Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

wallarm

Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Mar 31, 2025 By Wallarm In Wallarm
Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of current security tools, and the implications for businesses relying on API-driven applications. It will also discuss potential approaches for improving API security posture.
Read Post
indusface

CVE-2017-12637: Exploitation of SAP NetWeaver Directory Traversal Vulnerability

Mar 31, 2025 By Deepak Kumar Choudhary In Indusface
On March 19, 2025, the CISA issued a warning about the active exploitation of CVE-2017-12637, a directory traversal vulnerability in SAP NetWeaver AS Java. This vulnerability, originally patched in 2017, has resurfaced due to incomplete mitigations, leading to increased risks for organizations using outdated or misconfigured SAP environments.
Read Post
seemplicity

Why Vulnerability Management Is AI's Biggest Untapped Opportunity

Mar 31, 2025 By Kevin Swan In Seemplicity
The security industry has reached a turning point with AI. It’s no longer just hype, as AI has now become a critical part of day-to-day cybersecurity operations. According to The Rise of AI-Powered Vulnerability Management, the latest report from Seemplicity and Dark Reading, 86% of security teams now use some form of AI in their security stack. More than half of respondents say AI is already crucial to their work.
Read Post

Securing AI: How Mend.io & OWASP Are Making AI Safer for Enterprises #securitymanagement #shorts

Mar 29, 2025 By Mend In Mend
Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.
View Video
squarex

SquareX Discloses Browser-Native Ransomware that Puts Millions at Risk

Mar 28, 2025 By SquareX
From WannaCry to the MGM Resorts Hack, ransomware remains one of the most damaging cyberthreats to plague enterprises. Chainalysis estimates that corporations spend nearly $1 billion dollars on ransom each year, but the greater cost often comes from the reputational damage and operational disruption caused by the attack.
Read Post
CrowdStrike

Kubernetes IngressNightmare Vulnerabilities: What You Need to Know

Mar 28, 2025 By CrowdStrike Engineering In CrowdStrike
We would like to recognize Amit Serper, Travis Lowe, Tony Gore, Adrian Godoy, Mihai Vasilescu, Suraj Sahu, Pablo Ramos, Raj Jammalamadaka, Lacie Griffin, and Josh Grunzweig for their contributions in authoring this publication. CrowdStrike is committed to protecting our customers from the latest disclosed vulnerabilities. We are actively monitoring activity surrounding “IngressNightmare,” the name given to recently identified vulnerabilities in the Kubernetes (K8s) ingress-nginx controller.
Read Post
upguard

Critical Middleware Vulnerability in Next.js (CVE-2025-29927)

Mar 28, 2025 By Greg Pollock In UpGuard
Researchers have discovered a critical security vulnerability in Next.js that allows attackers to easily bypass middleware authorization measures. The vulnerability, designated CVE-2025-29927, was discovered by Rachid Allam and Yasser Allam and since assigned a base CVSS score of 9.1. By skipping checks for authorization cookies, attackers can potentially gain access to restricted areas of applications like admin tools and dashboards.
Read Post
splunk

Sinister SQL Queries and How to Catch Them

Mar 28, 2025 By Splunk Threat Research Team In Splunk
SQL Server is more than just a database—it's a powerful platform that can be leveraged by attackers for system access, persistence, and code execution. While organizations focus on protecting their valuable data, they often overlook the inherent capabilities within SQL Server that make it an attractive target for adversaries looking to establish footholds in Microsoft environments.
Read Post

Understanding CVE Scores: How #SoftwareVulnerabilities Are Rated & Reported #short #cybersecurity

Mar 28, 2025 By Mend In Mend
Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.
View Video
Snyk

Governance in DevSecOps: Measuring and Improving Security Outcomes

Mar 27, 2025 By Ben Desjardins In Snyk
After implementing a DevSecOps strategy from the ground up — including secure design, testing and monitoring, and risk-based remediation — you will need to focus on analysis and governance. After all, organizations need to regularly measure and refine their security processes to mature their DevSecOps programs.
Read Post
outpost 24

Threat Context Monthly: Green Nailao & UNC3886 - Briefing for March 2025

Mar 27, 2025 By KrakenLabs In Outpost 24
Welcome to the Threat Context Monthly blog series where we provide a comprehensive roundup of the most relevant cybersecurity news and threat information from KrakenLabs, Outpost24’s cyber threat intelligence team. Here’s what you need to know from March about espionage activities by threat actors Green Nailao and UNC3886.
Read Post
splunk

The OWASP Top 10 Explained: Today's Top Risks in Web Apps and LLMs

Mar 27, 2025 By Kayly Lange In Splunk
Over the past few years, cyberattacks have escalated to unprecedented heights. Just last year, in 2024, 94% of organizations reported being the victims of phishing attacks. And in the first five weeks of 2025, ransomware attacks increased by 149% in the first 5 weeks of 2025. Organizations and users need help understanding and navigating these changing risks to fight against the rising tide of cybercrimes. Thankfully, that is exactly what The OWASP Foundation aims to do.
Read Post
cycognito

