#softwaredevelopment

Zabbix urges upgrades after critical SQL injection bug disclosure

by

November 29, 2024 at 12:50PM Zabbix has alerted customers to a critical SQL injection vulnerability (CVE-2024-42327) that could allow system compromise via API access. Affected versions include 6.0.0-6.0.31, 6.4.0-6.4.16, and 7.0.0. Users should upgrade to protect against potential privilege escalation attacks, as the vulnerability poses risks across many industries. **Meeting Takeaways:** 1. **Critical Vulnerability Alert**: … Read more

Cross-Site Scripting Is 2024’s Most Dangerous Software Weakness

by

November 21, 2024 at 06:27PM The 2024 Common Weakness Enumeration (CWE) list revealed significant software flaws, emphasizing persistent threats like cross-site scripting and SQL injection. The new ranking methodology considered both severity and frequency. Organizations are urged to prioritize these weaknesses for better software security and to enhance their software supply chains. ### Meeting Takeaways … Read more

VMware makes Workstation and Fusion free for everyone

by

November 11, 2024 at 06:05PM VMware has made its Fusion and Workstation desktop hypervisors free for all users, retiring the paid subscription model. While users retain full features, support ticketing is discontinued. Broadcom plans ongoing development and updates. Current commercial contracts remain valid until expiration, ensuring continued service and support for those agreements. **Meeting Takeaways: … Read more

Open Source Security Incidents Aren’t Going Away

by

November 11, 2024 at 10:11AM Open source software (OSS) plays a crucial role in technology, yet increasing reliance introduces significant security risks. Organizations benefiting from OSS must ensure robust security practices by investing in skilled engineers. Effective communication, proactive approaches, and continuous vigilance are essential. This need intensifies with the rise of open source AI … Read more

How Developers Drive Security Professionals Crazy

by

November 8, 2024 at 10:35AM The integration of DevSecOps aims to balance development speed with security, addressing challenges such as security training, complex tools, and alert management. Successful implementation involves understanding risk portfolios, automating security testing, continuous monitoring, and simplifying developers’ experiences, ultimately fostering collaboration for efficient, secure software delivery. **Meeting Takeaways: DevSecOps Implementation** 1. … Read more

Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages

by

November 5, 2024 at 01:45AM A campaign targeting npm developers employs hundreds of typosquat packages to install cross-platform malware, utilizing Ethereum smart contracts for command-and-control. This approach complicates detection and takedown efforts, highlighting vulnerabilities in the open-source ecosystem. The attacker may be Russian-speaking, emphasizing the need for developer vigilance when downloading packages. ### Meeting Takeaways … Read more

Developer Velocity & Security: Can You Get Out of the Way in Time?

by

November 1, 2024 at 10:05AM CIOs are increasing software investments to enhance productivity, while CISOs face challenges in keeping up with rapid changes and integrating security into development processes. To improve collaboration, security must be embedded in developers’ workflows, allowing for faster output without hindering productivity, thus promoting a secure-by-design methodology that addresses risks effectively. … Read more

LottieFiles Issues Warning About Compromised “lottie-player” npm Package

by

October 31, 2024 at 10:39AM LottieFiles announced that its npm package “lottie-player” was compromised in a supply chain attack, leading to unauthorized, malicious versions that prompted users to connect cryptocurrency wallets. Users of versions 2.0.5, 2.0.6, and 2.0.7 should update to 2.0.8. The company is investigating with an external team. ### Meeting Takeaways – October … Read more

‘Shift Left’ Gets Pushback, Triggers Security Soul Searching

by

October 25, 2024 at 07:17AM The Cybersecurity and Infrastructure Security Agency (CISA) questions the claim that fixing software vulnerabilities is 100 times more expensive during production. Agile development may lessen this cost, suggesting that shifting security responsibilities to developers, while important, needs a balanced approach. The emphasis should be on integrating security throughout the development … Read more

Codasip Donates Tools to Develop Memory-Safe Chips

by

October 24, 2024 at 08:17AM Codasip donated its RISC-V software development kit to the CHERI Alliance to enhance chip memory safety for developers. The SDK includes essential tools like a C/C++ compiler, emulator, and build system, aiming to facilitate CHERI technology adoption in securing hardware memory against vulnerabilities like buffer overflows. ### Meeting Takeaways: 1. … Read more