Parse notes
Sponsored
This Wednesday, Drata will be hosting cybersecurity analyst and TED speaker Keren Elazari [4] for an open chat on the future of the industry and how resilience can be achieved with adaptability and innovation.
Can't attend? Register anyway and a recording will be emailed to you following the event.
GitHub Enterprise Server has disclosed a critical bug (CVE-2024-6800) that allows unauthorized admin access affecting SAML-enabled instances using public federation metadata in XML. GitHub addresses the bug and two other medium-severity vulnerabilities in this recent security update.
A new trend in phishing campaigns is to use progressive web apps (PWAs) to trick victims into entering banking credentials. The campaigns being tracked are using bogus notifications to update banking apps or ads on social media to download a bank's application to earn a promotion. The victim is then directed to a fake Google Play or App Store page that downloads the PWA which mimics the official app and steals the victim's credentials. The benefit of this method is that attackers can bypass App Store or Play Store restrictions.
Microchip Technology Incorporated has disclosed a data breach that impacted operations to the SEC. It did not disclose details of the incident but has stated that it is investigating the impact of unauthorized activity in its environment. The filing suggests that the incident may have been caused by ransomware.
This blog post from Linkedin explains why and how LinkedIn developed its own AI-driven Security Posture Platform (SPP) to manage vulnerabilities across its vast hardware estate. The SPP employs generative AI models and GraphQL API to efficiently map security engineers' queries to the graph, providing rapid access to accurate vulnerability information.
There is new research that reveals AI code assistants can be manipulated to suggest vulnerable code. A technique called CodeBreaker can poison training data, creating undetectable malicious code samples using comments in code.
This blog post discusses how C++ compilers insert wind and unwind metadata to ensure proper destructor calls during exceptions in C++ programs. Compilers invisibly insert special blocks to handle object destruction when exceptions occur, even if control flow skips normal destructor calls. Wind metadata provides valuable information for analyzing constructors and destructor calls in C++ programs.
Sponsored
* What's causing the surge in ransomware attacks, data breaches, and vulnerability exploits? * Which industries have suffered the most? * How can companies stay ahead of the latest threats?
Mixeway Flow is a versatile and comprehensive tool designed to serve as the ultimate Swiss army knife for DevSecOps processes. It streamlines the integration of security practices into your development and operations workflows, ensuring that your software is secure from the ground up.
Dalec is a project aimed at providing a declarative format for building system packages and containers from those packages in a secure manner.
GuardDog is a CLI tool that utilizes Semgrep rules to identify malicious PyPi and npm packages or Go modules.
The yearly hype cycle from Gartner suggests organizations will start adopting human-centric security and privacy techniques. Emerging technologies include AI TRiSM, cybersecurity mesh, digital immune systems, and homomorphic encryption.
This blog post provides an overview of the role of a SOC analyst. The main functions of a SOC analyst are security monitoring, incident detection, incident analysis, and incident response. Most SOCs are organized into tiers, with tier 1 analysts doing basic triage of alerts and higher tiered analysts doing more senior incident response and threat hunting.
Arden Claims Service experienced a data breach in October 2023 that affected 139,000 people. Personal information, including names and possibly Social Security numbers, was stolen by a third party. The firm is providing affected individuals with free identity protection services.
A Fifth Circuit appeals court judge ruled that geofence warrants, where law enforcement requests all data from users in an area, are unconstitutional.
The Justice Department is suing Georgia Tech for not meeting the cybersecurity standards needed for Pentagon contracts.
This post discusses the AppSec village and notes the utility of tools like GitGuardian to detect and address security vulnerabilities in software development.