GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos
Unexpected workflow_dispatch runs in the Actions tab could be a warning sign, the researchers said in a blog post. “If you use OIDC federation for…
Category: CISOOnline
TrapDoor malware campaign puts developer workstations in CISO spotlight
The packages were designed to steal developer secrets, including AWS credentials, GitHub tokens, SSH keys, browser data, environment variables, crypto wallets, and local development configuration…
Vulnerabilities have become cyber attackers’ No. 1 door to the enterprise
Verizon researchers found that exploited flaws were the root cause of breaches in 31% of cases, with credential abuse blamed for 13% of security failures.…
Security experts caution MFA alone can no longer stop threat actors
Professional attack model The Kali365 service provides templates, management dashboards, and integrated tools that lower the skill barrier for implementing large-scale attacks to the threat…
As AI speeds coding, CVE Lite CLI keeps security deliberately AI-free
“What developers are missing is early feedback at the point where the dependency decision is made,” Sonu Kapoor, creator and maintainer of the project, told…
AI security needs a shift from models to systems, researchers argue
“The AI model powering the agent must be treated as an untrusted component,” the researchers wrote in the paper, warning that “semantic guardrails” and prompt-level…
To pay, or not to pay: 58% of CISOs say they would pay the ransom for their data
In the survey of 750 CISOs in the US and UK, 58% said their organization would be willing to pay to end a ransomware incident.…
Unpatched ChromaDB flaw leaves servers open to remote code execution
The vulnerability stems from a race condition between the code ChromaDB uses to parse embedding model references and the code it uses to perform an…
Google folds CodeMender into agent ecosystem amid push for AI-led AppSec
The shift suggests that CodeMender may no longer be just a standalone remediation tool. Instead, it appears to be positioned as part of a broader…
Microsoft says it’s making AI ‘safe for work’ in your browser
And a new tab page will pull together calendar entries, files and Copilot prompts, reducing the need to switch between tools, it said. A key…
Google leaks details for Chromium bug that can turn browsers into bots
The bug tracker entry that contains the technical details was accessible long enough to be archived by users, and a copy can be easily found…
Police take down VPN service (this time with a good reason)
While First VPN’s fates seems well-deserved, there are concerns about wider attempts by governments and law enforcers to clamp down on users of VPN services.…