Breaking News

As commercial and enterprise software developers become more disciplined about keeping their open source software components updated to reduce the risk of software supply chain attacks, the bad guys are getting craftier: Researchers warn that they're over-running open source projects to turn them into malware distribution channels.

It used to be that attackers simply preyed on existing vulnerabilities within well-used open source components, with the understanding they could victimize the many organizations relying on outdated dependencies. Attackers are now more frequently getting proactive by infiltrating open source projects to seed them with compromised components that they can pounce on once they're downloaded and used by unsuspecting organizations.

The hacker-for-hire group, operating since at least 2012, primarily targets financial firms.
Small and midsize businesses (SMBs) should have a new advanced persistent threat (APT) on their collective radar: DeathStalker has been targeting SMBs in the financial sector since at least 2012.

Kaspersky researchers tracking the group since 2018 report DeathStalker has targeted companies around the world.
Attackers don't seem motivated by financial gain; they don't deploy ransomware or steal payment data.
The focus is sensitive business data, which could mean DeathStalker offers hacker-for-hire services, or serves as a sort of "information broker," in financial circles.

As part of a continuous testing approach, fuzzing has evolved to provide in-depth code checks for unknown vulnerabilities before deployment.

As companies have shifted security left, putting more security checks into the development pipeline, fuzz testing, or "fuzzing," has largely continued to remain outside the main software development lifecycle.
This year, that seems to have changed. DevOps lifecycle firm GitLab announced in June that the company had acquired two organizations, Peach Teach and Fuzzit, to bolster its own capabilities by providing continuous and periodic protocol fuzzing.