An attacker managed to gain access to the marketing platform Brevo by exploiting a residual Cloudflare API key left in the source code. This was used to deploy a malicious Cloudflare Worker that installed harmful scripts and a backdoor plugin on tens of thousands of WordPress sites. Visitors to the affected websites were subsequently presented […]
AI is significantly accelerating software development: thanks to AI, 82% of developers spend less time writing code. However, QA is lagging behind, as parallel-developed AI features cause conflicts, changing test data, and inconsistent test environments. Tests involving more than four features simultaneously quickly prove to be less reliable, making phased testing increasingly important. Organizations must […]
CISA and international cybersecurity agencies have updated the minimum requirements for a Software Bill of Materials (SBOM), significantly strengthening software supply chain transparency. New mandatory elements, such as author digital signatures, hashes, licensing information, and the context of SBOM generation, ensure much better code integrity and traceability. A robust SBOM must map all components and […]
Software security does not start with patches, but during design, development, and configuration. This CIS and SAFECode guide builds on the NIST Secure Software Development Framework (SSDF) and describes six pillars of Secure by Design: secure design, secure development, secure default configuration, supply chain security, code integrity, and rapid vulnerability handling. Additionally, the guide provides […]