Tag: software
-
Threat Actor Accidentally Exposes AI-Powered Operations
A threat actor accidentally revealed their AI-powered methods by installing Huntress security software First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/threat-actor-exposes-operations/
-
Salesloft Drift Security Breach Expands: Dozens of Companies Confirm Exposure in OAuth-Based Cyberattack
Tags: breach, cloud, credentials, cyberattack, cybersecurity, data, infrastructure, saas, software, supply-chainA Salesloft Drift cyberattack has compromised the Salesforce environments of numerous organizations, exposing customer data and credentials in a growing software supply chain incident. Triggered by a compromise of OAuth tokens used in the Drift chatbot’s integration with Salesforce, the Salesloft Drift security breach has impacted companies across cybersecurity, cloud infrastructure, DevOps, and SaaS industries.…
-
How AI and politics hampered the secure open-source software movement
Tech giants pledged millions to secure open-source code. Then AI came along. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/open-source-software-security-progress-roadblocks/758506/
-
Smart GPUGate malware exploits GitHub and Google Ads for evasive targeting
GPU-Gated decryption evades detection: The malware itself is delivered as a large Microsoft Software Installer (MSI) file, approximately 128 MB in size. It features a GPU-gated decryption mechanism that keeps the payload encrypted unless it detects the presence of a real GPU on the system. Researchers noted that this design allows GPUGate to remain dormant…
-
Smart GPUGate malware exploits GitHub and Google Ads for evasive targeting
GPU-Gated decryption evades detection: The malware itself is delivered as a large Microsoft Software Installer (MSI) file, approximately 128 MB in size. It features a GPU-gated decryption mechanism that keeps the payload encrypted unless it detects the presence of a real GPU on the system. Researchers noted that this design allows GPUGate to remain dormant…
-
SAP fixes maximum severity NetWeaver command execution flaw
SAP has addressed 21 new vulnerabilities affecting its products, including three critical severity issues impacting the NetWeaver software solution. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sap-fixes-maximum-severity-netweaver-command-execution-flaw/
-
SAP fixes maximum severity NetWeaver command execution flaw
SAP has addressed 21 new vulnerabilities affecting its products, including three critical severity issues impacting the NetWeaver software solution. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sap-fixes-maximum-severity-netweaver-command-execution-flaw/
-
SAP fixes maximum severity NetWeaver command execution flaw
SAP has addressed 21 new vulnerabilities affecting its products, including three critical severity issues impacting the NetWeaver software solution. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sap-fixes-maximum-severity-netweaver-command-execution-flaw/
-
How AI and politics hampered the secure open-source software movement
Tech giants pledged millions to secure open-source code. Then AI came along. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/open-source-software-security-progress-roadblocks/758506/
-
Sicherheits-Framework <> für Zero-Day-Angriffe eingesetzt
Die Sicherheitsforscher von Check Point Software Technologies haben beobachtet, wie Hacker das zur Cyber-Abwehr erfundene, kürzlich veröffentlichte Tool für Cyber-Angriffe missbrauchen. Eigentlich handelt es sich bei Hexstrike-AI um ein KI-gestütztes, offensives Sicherheits-Framework, das professionelle Sicherheits-Tools mit autonomen KI-Agenten kombiniert, um Sicherheitstests zu ermöglichen. Hacker haben Hexstrike-AI nun kurz nach der Veröffentlichung als Waffe […] First…
-
Sicherheits-Framework <> für Zero-Day-Angriffe eingesetzt
Die Sicherheitsforscher von Check Point Software Technologies haben beobachtet, wie Hacker das zur Cyber-Abwehr erfundene, kürzlich veröffentlichte Tool für Cyber-Angriffe missbrauchen. Eigentlich handelt es sich bei Hexstrike-AI um ein KI-gestütztes, offensives Sicherheits-Framework, das professionelle Sicherheits-Tools mit autonomen KI-Agenten kombiniert, um Sicherheitstests zu ermöglichen. Hacker haben Hexstrike-AI nun kurz nach der Veröffentlichung als Waffe […] First…
-
Sicherheits-Framework <> für Zero-Day-Angriffe eingesetzt
Die Sicherheitsforscher von Check Point Software Technologies haben beobachtet, wie Hacker das zur Cyber-Abwehr erfundene, kürzlich veröffentlichte Tool für Cyber-Angriffe missbrauchen. Eigentlich handelt es sich bei Hexstrike-AI um ein KI-gestütztes, offensives Sicherheits-Framework, das professionelle Sicherheits-Tools mit autonomen KI-Agenten kombiniert, um Sicherheitstests zu ermöglichen. Hacker haben Hexstrike-AI nun kurz nach der Veröffentlichung als Waffe […] First…
-
How a Single Faulty Windows Driver Can Crash Your System and Cause Blue Screen of Death
