Collecting Cyber-News from over 60 sources

Tag: programming

OWASP supply chain security cheat sheet: 5 key action items

Mar 13, 2025 4:52 PM

by

Andy Stern

in SecurityNews

Tags: ai, programming, software, supply-chain, tool
Ebyte Ransomware Targets Windows Users with Advanced Encryption Techniques

Mar 11, 2025 5:54 PM

by

Andy Stern

in SecurityNews

Tags: cyber, encryption, programming, ransom, ransomware, threat, windows

A new ransomware variant, known as Ebyte Ransomware, has emerged as a significant threat to Windows users. Developed in the Go programming language, this ransomware employs sophisticated encryption techniques, including ChaCha20 and Elliptic Curve Integrated Encryption Scheme (ECIES), to lock user files and demand ransom payments. The ransomware, inspired by Prince Ransomware, adds a unique…
Generative AI software development boosts productivity, and risk

Mar 11, 2025 4:54 PM

by

Andy Stern

in SecurityNews

Tags: ai, programming, risk, software
Companies are drowning in high-risk software security debt, and the breach outlook is getting worse

Mar 11, 2025 9:54 AM

by

Andy Stern

in SecurityNews

Tags: application-security, automation, best-practice, breach, cloud, cve, cybersecurity, data, flaw, framework, open-source, penetration-testing, programming, regulation, resilience, risk, risk-analysis, software, strategy, supply-chain, training, update, vulnerability, xss

Flaw prevalence: Leading organizations have flaws in fewer than 43% of applications, while lagging organizations exceed 86%.Fix capacity: Leaders resolve over 10% of flaws monthly, whereas laggards address less than 1%.Fix speed: Top performers remediate half of flaws in five weeks; lower-performing organizations take longer than a year.Security debt prevalence: Less than 17% of applications…
Secrets Detection Beyond the Repository: Securing The EndEnd Software Development Factory

Mar 11, 2025 8:54 AM

by

Andy Stern

in SecurityNews

Tags: access, detection, programming, software

Imagine this: A developer, pressed for time, drops an AWS access key into a Slack channel, asking a teammate for help debugging a production issue. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/secrets-detection-beyond-the-repository-securing-the-end-to-end-software-development-factory/
NHS investigating how API flaw exposed patient data

Mar 5, 2025 6:34 PM

by

Andy Stern

in SecurityNews

Tags: api, data, data-breach, flaw, healthcare, programming, vulnerability

NHS patient data was left vulnerable by a flaw in an application programming interface used at online healthcare provider Medefer First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366620174/NHS-investigating-how-API-flaw-exposed-patient-data
Role of AutoSecT in API Pentesting

Mar 5, 2025 12:34 PM

by

Andy Stern

in SecurityNews

Tags: api, penetration-testing, programming, service, software

APIs (Application Programming Interfaces) have become the backbone of modern software, enabling seamless communication between applications and services with efficiency and simplicity. As APIs play an increasingly vital role in today’s digital ecosystem, ensuring their security is more critical than ever. A key aspect of the Software Development Life Cycle (SDLC) is API Pentesting. This……
Getting the Most Value Out of the OSCP: The PEN-200 Course

Mar 4, 2025 6:34 PM

by

Andy Stern

in SecurityNews

Tags: access, antivirus, attack, awareness, backdoor, cloud, compliance, conference, control, credentials, cve, cybersecurity, data, defense, detection, dos, edr, endpoint, exploit, github, gitlab, guide, hacker, hacking, jobs, kali, linkedin, linux, login, malicious, malware, mandiant, microsoft, network, ntlm, open-source, password, penetration-testing, powershell, programming, rce, remote-code-execution, risk, service, skills, software, tactics, theft, threat, tool, unauthorized, update, vmware, vulnerability, windows

In this second post of a five-part series, I provide advice on how to best utilize the PEN-200 course material for a successful career in ethical hacking. Disclaimer: All opinions expressed in this article are solely my own. I have reviewed the content to ensure compliance with OffSec’s copyright policies and agreements. I have not been…
What Is Code Scanning? Approaches and Best Practices

