Tag: software
-
IoT Sector Given Final EU Cyber Resilience Act Guidance
Incident Reporting Starts Sept. 11, Other Mandates Wait Until Dec. 11, 2027. The European Commission published final guidance for complying with the Cyber Resilience Act, a 2024 law that aims to boost the cybersecurity of software and internet-connected hardware products. The greatest change from a previous draft is which software falls within the CRA’s scope.…
-
vBulletin fixes critical pre-auth RCE flaw with public exploit
A critical vulnerability in the vBulletin forum software allows unauthenticated attackers to execute arbitrary PHP code through template rendering. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/vbulletin-fixes-critical-pre-auth-rce-flaw-with-public-exploit/
-
Is Your SSO Protected Against Modern Credential Attacks?
A compromised SSO login can provide attackers with access to multiple enterprise applications and services. Specops Software explains how stronger passwords, phishing-resistant MFA, and identity hardening help secure modern SSO environments and the applications they protect. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/is-your-sso-protected-against-modern-credential-attacks/
-
Trojaner ersetzt in einer JSON-Bibliothek die Konfiguration des Entwicklers zur Manipulation einer Wettplattform
Das JFrog Security Research Team hat ein per Typosquatting getarntes NuGet-Paket entdeckt und offengelegt, das einen ungewöhnlich präzisen Supply-Chain-Angriff darstellt. Statt als generischer Info-Stealer zu agieren, wurde ‘Newtonsoftt.Json.Net>> als gezieltes Betrugswerkzeug gegen ein einzelnes Unternehmen entwickelt, während es sich für alle anderen wie eine völlig normale Software-Bibliothek verhielt. Es gab sich als die weit verbreitete…
-
Fake Claude Code Installer Delivers MacSync macOS Infostealer Through Google Ads
A highly convincing malvertising campaign is targeting macOS users searching for “how to install Claude Code on Mac,” delivering the MacSync infostealer through a trusted-looking workflow that abuses legitimate infrastructure rather than exploiting software vulnerabilities. The attack highlights a growing shift toward trust-based compromise, where attackers weaponize authentic platforms such as Google Ads and claude.ai…
-
JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
JFrog has confirmed that OpenAI models exploited a zero-day in self-hosted Artifactory while trying to reach the open internet from a sealed evaluation environment.Artifactory is JFrog’s software repository manager. OpenAI says the models then escalated privileges and moved laterally until they reached an internet-connected node. JFrog says it has since developed and released fixes for…
-
LegacyHive Exploit Abuses Windows Profile Loading to Hijack User Registry Hives
LegacyHive is a newly discovered proof-of-concept (PoC) for Windows that exploits profile initialization and offline registry hive manipulation to redirect user-level registry paths, potentially allowing access to resources associated with another account. This technique was published by the Nightmare-Eclipse disclosure actor shortly after Microsoft’s July 2026 Patch Tuesday. Unlike traditional software vulnerabilities, LegacyHive chains legitimate…
-
IT-Probleme im Einzelhandel: Omnissa benennt Software als Blinden Fleck
Tags: softwareFirst seen on datensicherheit.de Jump to article: www.datensicherheit.de/it-probleme-einzelhandel-omnissa-studie-software-blinder-fleck
-
NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
Tags: ai, cisco, cloud, crowdstrike, framework, group, ibm, intelligence, linux, microsoft, network, nvidia, open-source, software, toolNVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents.The 37-member group spans cloud, security, enterprise software, and AI companies, including Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux…
-
MedusaHVNC Trojan Creates Hidden Desktops to Hijack Browsers and Steal Data
MedusaHVNC RAT uses hidden Windows desktops to remotely control browsers, steal data, and evade detection through legitimate system features. Windows has always supported hidden desktops as a legitimate feature, useful for specialized software that needs a workspace the user never touches. It’s a niche capability most people never think about, buried deep in how the…
-
Clop Tied to PTC Product Lifecycle Management Software Hits
Signs Point to Cl0p Extortion Group Again Stealing Data and Holding It to Ransom. Digital extortion group Clop, aka Cl0p, has been tied to a fresh spate of supply-chain attacks, this time targeting users of popular Windchill and FlexPLM product lifecycle management software from PTC. Victims appear to at least span the aerospace, automotive, manufacturing…
-
Keyfactor Expands Into AI Agent Identity With Cofide Deal
Deal Extends Certificate-Based Trust Framework to AI Agents and Software Workloads. Cleveland-based Keyfactor plans to acquire London-based startup Cofide to expand its trust platform into software workloads and autonomous AI agents, betting enterprise demand for dynamic, standards-based machine identities will accelerate as AI adoption grows. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/keyfactor-expands-into-ai-agent-identity-cofide-deal-a-32331
-
Claude Opus 5 Finds Software Vulnerabilities While Blocking Exploit Generation
Claude Opus 5, the latest flagship AI model from Anthropic, represents a significant shift in how advanced systems can be safely utilized in cybersecurity. This model can proactively identify software vulnerabilities while specifically preventing the generation of exploits and offensive usage. Announced on July 24, 2026, Opus 5 is positioned as a high-end, general-purpose intelligence…
-
Over 70 Fake Windows App Sites Could Turn Trusted Downloads Into Malware
A newly uncovered cluster of more than 70 impersonation domains targeting popular Windows applications is raising fresh concerns about a scalable malware distribution campaign that leverages trust in legitimate software ecosystems. The discovery, triggered by a developer investigating unusual search results for their own application, reveals a coordinated infrastructure designed to mimic well-known tools while…
