Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
The Open Source Security Foundation (OpenSSF), a cross-industry organization hosted at the Linux Foundation that brings together the world's most important sof…
Sigstore community today announced the first stable release of sigstore-python, improving software supply chain security and paving the way for other client im…
A new attack vector targeting the Visual Studio Code extensions marketplace could be leveraged to upload rogue extensions masquerading as their legitimate coun…
Threat actors continue to adapt to the latest technologies, practices, and even data privacy laws—and it's up to organizations to stay one step ahead by implem…
Government entities in Ukraine have been breached as part of a new campaign that leveraged trojanized versions of Windows 10 installer files to conduct post-ex…
An active malware campaign is targeting the Python Package Index (PyPI) and npm repositories for Python and JavaScript with typosquatted and fake modules that …
Addressing a decades-old deficiency in coding curriculums could have a profound effect on the security of the software supply chain, a leading expert on the su…
SOS.dev initiative will combat software supply chain attacks by encouraging researchers to suggest security improvements to key projects.
Global visionaries headline the premier open source event in Europe to share on OSS adoption in Europe , driving the circular economy, finding inspiration thro…
4,000 Google Titan security keys should help to protect critical Python projects from software supply chain attacks.
Yet another malicious Python package has been spotted in the PyPI registry performing supply chain attacks to drop Cobalt Strike beacons and backdoors on Windo…
Yet another malicious Python package has been spotted in the PyPI registry performing supply chain attacks to drop Cobalt Strike beacons and backdoors on Windo…
The Open Source Software Security Foundation (OpenSSF), a project of the Linux Foundation, has come up with a 10-point plan to improve the safety of the softwa…
With the COVID-19 pandemic continuing to impact, and perhaps permanently changing, how we work, cybercriminals again leveraged the distraction in new waves of …
The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed …
Researchers have discovered a severe supply-chain attack that plants web skimmers on real-estate websites via…Hackers Exploit Cloud Video Platform To Target Re…
Mozilla is beginning to roll out Firefox 95 with a new sandboxing technology called RLBox that prevents untrusted code and other security vulnerabilities from …
A novel class of vulnerabilities could be leveraged by threat actors to inject visually deceptive malware in a way that's semantically permissible but alters t…
Security is becoming an increasingly key piece of the open source puzzle amid industry-wide pushes to shift left and integrate security during early stages of …
The U.S. Cybersecurity and Infrastructure Security Agency on FridayÂwarnedÂof crypto-mining and password-stealing malware embedded in "UAParser.js," a popular …
Microsoft on Monday revealed new malware deployed by the hacking group behind the SolarWinds supply chain attack last December to deliver additional payloads a…
In use for a decade as the de facto standard for communicating software bills of materials, The Linux Foundation has announced that the Software Package Data E…
As many as eight Python packages that were downloaded more than 30,000 times have been removed from the PyPI portal for containing malicious code, once again h…
Nearly three weeks after Florida-based software vendor Kaseya was hit by aÂwidespread supply-chain ransomware attack, the company on Thursday said it obtained …