Mar 4, 2025 6:34 AM

by

Andy Stern

in SecurityNews

Tags: best-practice, flaw, programming, software, vulnerability
C++ creator calls for help to defend programming language from ‘serious attacks’

Mar 2, 2025 7:34 PM

by

Andy Stern

in SecurityNews

Tags: attack, programming

Bjarne Stroustrup says standards committee needs to show it can respond to memory safety push First seen on theregister.com Jump to article: www.theregister.com/2025/03/02/c_creator_calls_for_action/
Almost All Organisations Experienced API Security Issues in Past Year

Mar 1, 2025 10:34 AM

by

Andy Stern

in SecurityNews

Tags: api, data, programming

The latest State of API Security Report by Salt Security has highlighted the ongoing challenges faced by organisations in securing their application programming interfaces (APIs). The Salt Labs State of API Security Report Q1 2025 draws on survey responses from over 200 IT and security professionals, alongside anonymised data from Salt Security’s customer base, to…
Is Vibe Coding The Future of Software Development

Feb 21, 2025 1:23 PM

by

Andy Stern

in SecurityNews

Tags: ai, programming, software, technology

Digital Technology is evolving faster than ever, and the way we interact with it is transforming dramatically. With the rise of AI-driven development, no-code/low-code platforms,…Read More First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/02/is-vibe-coding-the-future-of-software-development/
Understanding OWASP’s Top 10 list of non-human identity critical risks

Feb 20, 2025 7:46 AM

by

Andy Stern

in SecurityNews

Tags: access, api, attack, authentication, awareness, best-practice, blizzard, breach, cloud, compliance, computing, control, credentials, cybersecurity, data, data-breach, detection, encryption, exploit, framework, gartner, guide, iam, identity, infrastructure, Internet, kubernetes, least-privilege, malicious, marketplace, mfa, microsoft, mitigation, monitoring, network, nist, okta, password, programming, radius, risk, saas, security-incident, service, software, technology, threat, tool, unauthorized, vulnerability, zero-trust

OWASPThis scenario also occurs with NHIs, and as mentioned above, at a scale that significantly exceeds that of their human counterparts. In this case, the credentials are often tied to applications, services, automated workflows, and systems that are given NHI credentials to facilitate activities but then never cleaned up as the associated applications, services, and…
GPT-4o Copilot Covers More Than 30 Popular Programming Languages

Feb 19, 2025 7:46 AM

by

Andy Stern

in SecurityNews

Tags: cyber, github, programming, rust, update

GitHub has launchedGPT-4o Copilot, a refined code completion model now available to Visual Studio Code users. Built on the GPT-4o mini architecture and trained on over 275,000 high-quality public repositories, the update marks a leap in multi-language support, performance accuracy, and contextual understanding across more than 30 popular programming languages, including Python, JavaScript, Rust, Go, and TypeScript. Expanded Language…
CISA and FBI Warn Against Buffer Overflow Vulnerabilities

Feb 13, 2025 5:48 PM

by

Andy Stern

in SecurityNews

Tags: cisa, programming, software, vulnerability

US agencies have issued a new alert to eliminate buffer overflow vulnerabilities, urging memory-safe programming for secure-by-design software development First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-fbi-buffer-overflow/
Docker Inc. CEO swap has analysts anticipating a sale

Feb 13, 2025 1:48 PM

by

Andy Stern

in SecurityNews

Tags: ceo, docker, oracle, programming, software

Industry watchers see the takeover by a former Oracle exec as the precursor to merging with a broader software development portfolio at a larger company. First seen on techtarget.com Jump to article: www.techtarget.com/searchsoftwarequality/news/366619297/Docker-Inc-CEO-swap-has-analysts-anticipating-a-sale
GitHub Copilot’s New Agent Mode Enables Autonomous Code Completion

