Security Leftovers
-
Security Week ☛ Organizations Warned of Exploited GeoServer Vulnerability
CISA says it has evidence that a recent critical-severity vulnerability in GeoServer is exploited in the wild.
-
SANS ☛ "Reply-chain phishing" with a twist, (Tue, Jul 16th)
Few weeks ago, I was asked by a customer to take a look at a phishing message which contained a link that one of their employees clicked on. The concern was whether the linked-to site was only a generic credential stealing web page or something targeted/potentially more dangerous.
-
Security Week ☛ Atlassian Patches High-Severity Vulnerabilities in Bamboo, Confluence, Jira
Atlassian releases security-themed updates to fix several high-severity vulnerabilities in its Bamboo, Confluence and Jira products.
-
Security Week ☛ Chrome 126 Updates Patch High-Severity Vulnerabilities
Chrome 126 security updates released this week resolve high-severity vulnerabilities reported by external researchers.
-
OpenSSF (Linux Foundation) ☛ AI Cyber Challenge (AIxCC) and the Needle GNU/Linux Kernel Vulnerability – Part 2
In part 1 we discussed the Artificial Intelligence Cyber Challenge (AIxCC), a two-year competition to create Hey Hi (AI) systems that find software vulnerabilities and develop fixes to them. We also discussed a specific vulnerability in the GNU/Linux kernel, called needle, as an example of the kind of vulnerability we’d like such tools to find and fix. In part 1 we discussed how such tools might be able to find vulnerabilities. Now let’s talk a little bit about how they might fix them. Real competitors in AIxCC might do things differently; this article simply helps us understand what they’re trying to do.
-
OpenSSF (Linux Foundation) ☛ The 'Linux' Foundation and OpenSSF Release Report on the State of Education in Secure Software Development
Findings show nearly one-third of industry professionals are not familiar with secure software development practices