Tag: supply-chain
-
Salesforce investigates new incident echoing Salesloft Drift compromise
Tags: supply-chainIn what may be a repeat of the Salesloft Drift supply chain compromise, Salesforce confirmed that they’ve identified unusual activity involving Gainsight-published apps … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/20/salesforce-investigates-new-incident-echoing-salesloft-drift-compromise/
-
Tsundere Botnet Targets Windows, Linux macOS via Node.js Packages
A Russian-speaking threat actor attributed to the username >>koneko
-
Supply Chain Breaches Impact Almost All Firms Globally, BlueVoyant Reveals
Despite a growing maturity of third-party risk management programs, supply chain attacks impacted more organizations in 2025 than in previous years First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/supply-chain-breaches-impact/
-
Attack Surface Management ein Kaufratgeber
Tags: ai, api, attack, business, cloud, crowdstrike, cyber, cyberattack, cybersecurity, data, detection, dns, framework, hacker, hacking, HIPAA, incident response, infrastructure, intelligence, Internet, microsoft, monitoring, network, open-source, PCI, penetration-testing, risk, service, soc, software, supply-chain, threat, tool, update, vulnerabilityMit diesen Attack Surface Management Tools sorgen Sie im Idealfall dafür, dass sich Angreifer gar nicht erst verbeißen.Regelmäßige Netzwerk-Scans reichen für eine gehärtete Angriffsfläche nicht mehr aus. Um die Sicherheit von Unternehmensressourcen und Kundendaten zu gewährleisten, ist eine kontinuierliche Überwachung auf neue Ressourcen und Konfigurationsabweichungen erforderlich. Werkzeuge im Bereich Cyber Asset Attack Surface Management (CAASM)…
-
How We Ditched the SaaS Status Quo for Time-Series Telemetry
Free the logs! Behind the scenes at InfluxData, which turned to its own in-house security monitoring platform, DiSCO, to protect its supply chain after its third-party tool was breached. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/how-we-ditched-the-saas-status-quo-for-time-series-telemetry
-
‘PlushDaemon’ hackers hijack software updates in supply-chain attacks
The China-aligned advanced persistent threat (APT) tracked as ‘PlushDaemon’ is hijacking software update traffic to deliver malicious payloads to its targets. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/plushdaemon-hackers-hijack-software-updates-in-supply-chain-attacks/
-
New npm Malware Campaign Checks If Visitor Is a Victim or Researcher Before Initiating Infection
The Socket Threat Research Team has uncovered a sophisticated npm malware campaign orchestrated by the threat actor dino_reborn, who deployed 7 malicious packages designed to distinguish genuine targets from security researchers before executing their payloads. This nuanced approach represents a significant evolution in supply chain attacks, blending traffic cloaking, anti-analysis techniques, and deceptive UI elements…
-
JFrog introduces shadow AI detection for secure software supply chain
First seen on scworld.com Jump to article: www.scworld.com/brief/enhancing-ai-governance-jfrog-introduces-shadow-ai-detection-for-secure-software-supply-chain
-
What the DoD’s Missteps Teach Us About Cybersecurity Fundamentals for 2026
As organizations enter 2026, the real threat isn’t novel exploits but blind spots in supply chain security, proximity attack surfaces, and cross-functional accountability. This piece explains why fundamentals must become continuous, operational disciplines for modern cyber resilience. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/what-the-dods-missteps-teach-us-about-cybersecurity-fundamentals-for-2026/
-
What the DoD’s Missteps Teach Us About Cybersecurity Fundamentals for 2026
As organizations enter 2026, the real threat isn’t novel exploits but blind spots in supply chain security, proximity attack surfaces, and cross-functional accountability. This piece explains why fundamentals must become continuous, operational disciplines for modern cyber resilience. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/what-the-dods-missteps-teach-us-about-cybersecurity-fundamentals-for-2026/
-
Shared Intel QA: Viewing CMMC as a blueprint for readiness across the defense supply chain
Small and mid-sized contractors play a vital role in the U.S. defense industrial base, but too often, they remain the weakest link in the cybersecurity chain. Related: Pentagon enforcing CMMC RADICL’s 2025 DIB Cybersecurity Maturity Report reveals that 85%… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/shared-intel-qa-viewing-cmmc-as-a-blueprint-for-readiness-across-the-defense-supply-chain/
-
Shared Intel QA: Viewing CMMC as a blueprint for readiness across the defense supply chain
Small and mid-sized contractors play a vital role in the U.S. defense industrial base, but too often, they remain the weakest link in the cybersecurity chain. Related: Pentagon enforcing CMMC RADICL’s 2025 DIB Cybersecurity Maturity Report reveals that 85%… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/11/shared-intel-qa-viewing-cmmc-as-a-blueprint-for-readiness-across-the-defense-supply-chain/
-
The tech that turns supply chains from brittle to unbreakable
In this Help Net Security interview, Sev Kelian, CISO and VP of Security at Tecsys, discusses how organizations can strengthen supply chain resilience through a more unified … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/17/sev-kelian-tecsys-supply-chain-resilience-strategy/
-
Spam flooding npm registry with token stealers still isn’t under control