Feb 10, 2025 12:37 PM

by

Andy Stern

in SecurityNews

Tags: ai, cyber, github, programming, software

GitHub has once again raised the bar for productivity in software development with the launch of its revolutionary >>Agent Mode
Attackers hide malicious code in Hugging Face AI model Pickle files

Feb 7, 2025 9:06 PM

by

Andy Stern

in SecurityNews

Tags: ai, data, github, malicious, ml, open-source, programming, remote-code-execution, risk, service, software, threat, tool, vulnerability

Like all repositories of open-source software in recent years, AI model hosting platform Hugging Face has been abused by attackers to upload trojanized projects and assets with the goal of infecting unsuspecting users. The latest technique observed by researchers involves intentionally broken but poisoned Python object serialization files called Pickle files.Often described as the GitHub…
Lazarus Group tricks job seekers on LinkedIn with crypto-stealer

Feb 6, 2025 2:06 PM

by

Andy Stern

in SecurityNews

Tags: attack, backdoor, credentials, crypto, data, github, group, infection, jobs, korea, lazarus, linkedin, linux, login, macOS, malicious, malware, microsoft, north-korea, programming, scam, software, tactics, theft, threat, windows

North Korea-linked Lazarus Group is duping job seekers and professionals in an ongoing campaign that runs a LinkedIn recruiting scam to capture browser credentials, steal crypto wallet data, and launch persistence.According to a discovery made by BitDefender Labs, threat actors reach out with fake LinkedIn job offers to lure the victims into downloading and executing…
Go Module Mirror served backdoor to devs for 3+ years

Feb 5, 2025 2:12 PM

by

Andy Stern

in SecurityNews

Tags: attack, backdoor, programming, supply-chain

Supply chain attack targets developers using the Go programming language. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/02/backdoored-package-in-go-mirror-site-went-unnoticed-for-3-years/
Crypto-stealing iOS, Android malware found on App Store, Google Play

Feb 5, 2025 1:12 PM

by

Andy Stern

in SecurityNews

Tags: android, apple, crypto, google, malware, programming, software

A number of iOS and Android apps on Apple’s and Google’s official app stores contain a software development kit (SDK) that allows them to exfiltrate … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/05/crypto-stealing-ios-android-malware-found-on-app-store-google-play-sparkcat-malicious-sdk/
Abandoned AWS S3 buckets open door to remote code execution, supply-chain compromises

Feb 5, 2025 5:12 AM

by

Andy Stern

in SecurityNews

Tags: access, advisory, antivirus, apt, attack, cisa, cloud, cybersecurity, finance, framework, government, iam, infrastructure, injection, Internet, linux, macOS, malicious, malware, military, network, open-source, programming, ransomware, remote-code-execution, risk, social-engineering, software, supply-chain, tool, update, windows

Code references to nonexistent cloud assets continue to pose significant security risks, and the problem is only growing. Recent research identified approximately 150 AWS S3 storage buckets once used by various software projects to host sensitive scripts, configuration files, software updates, and other binary artifacts that were automatically downloaded and executed on user machines.Because these…
Poisoned Go programming language package lay undetected for 3 years

Feb 4, 2025 7:12 PM

by

Andy Stern

in SecurityNews

Tags: programming

Researcher says ecosystem’s auto-caching is a net positive but presents exploitable quirks First seen on theregister.com Jump to article: www.theregister.com/2025/02/04/golang_supply_chain_attack/
Why Some Source Code Files Shouldn’t Be Managed via Git-Based Version Control

Feb 4, 2025 9:12 AM

by

Andy Stern

in SecurityNews

Tags: control, github, programming, software

The ubiquitous version control system, Git, has revolutionised software development workflows with its robust set of capabilities. It simplifies the tracking of code changes, enables seamless branching and merging, and facilitates tight collaboration. Today, more than 100 million developers worldwide use the GitHub platform alone. However, Git is not always a suitable solution for all…
Lazarus Group Exploits Trusted Apps for Data Theft via Dropbox

