Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ever get one of those annoying error messages on your phone that gives way too much detail? You know, the ones that tell you the line of code that failed or the exact database query that crashed the app. As an app user, you may dismiss the message and move on. But did you know those overly verbose error messages could be exposing your personal data?

AI has made good on its promise to deliver value across industries: 77% of senior business leaders surveyed in late 2024 reported gaining a competitive advantage from AI technologies. While AI tools allow developers to build and ship software more efficiently than ever, they also entail risk, as AI-generated code can contain vulnerabilities just like developer-written code. To enable speed and security, DevSecOps teams can adopt tools to integrate security tasks into developer workflows.

How good is Symbolic AI as an automated expert system for analyzing code paths and detecting security vulnerabilities? Snyk Code is tested and demonstrates the benefits of rule-based, algorithmic systems.

A critical heap buffer overflow vulnerability in the AWS C Common library was discovered autonomously through an AI-automated fuzz testing solution, CI Fuzz, and has been fully addressed with a patch. In this post, we explore the vulnerability and its potential impact on embedded systems.

It's no surprise that 18–29-year-olds are turning to social media for cybersecurity information. As digital natives, this age group naturally gravitates toward platforms where information is fast, accessible, and constantly updated. But how effectively are they absorbing these short snippets—and are they likely to share it forward? More importantly, what happens if that cybersecurity information is inaccurate?

With the announcement of Anthropic’s Claude 3.7 Sonnet model, we, as developers and cybersecurity practitioners, find ourselves wondering – is the new model any better at generating secure code? We commission the model to generate a classic CRUD application with the following prompt: The model generates several files of code in one artifact, which the user can manually copy and organize according to the file tree suggested by Claude alongside the main artifact.

Security through obscurity is based on the idea that if attackers don’t know how a system works or even if it exists, they’ll have a harder time breaching it. Despite repeatedly broken implementations and lacking support from standards bodies, this concept continues to be widely used. Secret doesn’t always mean safe – and it can even give a false sense of security.

CWE, or Common Weakness Enumeration 73, occurs when an unauthorized user gains external access to control a file in your system. CWE provides a standardized language and classification system to help identify, understand, and mitigate vulnerabilities in software and systems. External Control of Filename or Path is a vulnerability that occurs when an application allows an external entity to influence the selection of a file or directory location within the system.

Today’s risk environment is constantly evolving as threat actors exploit the complexity of modern software. That's why it's crucial to prioritize security throughout the entire application lifecycle, from beginning to end. However, many software teams only start thinking about security when application development is well underway.

Using strong cryptography is essential for data protection and application security, such as tasks required for hashing passwords (which, technically, isn’t classic cryptography for the sake of encryption). However, some legacy code may still be deployed to production using weak and outdated cryptographic algorithms that weren’t found. How can Snyk Code help you find these vulnerable applications?

Last November, the Open Web Application Security Project (OWASP) released its Top Ten List for LLMs and Gen AI Applications 2025, making some significant updates from its 2023 iteration. These updates can tell us a great deal about how the LLM threat and vulnerability landscape is evolving - and what organizations need to do to protect themselves.

We are excited to announce the launch of Seal OS, the first holistic solution designed to automatically fix vulnerabilities in both Linux operating systems and application code. Seal OS delivers long-term support for a wide range of Linux distributions, encompassing Red Hat Enterprise Linux, CentOS, Oracle Linux, Debian, Ubuntu, Alpine, and more. This support extends to various deployment models, including containers, virtual machines, and bare metal installations.

Let’s be real—spreadsheets have been the go-to tool for vulnerability management for years. They’re easy to set up, familiar, and flexible. But here’s the hard truth: they’re costing you time, accuracy, and security. Imagine trying to track thousands of vulnerabilities across an ever-changing attack surface using a tool designed for budgeting, not security.

When it comes to vulnerability management, time is critical - the longer a vulnerability goes unaddressed, the greater the risk. Security teams need efficient, reliable processes that don’t drain resources. For most teams, relying on human effort alone isn’t sustainable or scalable. This is why so many teams turn to workflow orchestration and automation.

CVE-2025-0108 is a high-severity authentication bypass vulnerability affecting Palo Alto’s PAN-OS, the operating system for their next-generation firewalls. This flaw allows an unauthenticated attacker with network access to the PAN-OS management web interface to bypass authentication controls and execute restricted PHP scripts.

On February 19, 2025, Horizon3.ai published proof-of-concept (PoC) exploit code and technical details for critical Ivanti Endpoint Manager (EPM) vulnerabilities disclosed in January. The vulnerabilities are tracked as CVE-2024-10811, CVE-2024-13161, CVE-2024-13160, and CVE-2024-13159, allowing a remote unauthenticated attacker to leak sensitive information via a path traversal. They share the same underlying issue, which results from an unauthenticated endpoint failing to validate input.

