Application Security News and Articles


Prevent attackers from using legitimate tools against you

Malicious actors are increasingly exploiting legitimate tools to accomplish their goals, which include disabling security measures, lateral movement, and transferring files. Using commonly available tools allows attackers to evade detection. ...

The security and privacy risks of large language models

A large language model (LLM) is an artificial intelligence (AI) algorithm that employs deep learning methodologies, and extensive data sets to comprehend, condense, create, and predict new content. An example of an LLM is ChatGPT, a model ...

56,000+ cloud-based apps at risk of malware exfiltration

The technology sector had the highest number of malware-infected employees, most exposed corporate credentials and the majority of all stolen cookies, according to SpyCloud. Drawing on SpyCloud’s database of 400+ billion recaptured assets ...

Company executives can’t afford to ignore cybersecurity anymore

Asked about the Board and C-Suite‘s understanding of cybersecurity across the organisation, only 39% of respondents think their company’s leadership has a sound understanding of cybersecurity’s role as a business enabler, according to ...

Microsoft Patch Tuesday, May 2023 Edition

Microsoft today released software updates to fix at least four dozen security holes in its Windows operating systems and other software, including patches for two zero-day vulnerabilities that are already being exploited in active attacks. The ...

MY TAKE: DigiCert and Oracle partner to extend digital trust and scalable infrastructure globally

One meeting I had at RSA Conference 2023, was a briefing about a  new  partnership, announced this morning, between a top-rung Silicon Valley tech giant and the leading provider of digital trust. Related: Centralizing control of digital ...

Will CEOs Recognize Their Company a Year After Adopting AI?

Will CEOs Recognize Their Company a Year After Adopting AI? 2 min read·Just now -- Will Transforming the business with AI will ever reach the finish line? Artificial intelligence is everywhere, from how we drive our cars to the frictionless ...

A conversation with Michael Campbell and Steve Trevino heading into SOF Week 2023

SOF Week provides the opportunity to discover and explore solutions for some of our nation’s toughest problems. What problem are you focused on solving for SOF? The post A conversation with Michael Campbell and Steve Trevino heading into SOF ...

Threat Intelligence Management: Best Practices

Security teams rely on threat intelligence like a ship’s captain relies on a lighthouse. The information enables them to see new risks and steer clear of known threats. While threat intelligence provides benefits, many security teams struggle ...

Browser Fingerprint Spoofing: A New Cyber Risk

If one sure thing exists in the security and privacy area, it’s that cybercriminals will always find ways to use technological advances against users. With the internet as a fundamental communication and commercial technology, data derived from ...

Threat Tracking: Tracking Threats Across the Dark and Clear Web

The Internet is a gold mine of threat information that can bolster your cyber defenses if you actively track this data. From news updates to forum discussions on hacker forums, and data dumps to service offerings on marketplaces, there’s a lot ...

9 Open Source Threat Intelligence Sources

Keeping up with cybersecurity news is a challenge. From newly discovered vulnerabilities to new attack methodologies, you live a life of “need to know” when ability to find is difficult. As a security professional, knowing is more than half ...

COURT DOC: Justice Department Announces Court-Authorized Disruption of Snake Malware Network Controlled by Russia’s Federal Security Service

The Justice Department today announced the completion of a court-authorized operation, code-named MEDUSA, to disrupt a global peer-to-peer network of computers compromised by sophisticated malware, called 'Snake', that the U.S. Government ...

Art of the Hunt: Building a Threat Hunting Hypothesis List

Introduction Threat hunting is a proactive, behaviorally-based approach that empowers you to stay ahead of potential adversaries by focusing on their tactics, techniques, and patterns. By moving away from the traditional indicator of compromise ...

Log4j, GitHub Repositories, and Attack Surfaces

Numerous security practitioners and software development teams often utilize public repositories in their daily roles. The goal of these public repositories is to help teams collaborate on improving coding, fixing vulnerabilities, and support ...

Microsoft Patch Tuesday: 40 Vulnerabilities, 2 Zero-Days

Microsoft’s May 2023 security updates address a total of 40 newly documented vulnerabilities, including two flaws already exploited in attacks. The post Microsoft Patch Tuesday: 40 Vulnerabilities, 2 Zero-Days appeared first on SecurityWeek.

USENIX Enigma 2023 – Harlo Holmes – ‘Open Source Software And Journalism: Field Notes From A Global Perspective’

Our thanks to USENIX for publishing their Presenter’s outstanding USENIX Enigma ’23 Conference content on the organization’s’ YouTube channel. Permalink The post USENIX Enigma 2023 – Harlo Holmes – ‘Open Source Software ...

Microsoft fixes two actively exploited bugs, one used by BlackLotus bootkit (CVE-2023-29336, CVE-2023-24932)

For May 2023 Patch Tuesday, Microsoft has delivered fixes for 38 CVE-numbered vulnerabilities, including a patch for a Windows bug (CVE-2023-29336) and a Secure Boot bypass flaw (CVE-2023-24932) exploited by attackers in the wild. The two ...

US Disrupts Russia’s Sophisticated ‘Snake’ Cyberespionage Malware 

The US government has announced the disruption of Snake, a sophisticated cyberespionage malware officially attributed to a unit of Russia’s FSB agency. The post US Disrupts Russia’s Sophisticated ‘Snake’ Cyberespionage ...

Modular, Scalable Data Centers Deliver Utmost Efficiency and Flexibility

In today's fast-paced digital landscape, businesses and organizations face an ever-increasing demand for data storage and processing capabilities. As a result, data center operators must constantly adapt to meet these changing requirements, while ...