Emerging Threat: Next.js CVE-2025-29927

Mar 27, 2025 By Emma Zaballos In CyCognito
A critical improper authorization vulnerability (CVSS 9.1) in Next.js, tracked as CVE-2025-29927, was publicly disclosed on March 21, 2025. Next.js is a popular React-based web framework used for building full-stack applications. This vulnerability impacts applications that utilize middleware for authorization checks. Middleware functions used to implement access control, session validation, redirects, or security headers on incoming HTTP requests.
Read Post
gitguardian

SnowFROC 2025: A Chilly Reminder That OWASP Matters and Exploring Secure Coding Practices with AI Coding Bots

Mar 27, 2025 By Dwayne McDaniel In GitGuardian
At Denver's SnowFROC, security pros tackled the importance of OWASP’s evolving Top 10 and exposed the current shortcomings of AI-generated code for production systems.
Read Post
centripetal

Security Bulletin: Critical Vulnerabilities in Kubernetes Ingress NGINX Controller

Mar 26, 2025 By Lauren Farrell In Centripetal
CVE-2025-1974 is a critical remote code execution (RCE) vulnerability in Kubernetes’ Ingress-NGINX Controller that allows unauthenticated attackers with network access to inject arbitrary NGINX configuration directives, potentially leading to full cluster compromise. Ingress-NGINX is a software-only ingress controller provided by the Kubernetes project. Because of its versatility and ease of use, ingress-nginx is quite popular: it is deployed in over 40% of Kubernetes clusters.
Read Post
tripwire

How to Build a Mature Vulnerability Management Program

Mar 26, 2025 By Katrina Thompson In Tripwire
The terms “patch management” and “vulnerability management“ are not the same. And that difference is a big difference. They may be confused because applying patches is one of the many ways to mitigate cyber risks. However, it is one piece of the entire vulnerability management puzzle and organizations that do not realize this are burdened with a false sense of security.
Read Post
ionix

Exploited! Kentico Xperience Staging Service Authentication Bypass Vulnerabilities (CVE-2025-2746 & CVE-2025-2747)

Mar 26, 2025 By Amit Sheps In IONIX
Recently, two critical security flaws were discovered in Kentico Xperience 13, a popular digital experience platform (CMS). Tracked as CVE-2025-2746 and CVE-2025-2747, these vulnerabilities allow unauthenticated attackers to bypass the Staging Sync Server’s authentication, potentially gaining administrative control over the CMS.
Read Post
splunk

Exploring AI for Vulnerability Investigation and Prioritisation

Mar 26, 2025 By James Hodgkinson In Splunk
The sheer volume of cybersecurity vulnerabilities is overwhelming. In 2024, there were 39,998 CVEs — an average of 109.28 per day! This constant stream of new threats makes it increasingly difficult for security teams to keep up. Large Language Models (LLMs) offer a possible solution, helping automate vulnerability investigation and prioritisation, allowing teams to more efficiently assess and respond to emerging risks. Do you even have time to skim over 109 CVEs a day?
Read Post

GPSec Boston 2025 - CTEM: How to Start When You Haven't Started

Mar 25, 2025 By Nucleus Security In Nucleus
What does it really take to start a Continuous Threat Exposure Management (CTEM) program—especially if your organization hasn’t formally begun? In this GPSec Boston 2025 session, Scott Kuffer, COO and Co-founder of Nucleus Security, joins Chris Peltz, Director of Security Strategy at GuidePoint Security, to demystify CTEM by stripping away the buzzwords and breaking down the practical steps for getting started.
View Video
Arctic Wolf

CVE-2025-1974: Critical Unauthenticated RCE Vulnerability in Ingress NGINX for Kubernetes

Mar 25, 2025 By Andres Ramos In Arctic Wolf
On March 24, 2025, ingress-nginx maintainers released fixes for multiple vulnerabilities that could allow threat actors to take over Kubernetes clusters. Ingress is a Kubernetes feature that defines how workload Pods are exposed to the network, while an Ingress Controller implements those rules by configuring the necessary local or cloud resources. According to Kubernetes, ingress-nginx is deployed in over 40% of Kubernetes clusters.
Read Post
signmycode

GitHub Supply Chain Attack: CVE-2025-30066 and CVE-2025-30154 Expose Secrets Across 218 Repositories

Mar 25, 2025 By SignMyCode In SignMyCode
A major supply chain attack has exposed sensitive CI/CD secrets in GitHub Action tj-actions/changed-files, known as CVE-2025-30066, across 218 repositories. This incident has raised significant concerns about security and is connected to an earlier attack on the other GitHub Action, reviewdog/action-setup@v1, tracked as CVE-2025-30154. While only 4% of the 5,416 repositories that were affected had secrets leaked, the damage is severe.
Read Post
Snyk

What is a Data Poisoning Attack?

