Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Threat actors are now taking advantage of GitHub's search functionality to trick unsuspecting users looking for popular repositories into downloading spurious …
The malicious code inserted into the open-source library XZ Utils, a widely used package present in major Linux distributions, is also capable of facilitating …
As many as 100 malicious artificial intelligence (AI)/machine learning (ML) models have been discovered in the Hugging Face platform.These include instances wh…
A dormant package available on the Python Package Index (PyPI) repository was updated nearly after two years to propagate an information stealer malware called…
IntroductionThe modern software supply chain represents an ever-evolving threat landscape, with each package added to the manifest introducing new attack vecto…
The updated packages fix security vulnerabilities: A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with di…
Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-expl…
Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attac…
Telecommunication, media, internet service providers (ISPs), information technology (IT)-service providers, and Kurdish websites in the Netherlands have been t…
A new set of 48 malicious npm packages have been discovered in the npm repository with capabilities to deploy a reverse shell on compromised systems."These pac…
Cybersecurity researchers have uncovered a new set of malicious packages published to the NuGet package manager using a lesser-known method for malware deploym…
A malicious package hosted on the NuGet package manager for the .NET Framework has been found to deliver a remote access trojan called SeroXen RAT.The package,…
A download manager site served Linux users malware that stealthily stole passwords and other sensitive information for more than three years as part of a suppl…
Three additional rogue Python packages have been discovered in the Package Index (PyPI) repository as part of an ongoing malicious software supply chain campai…
An unknown threat actor is leveraging malicious npm packages to target developers with an aim to steal source code and configuration files from victim machines…
In yet another sign that developers continue to be targets of software supply chain attacks, a number of malicious packages have been discovered on the Rust pr…
A previously undocumented threat cluster has been linked to a software supply chain attack targeting organizations primarily located in Hong Kong and other reg…
The npm package registry has emerged as the target of yet another highly targeted attack campaign that aims to entice developers into downloading malevolent mo…
Cybersecurity researchers have discovered a new bunch of malicious packages on the npm package registry that are designed to exfiltrate sensitive developer inf…
Cybersecurity researchers have uncovered a privilege escalation vulnerability in Google Cloud that could enable malicious actors tamper with application images…
Ransomware has emerged as the only cryptocurrency-based crime to grow in 2023, with cybercriminals extorting nearly $175.8 million more than they did a year ag…
Millions of software repositories on GitHub are likely vulnerable to an attack called RepoJacking, a new study has revealed.This includes repositories from org…
Researchers at an Israeli security firm on Tuesday revealed how hackers could turn a generative AI's ''hallucinations'' into a nightmare for an organization's …
Researchers have discovered a novel attack on the Python Package Index (PyPI) repository that employs compiled Python code to sidestep detection by application…
