DevSecOps

Malware distribution on open source package repositories increased 1,300% in the last three years, researchers say.

Numerous Android and Java apps leveraging abandoned open-source libraries, including all technologies based on Apache Maven, could be compromised through the novel MavenGate software supply chain attack technique, reports The Hacker News.

Supply chain attacks possible with TensorFlow CI/CD misconfigurations TensorFlow instances on GitHub and PyPi could have been subjected to supply chain attacks involving the exploitation of continuous integration and continuous delivery vulnerabilities within the open-source machine learning framework, reports The Hacker News.

Unreported vulnerabilities may lurk among thousands of the most popular NPM packages.

All GitHub keys that may have been compromised by an unsafe reflection vulnerability, tracked as CVE-2024-0200, could be leveraged to enable remote code execution.

No user interaction is required for takeover; GitLab CE and EE users should patch immediately.

"In 2024, SaaS applications will present the next biggest attack surface that organizations have not yet addressed," says Adam Gavish, CEO and co-founder, DoControl.

Here’s five ways development and security teams can combine forces to build better apps via a DevSecOps approach.