Page 3 - Dan Lorenc News Today

Despite mitigation, one of the worst bugs in internet history is still prevalent—and being exploited.

Here's a comprehensive look at some of the lesser-known, but no less serious, types of software supply chain attacks.

The vulnerability in OpenSSL that forced the project's leaders to issue a security patch on Tuesday isn't as bad as initially feared, with the hole's severity shifted from "critical" to "high." Still, experts say infosec leaders need to take it seriously. OpenSSL 3.07 fixes a buffer overrun vulnerability in version 3.0 that can be triggered

With so much unknown about what developers and systems rely on to be productive — and what those tools and code bases rely on in turn — it’s time to get serious about securing the software supply chain.

With so much unknown about what your developers and systems rely on to be productive — and what those tools and code bases rely on in turn — it’s time to get serious about securing your software supply chain.

Checkmarx researchers say the vulnerability was fixed, but warns that the potential attack surface for such “hidden malicious code” may grow exponentially.

/PRNewswire/ -- The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced the keynote speakers and full...

The 2020 SolarWinds hack served as an alarming wake-up call about the threat of the software supply chain, spurring rapid shifts in how organizations secure third-party applications. And yet, two years later, open source repositories remain ripe for exploitation.

The desire for software supply chain integrity and transparency has left many organizations struggling to build in software security measures like signatures, provenance, and SBOMs to legacy systems and existing Linux distributions.

/PRNewswire/ -- Chainguard, the first developer platform for software supply chain security, today announced Wolfi, a new community Linux (un)distribution that...