Windows devices rely on a complex ecosystem of drivers to manage hardware and software interactions. When one driver fails to complete a critical task, the entire operating system can halt in a fatal error known as the Blue Screen of Death (BSOD). Understanding how a single faulty driver triggers a system-wide crash helps users and…
-
How a Single Faulty Windows Driver Can Crash Your System and Cause Blue Screen of Death
Windows devices rely on a complex ecosystem of drivers to manage hardware and software interactions. When one driver fails to complete a critical task, the entire operating system can halt in a fatal error known as the Blue Screen of Death (BSOD). Understanding how a single faulty driver triggers a system-wide crash helps users and…
-
Modern Solution-Urteil: Verurteilter IT-Spezialist reicht Verfassungsbeschwerde ein
Kurzer Nachtrag in Sachen Gerichtsurteil gegen einen IT-Spezialisten, der eine Sicherheitslücke in der Software von Modern Solutions aufdeckte, meldete und veröffentlichte. Der Mann ist inzwischen rechtskräftig zu einer Strafe von 3.000 Euro verurteilt. Wegen des Urteils des OLG Köln vom … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/09/09/modern-solution-urteil-verurteilter-it-spezialist-reicht-verfassungsbeschwerde-ein/
-
Modern Solution-Urteil: Verurteilter IT-Spezialist reicht Verfassungsbeschwerde ein
Kurzer Nachtrag in Sachen Gerichtsurteil gegen einen IT-Spezialisten, der eine Sicherheitslücke in der Software von Modern Solutions aufdeckte, meldete und veröffentlichte. Der Mann ist inzwischen rechtskräftig zu einer Strafe von 3.000 Euro verurteilt. Wegen des Urteils des OLG Köln vom … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/09/09/modern-solution-urteil-verurteilter-it-spezialist-reicht-verfassungsbeschwerde-ein/
-
71% of CISOs hit with third-party security incident this year
Tags: access, ai, application-security, attack, backdoor, breach, ceo, cisa, ciso, cloud, compliance, control, credentials, cyber, cybersecurity, data, defense, exploit, incident response, intelligence, malicious, malware, open-source, penetration-testing, phishing, programming, pypi, resilience, risk, risk-management, sbom, security-incident, service, software, startup, supply-chain, threat, toolSoftware supply chain threats: The software supply chain is heavily reliant on code developed by third-party developers, something only likely to increase with the advent of AI.Brian Fox, co-founder and CTO of open-source software security vendor Sonatype, says that “enormously complex” software supply chains pose a growing threat.”Too many organizations have no idea what open-source…
-
71% of CISOs hit with third-party security incident this year
Tags: access, ai, application-security, attack, backdoor, breach, ceo, cisa, ciso, cloud, compliance, control, credentials, cyber, cybersecurity, data, defense, exploit, incident response, intelligence, malicious, malware, open-source, penetration-testing, phishing, programming, pypi, resilience, risk, risk-management, sbom, security-incident, service, software, startup, supply-chain, threat, toolSoftware supply chain threats: The software supply chain is heavily reliant on code developed by third-party developers, something only likely to increase with the advent of AI.Brian Fox, co-founder and CTO of open-source software security vendor Sonatype, says that “enormously complex” software supply chains pose a growing threat.”Too many organizations have no idea what open-source…
-
71% of CISOs hit with third-party security incident this year
Tags: access, ai, application-security, attack, backdoor, breach, ceo, cisa, ciso, cloud, compliance, control, credentials, cyber, cybersecurity, data, defense, exploit, incident response, intelligence, malicious, malware, open-source, penetration-testing, phishing, programming, pypi, resilience, risk, risk-management, sbom, security-incident, service, software, startup, supply-chain, threat, toolSoftware supply chain threats: The software supply chain is heavily reliant on code developed by third-party developers, something only likely to increase with the advent of AI.Brian Fox, co-founder and CTO of open-source software security vendor Sonatype, says that “enormously complex” software supply chains pose a growing threat.”Too many organizations have no idea what open-source…
-
20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack
Multiple npm packages have been compromised as part of a software supply chain attack after a maintainer’s account was compromised in a phishing attack.The attack targeted Josh Junon (aka Qix), who received an email message that mimicked npm (“support@npmjs[.]help”), urging them to update their update their two-factor authentication (2FA) credentials before September 10, 2025, by…
-
Connected cars are racing ahead, but security is stuck in neutral
Connected cars are already on Europe’s roads, loaded with software, sensors, and constant data connections. Drivers love the features these vehicles bring, from remote apps to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/09/connected-car-cybersecurity-europe/
-
SHARED INTEL QA: Is your antivirus catching fresh threats, or just echoing VirusTotal?
