Two New Web Application Risk Categories Added to OWASP Top 10 2025-11-10 at 15:21 By Ionut Arghire OWASP has added two new categories to the revised version of its Top 10 list of the most critical risks to web applications. The post Two New Web Application Risk Categories Added to OWASP Top 10 appeared first […]
Two New Web Application Risk Categories Added to OWASP Top 10 Read More »
GlassWorm Malware Returns to Open VSX, Emerges on GitHub 2025-11-10 at 14:46 By Ionut Arghire Three more VS Code extensions were infected last week and the malware has emerged in GitHub repositories as well. The post GlassWorm Malware Returns to Open VSX, Emerges on GitHub appeared first on SecurityWeek. This article is an excerpt from
GlassWorm Malware Returns to Open VSX, Emerges on GitHub Read More »
Critical Flaw in Popular React Native NPM Package Exposes Developers to Attacks 2025-11-04 at 18:39 By Eduard Kovacs Arbitrary command/code execution has been demonstrated through the exploitation of CVE-2025-11953 on Windows, macOS and Linux. The post Critical Flaw in Popular React Native NPM Package Exposes Developers to Attacks appeared first on SecurityWeek. This article is
Critical Flaw in Popular React Native NPM Package Exposes Developers to Attacks Read More »
Bugcrowd Acquires Application Security Firm Mayhem 2025-11-04 at 15:32 By Eduard Kovacs Bugcrowd said the acquisition of Mayhem has nearly doubled its valuation — previously reported at over $1 billion. The post Bugcrowd Acquires Application Security Firm Mayhem appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Bugcrowd Acquires Application Security Firm Mayhem Read More »
Financial services can’t shake security debt 2025-11-04 at 07:30 By Anamarija Pogorelec In financial services, application security risk is becoming a long game. Fewer flaws appear in new code, but old ones linger longer, creating a kind of software “interest” that keeps growing, according to Veracode’s 2025 State of Software Security report. Researchers analyzed data
Financial services can’t shake security debt Read More »
Who is Zico Kolter? A Professor Leads OpenAI Safety Panel With Power to Halt Unsafe AI Releases 2025-11-03 at 16:23 By Associated Press Kolter leads a panel at OpenAI that has the authority to halt the ChatGPT maker’s release of new AI systems if it finds them unsafe. The post Who is Zico Kolter? A
Webinar Today: Fact vs. Fiction – The Truth About API Security 2025-10-15 at 17:37 By SecurityWeek News Get practical guidance to protect APIs against the threats attackers are using right now. The post Webinar Today: Fact vs. Fiction – The Truth About API Security appeared first on SecurityWeek. This article is an excerpt from SecurityWeek
Webinar Today: Fact vs. Fiction – The Truth About API Security Read More »
The diagnosis is in: Mobile health apps are bad for your privacy 2025-10-15 at 07:40 By Sinisa Markovic Sensitive data is moving through Android healthcare apps without adequate protection. Researchers found that many transmit information without encryption, store files without safeguards, or share it through third-party components. Study design showing data collection, static security analysis
The diagnosis is in: Mobile health apps are bad for your privacy Read More »
GitHub Boosting Security in Response to NPM Supply Chain Attacks 2025-09-24 at 13:18 By Ionut Arghire GitHub will implement local publishing with mandatory 2FA, granular tokens that expire after seven days, and trusted publishing. The post GitHub Boosting Security in Response to NPM Supply Chain Attacks appeared first on SecurityWeek. This article is an excerpt
GitHub Boosting Security in Response to NPM Supply Chain Attacks Read More »
Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit 2025-09-17 at 16:04 By Ionut Arghire The packages were injected with malicious code to harvest secrets, dump them to a public repository, and make private repositories public. The post Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit
Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit Read More »
Highly Popular NPM Packages Poisoned in New Supply Chain Attack 2025-09-10 at 11:45 By Ionut Arghire Designed to intercept cryptocurrency transactions, the malicious code reached 10% of cloud environments. The post Highly Popular NPM Packages Poisoned in New Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Highly Popular NPM Packages Poisoned in New Supply Chain Attack Read More »
GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets 2025-09-08 at 16:20 By Eduard Kovacs A supply chain attack called GhostAction has enabled threat actors to steal secrets and exploit them. The post GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets appeared first on SecurityWeek. This article is an excerpt from SecurityWeek
GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets Read More »
US, Allies Push for SBOMs to Bolster Cybersecurity 2025-09-04 at 13:52 By Ionut Arghire SBOM adoption will drive software supply chain security, decreasing risks and costs, and improving transparency. The post US, Allies Push for SBOMs to Bolster Cybersecurity appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
US, Allies Push for SBOMs to Bolster Cybersecurity Read More »
Five habits of highly secure development teams 2025-09-03 at 07:46 By Help Net Security In this Help Net Security video, Brendon Collins, Principal Consultant at Optiv, explores how organizations can embed security and privacy into the software development lifecycle (SDLC) from the very start. He outlines five proactive principles, including default-deny architecture, privacy in the
Five habits of highly secure development teams Read More »
CISA Requests Public Feedback on Updated SBOM Guidance 2025-08-25 at 13:54 By Ionut Arghire CISA has updated the Minimum Elements for a Software Bill of Materials (SBOM) guidance and is seeking public comment. The post CISA Requests Public Feedback on Updated SBOM Guidance appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View
CISA Requests Public Feedback on Updated SBOM Guidance Read More »
Watch Now: CodeSecCon – Where Software Security’s Next Chapter Unfolds (Virtual Event) 2025-08-16 at 16:58 By SecurityWeek News CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained. The post Watch Now: CodeSecCon – Where Software Security’s Next Chapter Unfolds (Virtual Event) appeared
Watch Now: CodeSecCon – Where Software Security’s Next Chapter Unfolds (Virtual Event) Read More »
CodeSecCon Is Today: Where Software Security’s Next Chapter Unfolds (Virtual Event) 2025-08-12 at 15:35 By SecurityWeek News Taking place August 12-13, CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained. The post CodeSecCon Is Today: Where Software Security’s Next Chapter Unfolds (Virtual
CodeSecCon Is Today: Where Software Security’s Next Chapter Unfolds (Virtual Event) Read More »
CodeSecCon 2025: Where Software Security’s Next Chapter Unfolds 2025-08-08 at 19:52 By SecurityWeek News Taking place August 12-13, CodeSecCon is the premier virtual event bringing together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained. The post CodeSecCon 2025: Where Software Security’s Next Chapter Unfolds appeared first on SecurityWeek. This
CodeSecCon 2025: Where Software Security’s Next Chapter Unfolds Read More »
Flaw in Vibe Coding Platform Base44 Exposed Private Enterprise Applications 2025-07-30 at 14:18 By Eduard Kovacs Base44 owner Wix quickly patched a critical authentication bypass vulnerability discovered by researchers at Wiz. The post Flaw in Vibe Coding Platform Base44 Exposed Private Enterprise Applications appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View
Flaw in Vibe Coding Platform Base44 Exposed Private Enterprise Applications Read More »
Inside the application security crisis no one wants to talk about 2025-07-29 at 07:50 By Anamarija Pogorelec Despite knowing the risks, most organizations are still shipping insecure software. That’s one of the stark findings from Cypress Data Defense’s 2025 State of Application Security report, which reveals a worsening crisis in software security. According to the
Inside the application security crisis no one wants to talk about Read More »