-
Russian APT Laundry Bear perfects zero-click phishing attack
A newly identified Russian state threat actor is using a novel zero-click phishing technique, likely developed with the help of an AI, to target Western users of Zimbra software products First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366645968/Russian-APT-Laundry-Bear-perfects-zero-click-phishing-attack
-
NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats
Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software’s source code.Every version before 4.14.0 is affected. NodeBB has fixed them all, and administrators should…
-
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign that involves the use of a malicious program that’s dressed up as a Notepad++ plugin to compromise Windows systems.The activity has been attributed by the agency to a threat cluster it tracks as UAC-0099, a Russia-aligned group that has previously observed…
-
The automotive software vulnerabilities hiding in your dashboard
Pop the hood on a new car and you won’t find much you can fix with a wrench. What you’ll find is software, and a lot of it. The screen in the dash probably runs … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/24/car-research-automotive-software-vulnerabilities/
-
IBM Bets on Multi-Billion-Dollar Open-Source Patch Business
IBM Charges Enterprises $1M Annually for Validated Legacy Open-Source Patches. IBM is betting that AI can transform legacy open-source vulnerability remediation into a multibillion-dollar business by delivering validated, backported security patches for software versions enterprises continue to run years after upstream support ends. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ibm-bets-on-multi-billion-dollar-open-source-patch-business-a-32317
-
Apiiro CEO: Coding Agents Are the New Enterprise Perimeter
Idan Plotnik: AI Development Tools Have Become Enterprises’ Newest Attack Surface. Apiiro CEO Idan Plotnik says AI coding agents have become the enterprise’s newest security perimeter, prompting organizations to shift from application security posture management to automated protection as AI accelerates both software development and vulnerability exploitation. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/apiiro-ceo-coding-agents-are-new-enterprise-perimeter-a-32314
-
Google Released Gemini 3.5 Flash Cyber AI, a Specialized AI Model for Vulnerability Hunting
Google DeepMind unveiled Gemini 3.5 Flash Cyber, an AI model for vulnerability discovery and patching, available only to governments and trusted partners. Google DeepMind announced Gemini 3.5 Flash Cyber on Tuesday, a security-focused AI model built on top of the existing 3.5 Flash architecture and designed specifically to find, validate, and patch software vulnerabilities. It…
-
Check Point warns of SmartConsole zero-day exploited in attacks
Israeli cybersecurity firm Check Point Software has addressed an actively exploited zero-day flaw in the company’s SmartConsole graphical user interface (GUI) admin panel. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/check-point-patches-smartconsole-zero-day-exploited-in-attacks/
-
Google Unveils CodeMender AI Agent for Automated Vulnerability Detection and Remediation
Google has unveiled CodeMender, a managed AI security agent designed to identify, validate, and remediate software vulnerabilities at machine speed. Announced in preview on July 22, 2023, the tool is available through the Gemini Enterprise Agent Platform and can also function as a core component of Google’s AI Threat Defense offering. This launch comes as…
-
Anthropic Launches Claude Security Plugin to Scan Codebases for Vulnerabilities Before Commit
Anthropic has launched the Claude Security plugin for Claude Code in beta, enhancing its AI-assisted development platform with security scanning capabilities designed to identify vulnerabilities earlier in the software development lifecycle. The company stated that developers can scan code changes before committing them or initiate comprehensive security reviews across an entire codebase directly from the…
-
Building a defense in depth strategy for sensitive data
In this Help Net Security video, Venkata Pavan Kumar Gummadi, Professional Software Engineer at Broadridge, explains how to build a defense in depth strategy for protecting … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/23/defense-in-depth-strategy-video/
-
Lookout launches tool to identify software exposure risk in mobile apps
First seen on scworld.com Jump to article: www.scworld.com/brief/lookout-launches-tool-to-identify-software-exposure-risk-in-mobile-apps
-
North Korean hackers target South Korean software vendors
First seen on scworld.com Jump to article: www.scworld.com/brief/north-korean-hackers-target-south-korean-software-vendors
-
Third-Party SDKs Raise Privacy Questions for Apps Marketed to U.S. Military
Researchers found Chinese and Russian SDKs in Android apps marketed to U.S. military users, highlighting software supply chain and enterprise privacy risks. The post Third-Party SDKs Raise Privacy Questions for Apps Marketed to U.S. Military appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-android-sdk-supply-chain-privacy-military-apps/
-
New Kimsuky campaign compromised South Korean software vendors
A North Korean advanced persistent threat (APT) group recently targeted vendors of collaborative-work software, South Korean researchers said. First seen on therecord.media Jump to article: therecord.media/kimsuky-north-korea-espionage-groupware-companies
-
Malware is targeting AI tools in software development environments
The worm blends in with thousands of other commands occurring daily in any given environment, yet its intent and origins remain unknown. First seen on cyberscoop.com Jump to article: cyberscoop.com/sandworm-mode-malware-ai-supply-chain-crowdstrike/