Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Price of Convenience: How Security Vulnerabilities in Global Transportation Payment Systems Can Cost You

Public transportation payment systems have undergone significant changes over the years. Mobile payment solutions have become increasingly popular, allowing passengers to pay for their fare using smartphones or other mobile devices. This trend is likely to continue in the years to come. But how secure are mobile payment solutions for public transportation?

CVE-2023-39143: Critical Remote Code Execution Vulnerability in PaperCut Print Management Server

On August 4, 2023, security researchers published a blog detailing a critical remote code (RCE) vulnerability in PaperCut NG/MF print management servers (CVE-2023-39143: CVSS 8.4). CVE-2023-39143 could allow unauthenticated threat actors to read, delete, and upload arbitrary files on compromised systems, which results in RCE. Additionally, this vulnerability does not require user interaction.

Secure Java URL encoding and decoding

URL encoding is a method that ensures your URL only contains valid characters so that the receiving server can correctly interpret it. According to the RFC 3986 standard, URIs (which are a superset of URLs) only contain a limited set of characters consisting of digits, letters, and a few graphic symbols, all within the ASCII character set. If a URL contains characters outside this limited set, the characters must be percent-encoded.

Securing Third-Party Integrations in EHR Software: A Collaborative Endeavor

Electronic Health Records (EHR) stand at the intersection of healthcare and technology, offering a digital representation of patient health histories. A vital aspect of EHR's efficacy is the seamless exchange of patient data between various systems and third-party tools. This interplay ensures that healthcare providers have the most up-to-date information on their patients, irrespective of where the initial data originated.

Discovering and Blocking a Zero-Day Exploit with CrowdStrike Falcon Complete: The Case of CVE-2023-36874

CrowdStrike Counter Adversary Operations is committed to analyzing active exploitation campaigns and detecting and blocking zero-days to protect our customers. In July 2023, the CrowdStrike Falcon® Complete managed detection and response (MDR) team discovered an unknown exploit kit leveraging a still-unknown vulnerability affecting the Windows Error Reporting (WER) component.

Starting Strategies: Where to Begin After Purchasing Snyk

Luke Sanders, Senior Technical Success Manager, shares quick tips and best practices for getting started with Snyk. Topics covered include: Snyk helps software-driven businesses develop fast and stay secure. Continuously find and fix vulnerabilities for npm, Maven, NuGet, RubyGems, PyPI and more.

CodeSecDays conference and more complete security coverage with GitGuardian

As secrets have a role in most security incidents, Snyk is excited to partner with GitGuardian to help development and security teams scale their security programs and further reduce an application's attack surface at every stage of the code-to-cloud lifecycle. We recently spoke at GitGuardian's first digital conference, CodeSecDays, joining security leaders from Chainguard, Doppler, Kondukto, and more — who shared insights on software signing, open source security, and secrets management.

The Impending EOL of CentOS 7: What You Need to Know and How to Prepare

CentOS 7 has been a popular choice for many businesses and developers due to its stability, robustness, and compatibility with enterprise-level applications. According to W3Techs, CentOS is used by 2.8% of all the websites whose operating system is known. However, as announced on the official CentOS blog, the end of life (EOL) for CentOS 7 is fast approaching. This means that after June 30, 2024, CentOS 7 will no longer receive official support, updates, or security patches.

IoT Monitoring: Protecting & Maintaining IoT Devices in 2023

The state of cybersecurity is in constant flux — meaning we must constantly iterate and revisit our systems to protect ourselves. With security logging and monitoring failures moving up to number 9 of the OWASP Top 10, organizations everywhere are revisiting their stance on network and application monitoring. This is great for getting a pulse check on security posture and is certainly key in any good strategy, but we might be forgetting something — IoT devices.