Latio Application Security Tester: Use AI to scan your code 2024-02-05 at 08:02 By Mirko Zorz Latio Application Security Tester is an open-source tool that enables the usage of OpenAI to scan code from the CLI for security and health issues. Features and future plans James Berthoty, the creator of Latio Application Security Tester, told […]
Latio Application Security Tester: Use AI to scan your code Read More »
Businesses banning or limiting use of GenAI over privacy risks 2024-02-05 at 07:01 By Help Net Security Privacy is much more than a regulatory compliance matter. Findings from a new Cisco study highlight the growing Privacy concerns with GenAI, trust challenges facing organizations over their use of AI, and the attractive returns from privacy investment. […]
Businesses banning or limiting use of GenAI over privacy risks Read More »
Migrating to the cloud: An overview of process and strategy 2024-02-05 at 06:01 By Help Net Security Over the next few years, the number of organizations navigating to the cloud to advance their business goals is expected to grow exponentially. According to Gartner, more than 70% of enterprises will use cloud platforms to accelerate their […]
Migrating to the cloud: An overview of process and strategy Read More »
NIS2 Directive raises stakes for security leaders 2024-02-02 at 08:01 By Mirko Zorz In this Help Net Security interview, Roland Palmer, VP Global Operations Center at Sumo Logic, discusses key challenges and innovations of the NIS2 Directive, aiming to standardize cybersecurity practices across sectors. NIS2 mandates minimal cybersecurity requirements for member companies, encompassing policies on […]
NIS2 Directive raises stakes for security leaders Read More »
FritzFrog botnet exploits Log4Shell, PwnKit vulnerabilities 2024-02-01 at 17:31 By Helga Labus The FritzFrog cryptomining botnet has new potential for growth: a recently analyzed variant of the bot is exploiting the Log4Shell (CVE-2021-44228) and PwnKit (CVE-2021-4034) vulnerabilities for lateral movement and privilege escalation. The FritzFrog botnet The FritzFrog botnet, initially identified in August 2020, is […]
FritzFrog botnet exploits Log4Shell, PwnKit vulnerabilities Read More »
FBI disrupts Chinese botnet used for targeting US critical infrastructure 2024-02-01 at 15:17 By Helga Labus The FBI has disrupted the KV botnet, used by People’s Republic of China (PRC) state-sponsored hackers (aka “Volt Typhoon”) to target US-based critical infrastructure organizations. A botnet for probing critical infrastructure organizations The threat actors used the KV botnet […]
FBI disrupts Chinese botnet used for targeting US critical infrastructure Read More »
Threat actor used Vimeo, Ars Technica to serve second-stage malware 2024-02-01 at 12:31 By Zeljka Zorz A financially motivated threat actor tracked as UNC4990 is using booby-trapped USB storage devices and malicious payloads hosted on popular websites such as Ars Technica, Vimeo, GitHub and GitLab to surreptitiously deliver malware. Another interesting detail about UNC4990 it’s […]
Threat actor used Vimeo, Ars Technica to serve second-stage malware Read More »
Zero trust implementation: Plan, then execute, one step at a time 2024-02-01 at 08:02 By Helga Labus 82% of cybersecurity professionals have been working on implementing zero trust last year, and 16% should be on it by the end of this year. The challenges of zero trust implementation You’ve probably heard it before: zero trust […]
Zero trust implementation: Plan, then execute, one step at a time Read More »
Custom rules in security tools can be a game changer for vulnerability detection 2024-02-01 at 07:32 By Mirko Zorz In this Help Net interview, Isaac Evans, CEO at Semgrep, discusses the balance between speed and thoroughness in CI/CD pipeline security scanning. Stressing the need to avoid slowing down the process, he recommends a nuanced approach, […]
Custom rules in security tools can be a game changer for vulnerability detection Read More »
CVEMap: Open-source tool to query, browse and search CVEs 2024-02-01 at 07:01 By Mirko Zorz CVEMap is an open-source command-line interface (CLI) tool that allows you to explore Common Vulnerabilities and Exposures (CVEs). It’s designed to offer a streamlined and user-friendly interface for navigating vulnerability databases. Although CVEs are crucial for pinpointing and discussing security […]