The future cyber threat is not static and appears to exploit vulnerabilities with fresh ransomware gangs and devastate businesses all over the world. One of such infamous gangs, Fog Ransomware, is currently dumping sensitive data of several businesses, recent attacks including GitLab deep. Foresiet security researchers believe that Fogs recently exploited Gitlab Cve perhaps they employed a fresh or unfixed zero-day vulnerability in GitLab.to launch its attacks.

Software supply chain security risks are mounting. As noted in Veracode’s State of Software Security (SoSS) report, organizations of all sizes are drowning in security debt, and a large portion of the critical debt can be attributed to third-party vulnerabilities.

On February 18, CISA has added the recently published Palo Alto Networks CVE-2025-0108 to the list of known exploited vulnerabilities. To date, according to GreyNoise, there are over 25 known distinct public sources attempting exploitation. Unmitigated, this vulnerability can lead to significantly weakened network defenses and open doors for data leakages, financial compromises, and ransomware down the road.

The team at Seemplicity is thrilled to announce a set of new features to enhance our customers’ experience with our platform! This release enhances intelligent automation and insights, personalization and customization, and overall user experience. Here’s what’s new.

On February 12, 2025, Palo Alto Networks published a security advisory for CVE-2025-0108, an authentication bypass vulnerability in the management web interface of PAN-OS. The vulnerability was responsibly disclosed to Palo Alto Networks by Assetnote, who published a blog article with technical details about how to exploit the vulnerability the same day it was disclosed. Since then, proof-of-concept exploit code has emerged publicly.

On February 12, 2025, Palo Alto Networks announced CVE-2025-0108, a high severity (8.8) authentication bypass vulnerability affecting Palo Alto Networks PAN-OS management web interface. Successful exploitation of this vulnerability allows unauthenticated attackers with network access to invoke certain PHP scripts without proper authentication. While it does not lead to remote code execution, it impacts the confidentiality and integrity of the affected system.

C and C++ programming are notorious for being bug-prone. Let’s look at the most dangerous software weaknesses in 2024 that are relevant for C and C++, so that you know what type of issues to test your code against in 2025. We examined the 2024 CWE Top 25 Most Dangerous Software Weaknesses list developed by Common Weakness Enumeration (CWE) and identified weaknesses relevant to C/C++. These weaknesses can become vulnerabilities. We explained how they occur and how you can uncover them.

Imagine you’re building a blogging web app using Prisma. You write a simple query to authenticate users based on their provided email and password: Looks harmless, right? But what if an attacker sends password = { "not": "" }? Instead of returning the User object only when email and password match, the query always returns the User when only the provided email matches. This vulnerability is known as operator injection, but it’s more commonly referred to as NoSQL injection.

For many security professionals, managing asset visibility feels like an endless game of whack-a-mole. They are stuck in what experts call the “swivel chair approach”—constantly pivoting between multiple dashboards, spreadsheets, and security tools to manually stitch together an understanding of their risk landscape.

Recently, Palo Alto Networks disclosed CVE‑2025‑0108—a high-severity authentication bypass in the PAN‑OS management web interface. Although the flaw does not enable remote code execution, it compromises the confidentiality and integrity of management functions. In this post, we’ll break down the technical details, discuss the exploitation methodology, illustrate configuration and code examples, and outline effective mitigation strategies.

On February 10, 2025, Bishop Fox published technical details and proof-of-concept (PoC) exploit code for CVE-2024-53704, a high-severity authentication bypass vulnerability caused by a flaw in the SSLVPN authentication mechanism in SonicOS, the operating system used by SonicWall firewalls. Shortly after the PoC was made public, Arctic Wolf began observing exploitation attempts of this vulnerability in the threat landscape.

On January 14th, 2025, Belsen Group emerged in the underground forum Breach Forums publishing a list of sensitive data extracted from vulnerable Fortinet FortiGate devices. Since then, they have expanded their malicious activities into acting as initial access brokers. Who are they and what do we know about them? In this blog we’ll give you the lowdown on an ambitious new threat group to be aware of.

In the context of penetration (pen) testing, false positives are where the testing tools or methods identify a security vulnerability or issue that doesn’t actually exist. Essentially, a false alarm. This can happen for a few reasons, such as misconfigurations in the testing tools, incorrect assumptions, or environmental factors.

