup hack
Marquis Software Solutions, a Texas-based financial services provider, is blaming a ransomware attack that impacted its systems and affected dozens of U.S. banks and credit unions in August 2025 on a security breach reported by SonicWall a month later. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/marquis-blames-ransomware-breach-on-sonicwall-cloud-backup-hack/
-
Top 7 Threat Intelligence Platforms Software
Threat intelligence platforms help analyze and share cyber threat data. Discover top TIPs , their features, use cases, and comparisons. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/products/threat-intelligence-platforms/