Mar 25, 2025 By Stephen Thoemmes In Snyk
Data poisoning is a sophisticated adversarial attack designed to manipulate the information used in training artificial intelligence (AI) models. By injecting deceptive or corrupt data, attackers can hurt model performance, introduce biases, or even create security vulnerabilities. As AI models increasingly power critical applications in cybersecurity, healthcare, finance, and many other industries, maintaining the integrity of their training data is absolutely critical.
Read Post
armo

IngressNightmare: Analysis of Critical Vulnerabilities in Kubernetes Ingress NGINX Controller

Mar 25, 2025 By Amit Schendel In ARMO
On March 24, 2025, Wiz Research disclosed a series of critical vulnerabilities in Ingress NGINX Controller for Kubernetes, collectively dubbed: These unauthenticated Remote Code Execution (RCE) vulnerabilities have been assigned a CVSS base score of 9.8. According to Wiz Research, exploitation allows attackers to gain unauthorized access to all secrets across all namespaces in affected Kubernetes clusters, potentially leading to complete cluster takeover.
Read Post
sysdig

Detecting and Mitigating IngressNightmare - CVE-2025-1974

Mar 25, 2025 By Sysdig Threat Research Team In Sysdig
On Monday, March 24, 2025, a set of critical vulnerabilities affecting the admission controller component of the Ingress NGINX Controller for Kubernetes was announced. In total, five vulnerabilities were announced; the most severe vulnerability, CVE-2025-1974 (CVS 9.8), may result in remote code execution (RCE). Exploitation of this vulnerability can be detected with Sysdig Secure or the Falco rule provided in this article.
Read Post
centripetal

Security Bulletin: GitHub Action Supply Chain Attack - reviewdog/action-setup

Mar 25, 2025 By Lauren Farrell In Centripetal
On March 11, 2025, a supply chain attack targeting the widely used GitHub Action reviewdog/action-setup@v1, leading to the exposure of sensitive CI/CD secrets across multiple repositories. The attack was identified by Wiz Research, which determined that this compromise played a pivotal role in the tj-actions/changed-files incident (Wiz, 2025).
Read Post
foresiet

Nation-State Threat Actors Leverage Windows Shortcut Vulnerability

Mar 24, 2025 By Foresiet In Foresiet
The newly found Windows shortcut vulnerability is now being actively exploited by state-sponsored Advanced Persistent Threat (APT) actors to execute covert malicious commands. According to new research conducted by Trend Micro's Zero Day Initiative (ZDI), the vulnerability, designated as ZDI-CAN-25373, is now being exploited by Chinese, Iranian, North Korean, and Russian threat actors for worldwide cyber espionage and data theft.
Read Post

POAM Process Automation: Breaking the Manual Grind

Mar 24, 2025 By Nucleus Security In Nucleus
Plans of Action and Milestones (POAM) play a critical role in public sector cybersecurity. In this webinar with government IT solutions provider Carahsoft, we break down the challenges security teams face when implementing POAMs, sharing real-life examples of where things go wrong and why. As part of the presentation, we also cover the intensive math of POAM programs: people, systems, and time.
View Video
jfrog

CVE-2025-29927 - Authorization Bypass Vulnerability in Next.js: All You Need to Know

Mar 24, 2025 By Yoav Saporta In JFrog
On March 21st, 2025, the Next.js maintainers announced a new authorization bypass vulnerability – CVE-2025-29927. This vulnerability can be easily exploited to achieve authorization bypass. In some cases – exploitation of the vulnerability can also lead to cache poisoning and denial of service.
Read Post
CrowdStrike

CrowdStrike Falcon Exposure Management Expands Security to Unmanaged Network Assets with Network Vulnerability Assessment

Mar 24, 2025 By Rona Kedmi In CrowdStrike
As organizations strengthen endpoint and cloud security, attackers are shifting their focus to often-overlooked network infrastructure like routers, switches, and firewalls. Legacy vulnerability management (VM) solutions struggle to keep pace, relying on slow, periodic scans that fail to provide real-time visibility into emerging threats.
Read Post

Falcon Exposure Management Network Vulnerability Assessment: Demo Drill Down

Mar 24, 2025 By CrowdStrike In CrowdStrike
Traditional network vulnerability scanners leave your critical network assets vulnerable, providing outdated visibility and ineffective prioritization. Falcon Exposure Management's Network Vulnerability Assessment (NVA) delivers real-time visibility, AI-powered prioritization with ExPRT.AI, and seamless integration for automated remediation. This demo showcases how NVA streamlines your security strategy, ensuring precise focus on threats that matter most and proactively protecting your network.
View Video
Snyk