Tags: access, antivirus, attack, authentication, blockchain, breach, control, credentials, crypto, detection, edr, exploit, finance, firewall, governance, identity, login, malicious, malware, mfa, monitoring, network, open-source, pypi, risk, software, spam, supply-chain, threat, tool, wormCSO that number has now grown to 153,000.And while this payload merely steals tokens, other threat actors are paying attention, said Sonatype CTO Brian Fox.When Sonatype wrote about the campaign just over a year ago, it found a mere 15,000 packages that appeared to come from a single person.With the swollen numbers reported this week,…
-
Worm flooding npm registry with token stealers still isn’t under control
Tags: access, antivirus, attack, authentication, blockchain, breach, control, credentials, crypto, detection, edr, exploit, finance, firewall, governance, identity, login, malicious, malware, mfa, monitoring, network, open-source, pypi, risk, software, supply-chain, threat, tool, wormCSO that number has now grown to 153,000.”It’s unfortunate that the worm isn’t under control yet,” said Sonatype CTO Brian Fox.And while this payload merely steals tokens, other threat actors are paying attention, he predicted.”I’m sure somebody out there in the world is looking at this massively replicating worm and wondering if they can ride…
-
Cybersecurity Snapshot: Refresh Your Akira Defenses Now, CISA Says, as OWASP Revamps Its App Sec Top 10 Risks
Tags: access, advisory, ai, antivirus, application-security, attack, authentication, backup, business, chatgpt, cisa, ciso, cloud, compliance, control, corporate, cve, cyber, cybersecurity, data, defense, detection, encryption, endpoint, exploit, finance, firewall, flaw, framework, germany, group, guide, healthcare, infrastructure, injection, Internet, iot, law, malware, mfa, mitigation, phishing, privacy, programming, ransomware, resilience, risk, service, soc, software, supply-chain, tactics, technology, threat, tool, update, vulnerabilityLearn why you should revise your Akira ransomware protection plans. Plus, find out what’s new in OWASP’s revamped Top 10 Web Application Risks list. Also, find out about agentic AI’s cognitive degradation risk. And get the latest on AI security trends and CISO compensation. Key takeaways CISA and other agencies are urging organizations, especially in…
-
Cybersecurity Snapshot: Refresh Your Akira Defenses Now, CISA Says, as OWASP Revamps Its App Sec Top 10 Risks
Tags: access, advisory, ai, antivirus, application-security, attack, authentication, backup, business, chatgpt, cisa, ciso, cloud, compliance, control, corporate, cve, cyber, cybersecurity, data, defense, detection, encryption, endpoint, exploit, finance, firewall, flaw, framework, germany, group, guide, healthcare, infrastructure, injection, Internet, iot, law, malware, mfa, mitigation, phishing, privacy, programming, ransomware, resilience, risk, service, soc, software, supply-chain, tactics, technology, threat, tool, update, vulnerabilityLearn why you should revise your Akira ransomware protection plans. Plus, find out what’s new in OWASP’s revamped Top 10 Web Application Risks list. Also, find out about agentic AI’s cognitive degradation risk. And get the latest on AI security trends and CISO compensation. Key takeaways CISA and other agencies are urging organizations, especially in…
-
How 43,000 NPM Spam Packages Hid in Plain Sight for Two Years
A two-year campaign quietly flooded npm with 43,000 dormant packages, exposing major supply-chain security gaps. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/how-43000-npm-spam-packages-hid-in-plain-sight-for-two-years/
-
Supply Chain Security made the OWASP Top Ten, this changes nothing
Tags: supply-chainIf you’ve been in the security universe for the last few decades, you’ve heard of the OWASP Top Ten. It’s a list of 10 security problems that we move around every year and never really solve. Oh sure, there are a few things we’ve made less bad, but fundamentally the list shows how our use……
-
Malicious Chrome Extension Grants Full Control Over Ethereum Wallet
Security researchers have uncovered a sophisticated supply chain attack disguised as a legitimate cryptocurrency wallet. Socket’s Threat Research Team discovered a malicious Chrome extension called >>Safery: Ethereum Wallet,
-
Black Duck SCA Adds AI Model Scanning to Strengthen Software Supply Chain Security
Black Duck has expanded its software composition analysis (SCA) capabilities to include AI model scanning, helping organisations gain visibility into the growing use of open-source AI models embedded in enterprise software. With the release of version 2025.10.0, the company’s new AI Model Risk Insights capability allows teams to identify and analyse AI models used within…
-
Black Duck SCA Adds AI Model Scanning to Strengthen Software Supply Chain Security
Black Duck has expanded its software composition analysis (SCA) capabilities to include AI model scanning, helping organisations gain visibility into the growing use of open-source AI models embedded in enterprise software. With the release of version 2025.10.0, the company’s new AI Model Risk Insights capability allows teams to identify and analyse AI models used within…
-
Fake NPM Package With 206K Downloads Targeted GitHub for Credentials (UPDATED)
Veracode Threat Research exposed a targeted typosquatting attack on npm, where the malicious package @acitons/artifact stole GitHub tokens. Learn how this supply chain failure threatened the GitHub organisation’s code. First seen on hackread.com Jump to article: hackread.com/fake-npm-package-downloads-github-credentials/
-
OWASP Top 10: Broken access control still tops app security list
Risk list highlights misconfigs, supply chain failures, and singles out prompt injection in AI apps First seen on theregister.com Jump to article: www.theregister.com/2025/11/11/new_owasp_top_ten_broken/