Security
Mandiant backs up an FBI warning that UNC3753 uses failed phishing as a pretext to physically access machines.
"The malware now generates a uniquely encrypted payload for each infection, making hash-based IOCs useful only for a specific package version"
"Unsexy infrastructure" - An 800-pound gorilla just entered the OSS security space
"We're just seeing them all over the place."
Control systems – and the entire software supply chain – needs work too, but even air-gapping isn't sufficient mitigation, Congress told.
Cloudflare’s CSO: “The principle is to make exploitation harder for an attacker even when a bug exists”
Webworm group has expanded outside of Europe to target EU countries and South Africa.
One poisoned extension. One trusted developer. Goodbye, private repositories. Claude Code configurations being targeted.
Bank of England to financial firms: Be ready to triage and remediate vulnerabilities faster