CVE-2025-29927 Authorization Bypass in Next.js Middleware

Mar 23, 2025 By Liran Tal In Snyk
On Friday morning, March 21, 2025, at 9:00 a.m. UTC, a security advisory identified as CVE-2025-29927 was published. It cited a critical 9.1 severity vulnerability for mainstream Next.js applications. Next.js versions considered vulnerable: We urge all developers to upgrade and deploy the latest version of Next.js that carries a fix to avoid suffering critical authorization bypass and other middleware logic circumvention.
Read Post
indusface

CVE-2025-24813 - Apache Tomcat Vulnerability Under Active Exploitation

Mar 21, 2025 By Pavan Bushan Reddy In Indusface
On March 17th, 2025, security researchers confirmed active exploitation of Apache Tomcat’s recently disclosed vulnerability, CVE-2025-24813. Publicly disclosed on March 10th, the earliest signs of exploitation were observed on March 12th, with attackers leveraging the flaw just 30 hours after disclosure. This vulnerability enables Remote Code Execution (RCE) and information disclosure by exploiting Tomcat’s request-handling mechanism.
Read Post
nucleus

Continuous Threat Exposure Management and the Role of Exposure Assessment Platforms

Mar 21, 2025 By Corey Tomlinson In Nucleus
Traditional vulnerability management is broken. It is ineffective. The process of scanning for software vulnerabilities, prioritizing based on CVSS scores, and fixing what you can has become an endless patch cycle. The need for a better approach is clear. Different scanning tools are creating millions of alerts, obscuring critical risks within the noise. Organizations need to go beyond finding and patching vulnerabilities and opt in to a more effective approach to managing exposures.
Read Post
securitysenses

The Role of Proactive Monitoring in Preventing IT Vulnerabilities

Mar 21, 2025 By SecuritySenses In SecuritySenses
We've all heard "prevention beats cure." Nowhere does this ring truer than cybersecurity. Many organisations discover this truth the hard way-after attackers have already breached their defences. Proactive monitoring isn't new, but it's increasingly crucial as threats multiply. Winter months typically see attack spikes (data shows December-February consistently tops breach statistics). With constant evolution in threat vectors, staying vigilant isn't optional-especially when reputation and customer trust hang in the balance.
Read Post
Snyk

Overcoming AppSec Challenges in FinServ: How CIBC Balances Speed, Security, and Compliance

Mar 20, 2025 By Snyk Team In Snyk
Financial institutions face a tricky balancing act: they need to innovate quickly while also following strict compliance rules in an environment where security is paramount. Recently, Snyk's Field CTO, Steven Schmidt, sat down with Mihai Saveschi, Senior Director of Security Service Management at CIBC, for a fireside chat to discuss these pressing issues. We’ve pulled key insights from their conversation on some of the most pressing AppSec challenges facing financial services organizations today.
Read Post
squarex

Vivek Ramachandran to Speak at Black Hat Asia's 2025 Financial Services Summit on the Evolving Cyber War Against State Actors

Mar 19, 2025 By SquareX
PALO ALTO, Calif., - 19 March 2025 - Vivek Ramachandran, Founder of SquareX and a cybersecurity veteran with over two decades of experience, will speak at the Black Hat Asia Financial Services Summit on April 2 2025 at Marina Bay Sands, Singapore. His talk, The War Against State Actors: Bleeding Edge Techniques Targeting Financial Services, will examine how nation-state attackers are evolving their tactics to infiltrate financial institutions and bypass enterprise security controls.
Read Post
astra

CVE-2024-53568:Stored Cross-Site Scripting (XSS) Vulnerability in Volmarg Personal Management System

Mar 19, 2025 By Prateek Kuber In Astra
Product Name: Volmarg Personal Management System Vulnerability: Stored Cross-Site Scripting (XSS) Vulnerable Version: v1.4.65 CVE: CVE-2024-53568 The researchers from Astra’s security team, on March 06, 2025, discovered a stored cross-site scripting (XSS) vulnerability in Volmarg Personal Management System v1.4.65. The issue was identified in the “Tags” field on the “Image Upload” page, where improper user input validation allowed attackers to execute arbitrary scripts.
Read Post
astra

