Securing Open Source
Torvalds Offers Guidance as AI Bug Reports Clog Up Linux Security Workflow
Linux kernel maintainers are confronting a new operational problem tied to the rapid adoption of AI-assisted coding tools, as too many people are reporting the same vulnerabilities at the same time. Linus ...
Security Boulevard
Fragnesia Extends Linux Kernel Security Challenge with Root-Level Exploit
A newly disclosed Linux kernel vulnerability is intensifying concerns about the stability of recent kernel security fixes, after researchers revealed a flaw that enables local attackers to obtain root privileges through corruption ...
Security Boulevard
OpenAI’s Aardvark is an AI Security Agent Combating Code Vulnerabilities
Jon Swartz | | Aardvark, AI agent security, Codex, LLM, Microsoft, open source AI tools, OpenAI, OpenAI GPT-5
OpenAI on Thursday launched Aardvark, an artificial intelligence (AI) agent designed to autonomously detect and help fix security vulnerabilities in software code, offering defenders a potentially valuable tool against malicious hackers. The ...
Security Boulevard
Apple Enrages IT — 45-Day Cert Expiration Fury
Richi Jennings | | 90-day certificates, 90-day TLS certificate validity, Apple, Apple Safari, browser, Browser Security, CA/B Forum, CA/Browser Forum, CAB Forum, certificate, Certificate and Key Lifecycle Management, Certificate and Key Management, Certificate Automation, mobile safari, Safari, SB Blogwatch, Sectigo
CA/B testing: Ludicrous proposal draws ire from “furious” systems administrators ...
Security Boulevard
Biggest Ever DDoS is Threat to OT Critical Infrastructure
Richi Jennings | | Analyzing DDoS Attacks, application-layer DDoS attacks, Cloudflare DDoS Protection, Critical Infrastructure, critical infrastructure attack, critical infrastructure attacks, Critical Infrastructure Security and Resilience Month, cyber attack on critical infrastructure, ddos, DDoS amplification, DDoS attack, distributed denial of service, Distributed denial of service (DDoS) attacks, distributed denial of service attack, ICS, ICS/SCADA systems, industrial control systems, Infrastructure, iot, operational technologies, operational technology, operational technology security, OT, SB Blogwatch, US critical infrastructure
Egyptian River Floods: Operational technology (OT) targeted in “world record” 3.8 Tb/s distributed denial of service (DDoS) ...
Security Boulevard
Why NTIA Support of Open-Source AI is Good for Security
A fully open model — one where the training data is available for inspection and modification — provides a means for addressing another threat: malicious or accidentally bad training data ...
Security Boulevard
Prisoner Swap: Huge Russian Hackers Freed — Seleznev and Klyushin
Richi Jennings | | cyber attacks russia, Putin, Roman Seleznev, Russia, russia hacker, russia-based, Russian hacker, Russian hackers, Russian hacking, SB Blogwatch, Vladimir Putin, Vladislav Klyushin
Pragmatic politics: Anger as Putin gets back two notorious cybercriminals ...
Security Boulevard
‘Blast-RADIUS’ Critical Bug Blows Up IT Vacation Plans
Richi Jennings | | blast radius, collision-based-hashing-algorithm-disclosure, CVE-2024-3596, hash, hash algorithms, hash function, hash functions, Man In The Middle, man in the middle attack, man in the middle attacks, maninthemiddleattacks, md5 hash, men-in-the-middle attack, mitm, MitM Attack, mitm attacks, RADIUS, SB Blogwatch
MD5 MITM Muddle: Ancient, widely used protocol has CVSS 9.0 vulnerability ...
Security Boulevard
‘Polyfill’ Supply Chain Threat: 4x Worse Than We Thought
Richi Jennings | | App Sec & Supply Chain Security, AppSec & Supply Chain Security, CloudFlare, Funnull, Javascript, Modern Software Supply Chains, Open Source and Software Supply Chain Risks, open source software supply chain, open source software supply chain security, polyfill, SB Blogwatch, secure software supply chain, software supply chain attack, software supply chain attacks, software supply chain hygiene, software supply chain risk, Software Supply Chain risks, Supply-Chain Insecurity
Spackle attack: Chinese company takes over widely used free web service—almost 400,000 websites at risk ...
Security Boulevard
‘Perfect 10’ Apple Supply Chain Bug — Millions of Apps at Risk of CocoaPods RCE
Richi Jennings | | App Sec & Supply Chain Security, Apple, Apple iOS, AppSec & Supply Chain Security, CocoaPods, CVE-2024-38366, CVE-2024-38368, dependencies, dependency injection, Dependency Management, macos, macOS Security, Modern Software Supply Chains, Open Source and Software Supply Chain Risks, open source software supply chain, open source software supply chain security, SB Blogwatch, software dependencies, Supply-Chain Insecurity, third-party dependencies, trust dependencies
Tim looks grim: 10 year old vulnerabilities in widely used dev tool include a CVSS 10.0 remote code execution bug ...
Security Boulevard