A small entrepreneur-led digital marketing agency was having a regular morning with client calls, design presentations, and ad discussions. Suddenly, every team member was locked out of their accounts and couldn’t access their e-mails, cloud folders, or even the company bank account – their data had been taken hostage digitally. This isn’t just a cautionary tale.

Researchers recently found another Software Supply Chain issue in BoltDB, a popular database tool in the Go programming environment. The BoltDB Go Module was found backdoored and contained hidden malicious code. This version took advantage of how Go manages and caches its modules, allowing it to go unnoticed for several years. This backdoor allows hackers to remotely control infected computers through a server that sends them commands i.e. via a command and control server.

Building a vulnerability management (VM) program from the ground up is no small feat. It requires technical expertise, organizational buy-in, and a clear roadmap. In recent months, I’ve been working with a client who had to discard their legacy approach and start afresh. We came to realize just how many components have to come together to get a decent start on a VM project while also showing value along the way.

Security teams and developers are drowning in product security alerts. Every security scan generates a flood of issues, and manually reviewing, prioritizing, and assigning each one is time-consuming and inefficient. The result? Critical risks get buried in long backlogs, while developers waste time chasing issues that don’t actually introduce real risk.

Tanium Remediation Visibility is a game-changer for vulnerability and exposure management. This post describes a number of foundational capabilities of Tanium Autonomous Endpoint Management. Check out this Tanium AEM overview for a high-level explanation of capabilities and benefits.

As organizations increase their reliance on cloud services, remote work tools, IoT devices and smart infrastructures, and the use of third-party vendors, their exposure to cyber threats increases. Traditional approaches to vulnerability management are unable to keep up with rapidly changing business needs and an expanding attack surface. While scanning and patching known vulnerabilities remains critical, today’s complex threat landscape demands a more comprehensive strategy.

A newly discovered zero-day vulnerability, CVE-2025-24085 is a use-after-free vulnerability affecting Apple products, including iOS and macOS. It has been addressed in updates such as iOS 18.3 and macOS Sequoia 15.3 has emerged on the dark web and poses a severe security risk to Apple users. The exploit reportedly sells for 0.00254009 BTC ($233.09 USD) and enables attackers to escalate privileges within iOS devices. Researchers confirm that the vulnerability has been actively exploited in the wild.

The question of ownership is one of the biggest reasons vulnerabilities persist in organizations far longer than they should. Who owns vulnerabilities? This isn’t just a theoretical debate—it’s a critical operational issue. Modern scanning solutions excel at identifying and prioritizing vulnerabilities, but without clear ownership, those vulnerabilities often linger unaddressed or improperly documented, increasing an organization’s risk exposure.

Together, Snyk and Google Cloud enable modern security practices that unify cloud and application security efforts. This collaboration simplifies risk management for CISOs, providing a cohesive strategy to protect cloud-native environments and the applications running within them. Security leaders often struggle with fragmented tools that create silos between cloud security and application security teams.

Published first as a whitepaper in late 2024, the 2025 OWASP Top 10 for LLM Applications is yet another monumental effort from OWASP made possible by a large number of experts in the fields of AI, cybersecurity, cloud technology, and beyond—including Mend.io Head of AI Bar-El Tayouri. LLMs are still new to the market but beginning to mature, and the OWASP Top 10 for LLM Applications is maturing alongside it.

The software bill of materials (SBOM) is quickly becoming an essential aspect of open source security and compliance. In this post, we'll delve into what SBOMs are, why they're necessary, and their role in open source security.

Welcome to the Threat Context Monthly blog series where we provide a comprehensive roundup of the most relevant cybersecurity news and threat information from KrakenLabs, Outpost24’s cyber threat intelligence team. Here’s what you need to know from January.

The average data breach costs businesses around $4.5 million to overcome. A single breach could even cause your company to fail. The good news is there are steps you can take to safeguard your sensitive information. Knowing the security threats you face goes a long way toward keeping your data safe. So, which of the following is a configuration vulnerability? We’ve created a guide with the answers. Let’s explore the information you need to know.

As the adoption of large language models (LLMs) continues to surge, ensuring their security has become a top priority for organizations leveraging AI-powered applications. The OWASP LLM Top 10 for 2025 serves as a critical guideline for understanding and mitigating vulnerabilities specific to LLMs. This framework, modeled after the OWASP Top 10 for web security, highlights the most pressing threats associated with LLM-based applications and provides best practices for securing AI-driven systems.

The average data breach costs businesses approximately $4.5 million per incident. There’s no shortage of cybersecurity threats that can lead to scenarios like these. Even a single occurrence can be impossible to recover from. This is why it’s so important to leverage the right vulnerability management tools to protect your business data. Not everyone knows how to get started, though.