Content Spoofing Vulnerability in RosarioSIS Student Information System

Mar 19, 2025 By Prateek Kuber In Astra
Product Name: RosarioSIS Student Information System Vulnerability: Content Spoofing Vulnerable Version: v12.0.0 CVE: To Be Assigned The researchers from Astra’s security team, on March 4, 2025, discovered a content spoofing vulnerability in the Demo Web Application. This issue was identified in the “Theme” configuration under “My Preferences,” where improper user input validation allowed attackers to manipulate application settings.
Read Post
seemplicity

regreSSHion in Perspective: Was It Worth the Hype

Mar 19, 2025 By Omer Tal In Seemplicity
The regreSSHion vulnerability generated a lot of buzz and attention in mid-2024 that has since faded away. That’s in part because there’s no evidence that it was ever exploited. But, I argue it’s simply too dangerous not to patch, and that your vulnerability program needs to be flexible enough so that you can escalate exceptional cases like regreSSHion.
Read Post
avast

Zero-day vulnerabilities: the real threat behind Netflix's "Zero Day"

Mar 19, 2025 By Emily Lockwood In Avast
Imagine a hidden flaw in software that no one—except cybercriminals—knows about. A zero-day vulnerability is exactly that: a security weakness that hasn’t been discovered or patched by developers. Because there’s no fix, attackers can exploit these flaws before anyone has a chance to defend against them.
Read Post
foresiet

AI-Driven Vulnerability Management: How Generative AI is Transforming Cybersecurity

Mar 18, 2025 By Foresiet In Foresiet
With the rapid and dynamic nature of the digital world of today, businesses are seeing a mounting high rate of cybersecurity attacks. Cyber attackers keep evolving and coming up with new methods of breaching their systems, which leaves security teams under immense pressure to identify, assess, and remediate vulnerabilities at scale. Traditional methods of vulnerability management are typically behind the curve because the sheer volume of threats is overwhelming.
Read Post
Snyk

Unburdening Developers From Vulnerability Fatigue with Snyk Delta Findings

Mar 18, 2025 By Liran Tal In Snyk
Developers are trapped in a loop: constantly chasing dependency upgrades to mitigate security risks or chasing down security reports of vulnerable code or findings in the CI pipeline. Developers often refer to this as “vulnerability fatigue,” a term commonly referenced in npm package install logs that list the newly introduced security vulnerabilities for third-party dependencies.
Read Post
Snyk

Building a Culture of Secure Coding: Empowering Developers to Build Resilient Software

Mar 18, 2025 By Akanchha Shrivastava In Snyk
Speed and innovation rule in software development, which makes it easy to overlook one crucial aspect: security. As a Staff Solutions Engineer at Snyk, I’ve seen firsthand how a single overlooked vulnerability can spiral into a crisis, affecting businesses, customers, and trust. Secure coding isn’t just about writing better code—it’s about protecting what matters, which includes the credibility and reputation of individuals, teams, and the business.
Read Post
Snyk

Reconstructing the TJ Actions Changed Files GitHub Actions Compromise

Mar 17, 2025 By Micah Silverman In Snyk
In the afternoon on Friday, March 14, 2025, details began to emerge about a serious security exploit on a popular GitHub Action called changed files (tj-actions/changed-files). About 23,000 GitHub repos use this Action as part of their CI and DevOps workflows. It allows you to track which files have changed across branches and commits. An attacker with write privileges on the Action repo made a commit that caused encrypted secrets to appear in plaintext in the GitHub Action logs.
Read Post
securitysenses

The cybersecurity implications of using legacy hardware: risks and solutions

Mar 17, 2025 By SecuritySenses In SecuritySenses
Outdated hardware poses significant cybersecurity risks that can compromise sensitive data. Businesses often overlook the vulnerabilities associated with old computers, leading to potential data breaches. The secure disposal of such equipment is essential to maintaining data integrity and complying with privacy regulations.
Read Post
sysdig

Detecting and Mitigating the "tj-actions/changed-files" Supply Chain Attack (CVE-2025-30066)

Mar 15, 2025 By Michael Clark In Sysdig
On March 14, 2025, StepSecurity uncovered a compromise in the popular GitHub Action tj-actions/changed-files. Tens of thousands of repositories use this action to track file changes, and it is now known to have been tampered with, posing a risk to both public and private projects. A CVE has been created for this issue: CVE-2025-30066.
Read Post
wallarm

One PUT Request to Own Tomcat: CVE-2025-24813 RCE is in the Wild

Mar 14, 2025 By Wallarm In Wallarm
A devastating new remote code execution (RCE) vulnerability, CVE-2025-24813, is now actively exploited in the wild. Attackers need just one PUT API request to take over vulnerable Apache Tomcat servers. The exploit, originally published by a Chinese forum user iSee857, is already available online: CVE-2025-24813 PoC by iSee857.
Read Post
sysdig

