#SoftwareSupplyChain

Security Flaws in Popular ML Toolkits Enable Server Hijacks, Privilege Escalation

by

November 11, 2024 at 05:39AM Cybersecurity researchers have identified nearly 24 vulnerabilities in 15 machine learning open-source projects, including Weave and ZenML. These flaws could allow unauthorized access, remote code execution, and escalation of privileges, posing significant risks to ML infrastructure. This discovery follows previous vulnerabilities and the introduction of a new defense framework, Mantis. … Read more

BeaverTail Malware Resurfaces in Malicious npm Packages Targeting Developers

by

October 28, 2024 at 11:36AM In September 2024, three malicious npm packages were discovered containing BeaverTail malware, linked to North Korean campaigns targeting developers. The packages, now removed, included backdoored versions of popular libraries. Ongoing threats exploit the open-source ecosystem, highlighting developers as valuable targets in cyberattacks. ### Meeting Takeaways: Malware / Threat Intelligence – … Read more

Researchers Reveal ‘Deceptive Delight’ Method to Jailbreak AI Models

by

October 23, 2024 at 06:36AM Cybersecurity researchers have identified a new technique, “Deceptive Delight,” which exploits large language models (LLMs) during conversations to generate unsafe content. Achieving a 64.6% success rate, it utilizes the model’s limited attention span. To mitigate these risks, effective content filtering and prompt engineering strategies are recommended. ### Meeting Takeaways from … Read more

Zero-Day Breach at Rackspace Sparks Vendor Blame Game

by

October 2, 2024 at 02:00PM The breach at Rackspace highlights software supply chain vulnerability, causing a blame game among vendors over an exploited zero-day. This underscores the importance of supply chain security. Based on the meeting notes, the key takeaway is that a breach at Rackspace has highlighted the vulnerability of the software supply chain, … Read more

Moving DevOps Security Out of the ‘Stone Age’

by

September 26, 2024 at 10:45AM Combining software development, operations, and deployment into DevOps teams promises greater efficiency, but also increases the attack surface. Organizations face challenges in securing the entire pipeline, software components, and infrastructure, requiring continuous monitoring and attention to areas such as code quality, open source components, and container security. AI and automation … Read more

Rising Tide of Software Supply Chain Attacks: An Urgent Problem

by

September 12, 2024 at 10:08AM Software supply chain attacks have become a major concern, with a 180% surge in vulnerability-based breaches in 2023. High-profile attacks like SolarWinds and Okta highlight the significant impact and lingering liabilities. Understanding and mitigating these attacks is crucial, involving processes such as SSCS and continuous code scanning to secure software … Read more

GitHub Actions Vulnerable to Typosquatting, Exposing Developers to Hidden Malicious Code

by

September 6, 2024 at 11:45AM Threat actors use typosquatting to deceive users into accessing malicious sites or downloading compromised software. They exploit typing errors in open-source repositories like PyPI, npm, and GitHub Actions to introduce supply chain attacks. Cloud security firm Orca’s findings reveal the vulnerability of even trusted platforms like GitHub Actions. Users are … Read more

Hackers Hijack 22,000 Removed PyPI Packages, Spreading Malicious Code to Developers

by

September 4, 2024 at 09:18AM A new supply chain attack technique, Revival Hijack, targets the Python Package Index (PyPI), allowing for hijacking of over 22,000 existing PyPI packages. Attackers can publish malicious packages under the same name and a higher version, posing a significant risk to developers. The attack has already been exploited, emphasizing the … Read more

Software Supply Chain Security Firm Lineaje Raises $20M in Series A Funding

by

July 30, 2024 at 10:00AM Lineaje, a software supply chain security management provider, has raised $20 million in a Series A funding round, totaling $27 million in investments. The funding, led by various ventures and investors, will support Lineaje’s global expansion and technological advancement. The Saratoga-based company offers comprehensive governance platforms for software supply chain … Read more

Wanted: A SBOM Standard to Rule Them All

by

July 23, 2024 at 10:07AM The SBOM, originally created by NTIA, has transitioned from niche to mandatory for federal agencies and security teams due to the rise in supply chain attacks. However, the current fragmented implementation is hindering its effectiveness. The need for a unified, comprehensive format is crucial to enhance software supply chain security … Read more