Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

levelblue

How to Detect and Mitigate Zero-Day Vulnerabilities

Sep 30, 2025 By Daniel Ghillione In LevelBlue
Companies face more sophisticated, unpredictable cyber threats. Zero Day vulnerabilities are among the greatest risks, as these software flaws are unknown and exploited before a fix is available, potentially compromising thousands of organizations. Stopping zero-day attacks is a top priority for security teams, requiring faster identification, detection, and mitigation to prevent damage. But how do these attacks work, and what practices really help?
Read Post
tripwire

Understanding the OWASP AI Maturity Assessment

Sep 29, 2025 By Josh Breaker-Rolfe In Tripwire
Today, almost all organizations use AI in some way. But while it creates invaluable opportunities for innovation and efficiency, it also carries serious risks. Mitigating these risks and ensuring responsible AI adoption relies on mature AI models, guided by governance frameworks. The OWASP AI Maturity Assessment Model (AIMA) is one of the most practical. In this article, we’ll explore what it is, how it compares to other frameworks, and how organizations can use it to assess their AI maturity.
Read Post
graylog

The Value of a Robust Vulnerability Management Program

Sep 29, 2025 By Jeff Darrington In Graylog
Back before live security video feeds in homes, people would walk around at night checking to make sure they locked every window and door. They took these precautions because they knew that a single open lock gave burglars an opportunity to steal from them. For organizations, vulnerability management programs are a way to lock the doors against cybercriminals.
Read Post
bitsight

Critical Vulnerability Alert: CVE-2025-10035 in GoAnywhere MFT

Sep 29, 2025 By Emma Stevens In BitSight
A critical security vulnerability (CVE-2025-10035) has been identified in GoAnywhere MFT, a widely used file transfer solution developed by Fortra. This software is commonly deployed to securely transfer sensitive data such as financial records, HR files, legal documents, and personally identifiable information (PII). Currently, CVE-2025-10035 is rated at a 10.0 (critical) on the CVSS scale and a 9.23 out of 10 on Bitsight’s Dynamic Vulnerability Exploit (DVE) scale.
Read Post

The case against secrets in .env files

Sep 29, 2025 By Snyk In Snyk
Most developers rely on.env files to store secrets like API keys, database passwords, and tokens. But what if I told you this common practice can leave you wide open to attacks? In this video, I break down why storing secrets in a.env file is dangerous, how attackers can exploit it, and what safer alternatives you should be using instead.
View Video
Top 5 Cybersecurity Risks in ERP Systems and How to Prevent Them

Top 5 Cybersecurity Risks in ERP Systems and How to Prevent Them

Sep 29, 2025 By SecuritySenses In SecuritySenses
Modern businesses are built on Enterprise Resource Planning (ERP) systems. From finance to supply chain, they run everything in one place. Many of them can even connect to cloud systems, mobile apps, and IoT devices. But where they are most powerful, they are also most vulnerable. Cybercriminals know that ERP systems are treasure troves of data. So if an attack happens, it can lead to significant data theft. Not only that, it can also delay payroll, damage production lines, and stop operations.
Read Post
ionix

CVE-2025-20333: Authenticated RCE in Cisco ASA / FTD VPN Web Server

Sep 26, 2025 By Tal Zamir In IONIX
A high-severity vulnerability (CVSS 9.9) has been disclosed in the VPN web server component of Cisco Secure Firewall ASA and FTD software. An authenticated attacker (i.e. one possessing valid VPN credentials) can send specially crafted HTTP(S) requests that bypass input validation and lead to remote code execution as root. This means full device compromise is possible.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.