Detecting CVE-2025-22224 with Falco

Mar 13, 2025 By Nigel Douglas In Sysdig
The Shadowserver group recently identified over 41,500 internet-exposed VMware ESXi hypervisors vulnerable to CVE-2025-22224, a critical Time-of-Check Time-of-Use (TOCTOU) code execution attack. The attackers who gain administrative access to a compromised VM can exploit this flaw to execute arbitrary code on the hypervisor, gaining full control over all hosted VMs and networked assets. Broadcom released emergency patches for ESXi and Workstation products to remediate the flaw.
Read Post
nucleus

Managing Cloud Exposures Just Got Easier: Introducing Nucleus Cloud-Native Vulnerability and Exposure Management

Mar 13, 2025 By Gil Azaria In Nucleus
Every day, security teams are expected to manage risks in cloud environments that they don’t fully control, can’t always see, and that are constantly changing. Cloud-native assets—such as container workloads, autoscaling groups, and serverless functions—are highly dynamic, appearing, disappearing, and evolving in response to demand and functionality changes.
Read Post
Snyk

Responding and remediating: Best practices for handling security alerts

Mar 13, 2025 By Ben Desjardins In Snyk
As organizations continue to evolve their DevSecOps programs by adopting comprehensive testing and monitoring, the next step is to take action on the insights uncovered. This means remediating security issues as early as possible and responding to security alerts and incidents in a timely manner. However, many security and development teams find that triaging the findings of every tool and managing remediation efforts is time-consuming and costly.
Read Post
Snyk

AI Risk Management: Benefits, Challenges, and Best Practices

Mar 13, 2025 By Stephen Thoemmes In Snyk
Managing the risks of AI development tools is crucial for organizations looking to responsibly and effectively leverage this technology’s potential. AI offers transformative capabilities, particularly in coding assistance, where tools can speed up development and reduce manual workloads. However, these benefits can come with risks, such as security vulnerabilities and compliance challenges, that cannot be overlooked.
Read Post

AI Security = API Security: 10x Surge in AI-Related CVEs #AIExploits #APIAttacks #SecureAI

Mar 13, 2025 By Wallarm In Wallarm
AI-driven applications rely on APIs, making them a prime target for attackers. In 2024, AI-related CVEs increased 10x, with 98.6% of vulnerabilities linked to APIs. As AI agents interact with systems via APIs, security risks grow. Learn why securing AI means securing APIs.
View Video
jfrog

Is TensorFlow Keras "Safe Mode" Actually Safe? Bypassing safe_mode Mitigation to Achieve Arbitrary Code Execution

Mar 12, 2025 By Andrey Polkovnichenko In JFrog
Update: This issue was discovered and disclosed independently to Keras by JFrog’s research team and Peng Zhou. Machine learning frameworks often rely on serialization and deserialization mechanisms to store and load models. However, improper code isolation and executable components in the models can lead to severe security risks. The structure of the Keras v3 ML Model in TensorFlow.
Read Post
ionix

Exploited! Apache Tomcat Path Equivalence Vulnerability (CVE-2025-24813)

Mar 12, 2025 By Amit Sheps In IONIX
Apache Tomcat recently disclosed a critical security vulnerability, CVE-2025-24813, affecting several versions of its widely used servlet container. This vulnerability arises from improper handling of path equivalence checks involving filenames with internal dots (file…txt). Exploitation could result in unauthorized information disclosure, file manipulation, and even remote code execution (RCE).
Read Post
Snyk

Snyk and ServiceNow: Streamlining Vulnerability Management with ServiceNow VR Assignment Rules

Mar 12, 2025 By Sarah Conway In Snyk
Snyk is committed to our partnership with ServiceNow, and together, we're revolutionizing how organizations manage Application vulnerabilities and risk. Snyk's market-leading developer security platform and ServiceNow's robust Security Operations (SecOps) capabilities offer a powerful solution for Application Security teams and Enterprise CISOs.
Read Post
seal security

Seal Security and Socket Team Up to Fix Critical npm Overrides

Mar 12, 2025 By Alon Navon In Seal Security
When developing a JavaScript package with npm, direct dependencies are defined within the dependencies section of the package.json file. Developers manage these dependencies' versions using semver-compliant version specifications. This allows for precise control, from specifying exact versions to defining ranges that permit the package manager to select compatible versions.
Read Post
Snyk

DevSecOps Automation Framework

Mar 11, 2025 By Ben Desjardins In Snyk
Security is often seen as a roadblock in development, slowing releases and adding friction between teams. However, as software development cycles become faster and more complex, security must evolve from a blocker to an innovation driver. DevSecOps ensures security is a core part of the development workflow, and automation plays a crucial role in making this integration smooth and effective.
Read Post
Snyk

AI Code Generation: Code Security & Quality, Benefits, Risks & Top Tools

Mar 11, 2025 By Stephen Thoemmes In Snyk
AI code generation is exactly what it sounds like — using artificial intelligence to write and improve code. Tools powered by large language models (LLMs) and specialized AI systems can help developers generate boilerplate code, fix bugs, and even refactor entire sections of an application. And developers are leaning in. According to a GitHub survey, 92% of developers have already used AI coding tools at work or on personal projects.
Read Post
fidelis security