In cybersecurity, trust often hinges on what users think their software is doing, versus what’s actually happening under the hood. Related: Eddy Willem’s ‘Borrowed Brains’ findings Take antivirus, for example. Many users assume threat detection is based on proprietary… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/shared-intel-qa-is-your-antivirus-catching-fresh-threats-or-just-echoing-virustotal/
-
SHARED INTEL QA: Is your antivirus catching fresh threats, or just echoing VirusTotal?
In cybersecurity, trust often hinges on what users think their software is doing, versus what’s actually happening under the hood. Related: Eddy Willem’s ‘Borrowed Brains’ findings Take antivirus, for example. Many users assume threat detection is based on proprietary… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/shared-intel-qa-is-your-antivirus-catching-fresh-threats-or-just-echoing-virustotal/
-
SHARED INTEL QA: Is your antivirus catching fresh threats, or just echoing VirusTotal?
In cybersecurity, trust often hinges on what users think their software is doing, versus what’s actually happening under the hood. Related: Eddy Willem’s ‘Borrowed Brains’ findings Take antivirus, for example. Many users assume threat detection is based on proprietary… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/shared-intel-qa-is-your-antivirus-catching-fresh-threats-or-just-echoing-virustotal/
-
Software packages with more than 2 billion weekly downloads hit in supply-chain attack
Incident hitting npm users is likely the biggest supply-chain attack ever. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/09/software-packages-with-more-than-2-billion-weekly-downloads-hit-in-supply-chain-attack/
-
Salesloft Drift Hack Claims New Victims in Tenable, Qualys
Salesloft Says Hackers Broke Into Its GitHub Repository. Cybersecurity firms Tenable and Qualys fell to attacks stemming from hacker theft of authentication tokens from a third-party tool often integrated into Salesforce. The firms disclosed their exposure to the attack that lifted access tokens from marketing-as-a-service software provider Salesloft. First seen on govinfosecurity.com Jump to article:…
-
Salesloft Drift Hack Claims New Victims in Tenable, Qualys
Salesloft Says Hackers Broke Into Its GitHub Repository. Cybersecurity firms Tenable and Qualys fell to attacks stemming from hacker theft of authentication tokens from a third-party tool often integrated into Salesforce. The firms disclosed their exposure to the attack that lifted access tokens from marketing-as-a-service software provider Salesloft. First seen on govinfosecurity.com Jump to article:…
-
UltraViolet Cyber Acquires Application Security Testing Service from Black Duck
Tags: application-security, ceo, cloud, container, cyber, penetration-testing, RedTeam, risk, risk-assessment, service, software, threatUltraViolet Cyber has acquired the application security testing services arm of Black Duck Software as part of an effort to expand the scope of the managed security services it provides. Company CEO Ira Goldstein said this addition to its portfolio will provide penetration testing, red teaming, threat modeling, cloud and container risk assessments, architecture risk..…
-
UltraViolet Cyber Acquires Application Security Testing Service from Black Duck
Tags: application-security, ceo, cloud, container, cyber, penetration-testing, RedTeam, risk, risk-assessment, service, software, threatUltraViolet Cyber has acquired the application security testing services arm of Black Duck Software as part of an effort to expand the scope of the managed security services it provides. Company CEO Ira Goldstein said this addition to its portfolio will provide penetration testing, red teaming, threat modeling, cloud and container risk assessments, architecture risk..…