CVEMap: Open-source tool to query, browse and search CVEs Read More »
Unpacking the challenges of AI cybersecurity 2024-02-01 at 06:31 By Help Net Security As organizations handle increasing amounts of data daily, AI offers advanced capabilities that would be harder to achieve with traditional methods. In this Help Net Security video, Tyler Young, CISO at BigID, explores AI’s challenges, triumphs, and future in cybersecurity. The post […]
Unpacking the challenges of AI cybersecurity Read More »
A zero-day vulnerability (and PoC) to blind defenses relying on Windows event logs 2024-01-31 at 18:31 By Zeljka Zorz A zero-day vulnerability that, when triggered, could crash the Windows Event Log service on all supported (and some legacy) versions of Windows could spell trouble for enterprise defenders. Discovered by a security researcher named Florian and […]
A zero-day vulnerability (and PoC) to blind defenses relying on Windows event logs Read More »
Free ransomware recovery tool White Phoenix now has a web version 2024-01-31 at 10:17 By Help Net Security White Phoenix is a free ransomware recovery tool for situations where files are encrypted with intermittent encryption. It was tested on BlackCat/ALPHV Ransomware, Play Ransomware, Qilin/Agenda Ransomware, BianLian Ransomware, and DarkBit. Intermittent encryption occurs when ransomware chooses […]
Free ransomware recovery tool White Phoenix now has a web version Read More »
Does CVSS 4.0 solve the exploitability problem? 2024-01-31 at 08:03 By Help Net Security The newest version of the vulnerability scoring system CVSS 4.0 is here! After a lengthy gap between version 3 (released in 2015), as of November 2023 version 4.0 is officially live. Building iteratively on version 3 there are a few differences […]
Does CVSS 4.0 solve the exploitability problem? Read More »
Proactive cybersecurity: A strategic approach to cost efficiency and crisis management 2024-01-31 at 07:31 By Mirko Zorz In this Help Net Security interview, Stephanie Hagopian, VP of Security at CDW, discusses offensive strategies in the face of complex cyberattacks and the role of the zero-trust model. The conversation also covers the essential steps for a […]
Proactive cybersecurity: A strategic approach to cost efficiency and crisis management Read More »
How to make developers accept DevSecOps 2024-01-31 at 07:05 By Helga Labus According to a recent Dynatrace report, only 50% of CISOs believe that development teams have thoroughly tested the software for vulnerabilities before deploying it into the production environment. This is a statistic that needs to change and the only way to change it […]
How to make developers accept DevSecOps Read More »
Self-managed GitLab installations should be patched again (CVE-2024-0402) 2024-01-30 at 14:02 By Zeljka Zorz Less than two weeks after having plugged a security hole that allows account takeover without user interaction, GitLab Inc. has patched a critical vulnerability (CVE-2024-0402) in GitLab CE/EE again and is urging users to update their installations immediately. GitLab Inc. operates […]
Self-managed GitLab installations should be patched again (CVE-2024-0402) Read More »
Great security or great UX? Both, please 2024-01-30 at 08:02 By Help Net Security A new user is signing up for a SaaS application. On the one hand, UX teams want that user to get into the app as quickly as possible. On the other hand, security teams want the user to strongly validate their […]
Great security or great UX? Both, please Read More »
Faction: Open-source pentesting report generation and collaboration framework 2024-01-30 at 07:31 By Mirko Zorz Faction is an open-source solution that enables pentesting report generation and assessment collaboration. Josh Summitt, the creator of Faction, has always disliked the process of writing reports, preferring to focus on uncovering bugs. A key frustration for him was the redundant […]
Faction: Open-source pentesting report generation and collaboration framework Read More »
Ransomware recap 2023 highlights cybersecurity crisis 2024-01-30 at 07:02 By Help Net Security In this Help Net Security video, Yochai Corem, CEO of Cyberint, explores the ransomware environment’s development, effects, and emerging patterns throughout the previous year. 2023 marked a historic high for ransomware groups, with a 55.5% increase in attacks, reaching 4,368 victims globally, […]
Ransomware recap 2023 highlights cybersecurity crisis Read More »