Leveraging Retrospective Detection for Zero-Day Threats

Mar 11, 2025 By Fidelis Security In Fidelis Security
Within the cybersecurity landscape, zero-day vulnerabilities have become a significant threat to companies, especially bigger enterprises. It is a form of cyberattack in which a security flaw that is undiscovered by the organization is exploited by attackers. Zero-day threats pose a serious challenge to enterprises as it becomes difficult to detect and mitigate an attack which is unknown.
Read Post
centripetal

Security Bulletin: Apache Camel Message Header Injection via Improper Filtering

Mar 11, 2025 By Lauren Farrell In Centripetal
In the days leading up to the publication of the Apache Camel Message Header Injection via Improper Filtering, now known as CVE-2025-27636, alarmist noise emerged from the wider cyber community, with Kevin Beaumont describing it as an “end of the world zero day” in Apache Camel, along with explicit details on how elements of this vulnerability worked.
Read Post
detectify

Introducing Alfred for fully autonomous AI-built vulnerability assessments

Mar 10, 2025 By Detectify In Detectify
We are excited to announce Detectify Alfred, a revolutionary system that uses AI to completely autonomously collect and prioritize threat intelligence and generate high-fidelity security tests for the CVEs that are most likely to be exploited in the wild.
Read Post
outpost 24

Introducing dark web insights to Outpost24's EASM platform

Mar 10, 2025 By Victor Acin In Outpost 24
We’re pleased to announce that a new Digital Risk Protection (DRP) integration has been added to Outpost24’s External Attack Surface management (EASM) platform: the Dark Web module. Security teams need complete visibility on their organization’s exposure and potential threats. This doesn’t only include your owned online assets, but also your dark web presence.
Read Post
armo

CVE-2025-1094: SQL Injection Vulnerability in PostgreSQL's Escaping Functions

Mar 10, 2025 By Amit Schendel In ARMO
CVE-2025-1094 presents a critical challenge to established SQL security paradigms, effectively circumventing fundamental best practices. Though initially reported over a month ago, the gravity of its implications warrants an extensive analysis. This vulnerability challenges the long-held assumption that proper escaping guarantees protection against SQL injection attacks.
Read Post
astra

Vulnerability Scanning and How It Works in Cyber Security?

Mar 7, 2025 By Ananda Krishna In Astra
Vulnerability scanning refers to the process of evaluating applications, APIs they consume, systems, networks, and cloud environments to identify and pinpoint vulnerabilities within your organization’s digital infrastructure. It involves using automated tools trained to scan for known CVEs, misconfigurations, and potential attack vectors. Vulnerability scanning today is more than just ticking checkboxes.
Read Post
indusface

Credential Coercion Vulnerabilities in Ivanti Endpoint Manager

Mar 7, 2025 By Pavan Bushan Reddy In Indusface
Multiple vulnerabilities have been discovered in Ivanti Endpoint Manager, affecting various file hashing functions. These vulnerabilities—CVE-2024-10811, CVE-2024-13161, CVE-2024-13160, and CVE-2024-13159—allow credential coercion, which can lead to path traversal and potentially enable remote code execution (RCE).
Read Post
squarex

SquareX Unveils Polymorphic Extensions that Morph Infostealers into Any Browser Extension - Password Managers, Wallets at Risk

Mar 6, 2025 By SquareX
With recent attack disclosures like Browser Syncjacking and extension infostealers, browser extensions have become a primary security concern at many organizations. SquareX's research team discovers a new class of malicious extensions that can impersonate any extension installed on the victim's browser, including password managers and crypto wallets.
Read Post
centripetal

Security Bulletin: Zero-Day Vulnerabilities in VMware ESXi, Workstation and Fusion

Mar 6, 2025 By Lauren Farrell In Centripetal
On March 4, 2025, Broadcom, which acquired VMware in 2023, released security updates to fix three actively exploited vulnerabilities in VMware ESXi, Workstation, and Fusion that could result in code execution and information disclosure. CVE-2025-22224 is a critical TOCTOU (Time-of-Check Time-of-Use) race condition vulnerability that leads to an out-of-bounds write, allowing an attacker with administrative privileges on a virtual machine to execute code as the VMX process on the host.
Read Post
seal security

Seal Security Joins Snyk Technology Alliance Partner Program

Mar 6, 2025 By Itamar Sher In Seal Security
Seal Security Joins Snyk’s Technology Alliance Partner Program Seal Security is excited to announce that it has joined Snyk’s Technology Alliance Partner Program and is now listed in the Snyk Partner Solutions Directory. Together, Seal Security and Snyk provide a seamless integration and product experience for Snyk customers looking to streamline their open source vulnerability patching efforts. ‍
Read Post
Snyk

