Supply chain

An attempted rebound by LockBit and rise of fresh groups like RansomHub led to a 20% increase in claimed victims.

Jay Jacobs Co-Founder and Data Scientist and Wade Baker Co-Founder; Data Storyteller from The Cyentia Institute come on the show to talk about The Exploit Prediction Scoring System (EPSS). This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!

PyPi has immediately moved to revoke the authentication token, which had been given to PyPI Admin EE Durbin before March 3, 2023, reported JFrog researchers.

A newly disclosed vulnerability in the way source code is compiled could put enterprises at risk of upstream attacks.

All of the packages employed Intermediary Language Weaving to insert malicious code within a Portable Executable .NET binary.

CVE-2024-6385, like another bug patched last month, could allow attackers to run pipelines as any user.

Up to 68 malicious iterations of the jQuery software have been distributed across GitHub, npm, and jsDelivr as part of a sophisticated supply chain intrusion.

A four-part framework for assessing OSS trustworthiness can be automated using free software.