Tag: open source
44 articles
software supply chain Must-Have Fix for Risky Systems
The OpenSSF warns that the critical infrastructure powering npm, PyPI and other registries is underfunded and increasingly vulnerable—if we don’t invest now, supply‑chain attacks and outages will be far costlier later. It’s time for governments, companies, and the community to share the bill and make the software plumbing resilient.
secret-stealing worm: Devastating npm threat Revealed
A fast‑spreading secret‑stealing worm nicknamed Shai‑Hulud is prowling npm, siphoning hundreds of credentials from developer machines and CI pipelines and turning routine installs into supply‑chain attacks. Act now: rotate exposed tokens, harden CI, and vet dependencies to stop further spread.
supply chain attack: Stunning Near-Miss, Risky Lessons
A fast, coordinated open‑source response helped avert what could have been a massive npm supply‑chain breach, but the near miss raises urgent questions for developers, maintainers and policymakers about dependency hygiene, registry controls and long‑term resilience.
Apache ActiveMQ Urgent Risk: Exclusive Stealth Patch Threat
Imagine an attacker who not only breaks in through a critical Apache ActiveMQ flaw but then patches it to hide their tracks—leaving defenders chasing symptoms, not the root cause. Treat any “fixed” indicator with skepticism: validate patches with independent controls, boost behavioral monitoring, and assume an adversary may have tampered with the system.
open source alternatives: Must-Have Best Path for UK
Should the UK lock in a £9bn deal with Microsoft or reinvest that money into open-source options that could boost resilience, competition and the domestic tech sector — even if transitions carry costs and risks? A pragmatic path of pilots, open standards and skills investment could protect services, cut long-term costs and reclaim digital sovereignty.
Alarming 188% Annual Increase in Malicious Open Source Packages
Discover the shocking 188% annual rise in malicious open source packages and its implications for developers and software security.
Microsoft Releases VS Code Copilot Chat Extension as Open Source on GitHub
Microsoft has launched the VS Code Copilot Chat Extension as open source on GitHub, enhancing developer productivity with AI-powered coding assistance.
Google Cloud Contributes A2A AI Protocol to the Linux Foundation
Google Cloud donates the A2A AI Protocol to the Linux Foundation, enhancing open-source collaboration in artificial intelligence development.
PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud Environments
Malware surge exploits PyPI, npm, and AI tools in DevOps and cloud environments. Learn how attackers leverage these vulnerabilities to compromise systems.
Malicious PyPI Package Masquerades as Chimera Module to Steal AWS, CI/CD, and macOS Data
Beware: Malicious PyPI package disguised as Chimera module steals AWS credentials, CI/CD secrets, and macOS data.
Apple tries to contain itself with lightweight Linux VMs for macOS
Apple employs lightweight Linux VMs on macOS to contain processes, boost efficiency, and enhance system security.
Supply chain attack hits Gluestack NPM packages with 960K weekly downloads
Supply chain attack strikes Gluestack’s NPM packages with 960K weekly downloads, exposing vulnerabilities that threaten project security and developer trust.
Reconnaissance Campaign Active on NPM Repository
A reconnaissance campaign on the NPM repository exposes vulnerabilities and drives urgent calls for stronger security protocols.
SafeLine WAF: Open Source Web Application Firewall with Zero-Day Detection and Bot Protection
SafeLine WAF is an open-source web application firewall with zero-day detection and robust bot protection to keep your site secure.
Code Transparency: Unveiling the Secret to Strong Security
Unlock robust security by revealing hidden vulnerabilities through code transparency, ensuring precise risk management and flawless system integrity.
Ivanti Remediates Two Actively Exploited Zero-Day Flaws as Intelligence Agency Issues Warning
Ivanti patches two actively exploited zero-day flaws as intelligence agencies warn of escalating cyber threats, urging rapid remediation.
Curl project founder snaps over deluge of time-sucking AI slop bug reports
Curl project founder snaps amid endless AI-generated bug reports, decrying time-wasting issues and distracting from genuine bugs.
Pentagon declares war on ‘outdated’ software buying, opens fire on open source
Pentagon targets outdated software buying and open source tools, enforcing a tech crackdown to modernize national defense procurement.
Open-Source Platforms Offer Enhanced Security Over Proprietary Systems
Open-source platforms deliver enhanced security through transparent code, rapid patches, and active community oversight, outperforming proprietary systems.
Open source text editor poisoned with malware to target Uyghur users
Open-source text editor infected with malware allegedly targets Uyghur users, raising serious security and privacy concerns.