Cybersecurity

Codecov’s compromised Bash Uploader script exposed CI/CD secrets for thousands of organizations, highlighting a systemic weakness in how we trust third-party

Attackers pushed malicious commits to PHP’s official Git repository, exposing the fragile trust model behind open-source supply chains.

Four zero-day vulnerabilities in Microsoft Exchange Server are being actively exploited at scale, and the fallout is only beginning.

Python’s latest security releases fix critical vulnerabilities and highlight the increasingly professional security posture of the Python ecosystem.

Three months after the SolarWinds breach disclosure, the full scope is still unfolding and the implications for software supply chain security demand

WhatsApp’s updated privacy policy drives millions to Signal, highlighting the growing demand for privacy-respecting open-source alternatives.

The SolarWinds supply chain attack is a watershed moment for software security — and it has profound implications for how we build, ship, and trust code.

FireEye discloses that sophisticated attackers stole their red team tools.

A joint NSA/CISA advisory details 25 CVEs actively exploited by Chinese state-sponsored actors. The uncomfortable truth: most are well-known and patchable.

CVE-2020-1472, dubbed Zerologon, scores a perfect 10.0 CVSS and allows full domain takeover with a handful of packets. Here’s what you need to know.

The massive Twitter compromise that hit Barack Obama, Elon Musk, and Apple wasn’t a sophisticated zero-day — it was social engineering targeting internal tools.

Home IoT device sales have surged during lockdowns, and every one of those devices just joined a corporate network via VPN.