Learn about API security risks with the new Snyk Learn Learning Path

Mar 6, 2025 By Michael Biocchi In Snyk
Snyk Learn, our developer security education platform, now includes lessons on API security! Check out the new learning path that covers the OWASP Top 10 for API security risks. APIs power the modern web, connecting applications and services in ways that drive innovation and efficiency. However, with this interconnectivity comes significant security risks.
Read Post
outpost 24

Unveiling EncryptHub: Analysis of a multi-stage malware campaign

Mar 6, 2025 By KrakenLabs In Outpost 24
EncryptHub, a rising cybercriminal entity, has recently caught the attention of multiple threat intelligence teams, including our own (Outpost24’s KrakenLabs). While other reports have begun to shed light on this actor’s operations, our investigation goes a step further, uncovering previously unseen aspects of their infrastructure, tooling, and behavioral patterns.
Read Post
seemplicity

What's Coming in Exposure Management and Remediation in 2025

Mar 6, 2025 By Ravid Circus In Seemplicity
In December 2024, the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and International Partners published a guide for “protecting communications infrastructure” in response to the discovery that a stealthy Chinese government threat actor, Salt Typhoon, had infiltrated a number of US telecommunications firms.
Read Post
Arctic Wolf

Three VMware Zero-Days Exploited in the Wild Patched by Broadcom

Mar 4, 2025 By Andres Ramos In Arctic Wolf
On March 4, 2025, Broadcom released patches for three zero-day vulnerabilities exploited in the wild, affecting ESXi, Workstation, and Fusion. These vulnerabilities, discovered by Microsoft, range in severity from high to critical. Details of the exploitation have not been revealed at this time, and Arctic Wolf has not identified a public Proof-of-Concept (PoC) exploit.
Read Post
nucleus

Is Enterprise Risk Posture Better or Worse Today?

Mar 4, 2025 By Corey Tomlinson In Nucleus
Measuring enterprise risk posture—its overall security readiness and resilience—is a complex challenge. Advanced security solutions, such as automated vulnerability management tools and unified risk dashboards, enable organizations to defend their networks with unprecedented efficiency. The rapid expansion of cloud environments and the intricacies of modern IT infrastructures, however, present an increasingly dynamic attack surface.
Read Post
sysdig

In-use vulnerability prioritization

Mar 4, 2025 By Matt Kim In Sysdig
Vulnerability management has always been a challenge, but today’s security teams are feeling the pressure more than ever. With thousands of new CVEs reported every month, the sheer volume makes it difficult to know where to focus. In-use vulnerability prioritization is one of the most effective ways to cut through the noise, focusing only on vulnerabilities that are actively loaded in runtime. To focus on what really matters, security teams need better ways to prioritize risk.
Read Post
Snyk

ChatGPT and Secure Coding: Benefits and Security Vulnerabilities of ChatGPT-Generated Code

Mar 4, 2025 By Stephen Thoemmes In Snyk
As developers continue to adopt AI tools to transform their workflows, AI-generated code has become more common. In fact, 96% of developers reported using AI coding assistants to streamline their work. Although generative AI (GenAI) tools like ChatGPT can speed up workflows and boost productivity, the security and quality of the outputs aren’t guaranteed.
Read Post
ionix

Can Autonomous LLM Agents Exploit One Day Vulnerabilities?

Mar 3, 2025 By Fara Hain In IONIX
When generative AI first emerged, the cybersecurity community primarily focused on two promising benefits. However, a concerning “third angle” has now been demonstrated: AI as an attacker – powerful AI systems in the hands of malicious actors, autonomously exploiting vulnerabilities with minimal human guidance.
Read Post
outpost 24

Introducing Outpost24 CyberFlex

Mar 3, 2025 By Outpost 24 In Outpost 24
Today, Outpost24 is excited to announce the launch of its new CyberFlex solution, a flexible combination of ASM and PTaaS. With two-thirds of organizations having experienced a cyberattack via unmanaged internet-facing assets, the CyberFlex solution provides an unmatched approach to the comprehensive discovery, risk management, and protection of all your external-facing applications.
Read Post
foresiet

New Apple iOS Zero-Day Vulnerability CVE-2025-24200: What You Need to Know

Mar 2, 2025 By Foresiet In Foresiet
Apple had to deal with another active security vulnerability. The company has recently issued emergency patches for iOS and iPadOS, which fixed CVE-2025-24200-an alarming zero-day flaw that might have allowed cybercrooks to disable USB Restricted Mode on locked devices. The purpose of the update is to ward off possible cyber-physical attacks and keep data from unauthorized extraction.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.