Feb 3, 2025 5:12 PM

by

Andy Stern

in SecurityNews

Tags: crypto, cyber, data, espionage, exploit, group, infrastructure, korea, lazarus, north-korea, programming, software, technology, theft, tool

In an alarming development, North Korea’s infamous Lazarus Group has been linked to a global cyber espionage campaign, code-named Operation Phantom Circuit. Beginning in September 2024, this operation exploited trusted software development tools to infiltrate systems worldwide, targeting cryptocurrency and technology developers. The campaign’s advanced obfuscation techniques and infrastructure demonstrate a significant evolution in the…
API Supply Chain Attacks, The Sky’s the Limit

Jan 28, 2025 6:36 PM

by

Andy Stern

in SecurityNews

Tags: access, api, attack, authentication, awareness, business, control, credentials, credit-card, data, defense, email, endpoint, exploit, flaw, GDPR, governance, jobs, login, malicious, mobile, penetration-testing, phone, programming, risk, service, supply-chain, technology, unauthorized, vulnerability

Account takeover of a third-party service provider may put millions of airline users worldwide at risk. Summary Salt Labs has identified an account takeover vulnerability in a popular online top-tier travel service for hotel and car rentals. The service is integrated into dozens of commercial airline online services and allows airline users to add hotel…
Treasury Department Breach: A Crucial Reminder for API Security in the Public Sector

Jan 23, 2025 6:22 PM

by

Andy Stern

in SecurityNews

Tags: access, ai, api, application-security, attack, authentication, breach, china, cve, cyber, data, detection, exploit, finance, flaw, framework, governance, government, hacker, healthcare, infrastructure, injection, malicious, monitoring, network, programming, risk, siem, software, sql, strategy, supply-chain, threat, tool, unauthorized, vpn, vulnerability, zero-day, zero-trust

The recent cyber breach at the U.S. Treasury Department, linked to state-sponsored Chinese hackers, has set off alarm bells in the public sector. As the investigation continues, this incident reveals a pressing issue that all government agencies must confront: securing their APIs (Application Programming Interfaces). APIs are essential connections within our digital infrastructure, facilitating communication…
Empowering Teams with Secure API Management

Jan 23, 2025 6:22 AM

by

Andy Stern

in SecurityNews

Tags: api, cybersecurity, programming, strategy

Why is Secure API Management Essential for Team Empowerment? Is API management a critical aspect of your organization’s cybersecurity strategy? It should be. APIs, or Application Programming Interfaces, are the engines that power today’s digital ecosystem. They enable systems to communicate, allowing for streamlined operations and improved productivity. However, incorrectly managed APIs expose businesses to……
‘Severe’ bug in ChatGPT’s API could be used to DDoS websites

Jan 22, 2025 9:24 PM

by

Andy Stern

in SecurityNews

Tags: api, chatgpt, ddos, programming, vulnerability

The vulnerability, described by a researcher as “bad programming,” allows an attacker to send unlimited connection requests through ChatGPT’s API. First seen on cyberscoop.com Jump to article: cyberscoop.com/ddos-openai-chatgpt-api-vulnerability-microsoft/
The Quiet Rise of the ‘API Tsunami’

Jan 22, 2025 8:22 PM

by

Andy Stern

in SecurityNews

Tags: access, api, attack, authentication, breach, business, cloud, compliance, control, data, data-breach, encryption, endpoint, finance, GDPR, healthcare, HIPAA, infrastructure, law, leak, mail, malicious, mfa, mobile, monitoring, network, privacy, programming, regulation, risk, security-incident, service, threat, tool, unauthorized, update, vulnerability

As enterprises increasingly adopt cloud-native architectures, microservices, and third-party integrations, the number of Application Programming Interfaces (APIs) has surged, creating an “API tsunami” in an organization’s infrastructure that threatens to overwhelm traditional management practices. As digital services proliferate, so does the development of APIs, which allow various applications to communicate or integrate with each other…