Vulnerability Management

New malware strain a continuation of the North Korean Contagious Interview job lure campaign first described last December.

Threat modeling has been in the appsec toolbox for decades. But it hasn't always been used and it hasn't always been useful. Sandy Carielli shares what she's learned from talking to orgs about what's been successful, and what's failed, when they've approached this practice. Akira Brand joins to talk about her direct experience with building threat ...

A total of 768 CVE-listed vulnerabilities exploited in the wild, a 20% increase from 2023.

This week in the enterprise security weekly news, we discuss funding and acquisitions Understanding the Semgrep license drama Ridiculous vulnerabilities everywhere: vulns to take down your entire city’s cell service vulns to mess with your Subarus vulns in Microsoft 365 authentication cybersecurity regulations are worthless Facebook is banning pe...

AI agents and GenAI-driven fuzzing tools are already discovering flaws in open-source software.

While the archived projects remain available for download, users will be provided a warning banner to help them make informed dependency choices. PyPI aims to enhance supply-chain security by preventing attackers from hijacking abandoned projects and injecting malicious updates.

.ASS, Deepseek, AI Time Travel, Google, HeartBlocker, TikTok, Aaran Leyland, and More, on this edition of the Security Weekly News.

Agencies say firmware backdoor can cause an RCE, which could result in faulty readings on patients’ vital signs.