Computer Security Articles

For years, software supply chain security (SSCS) lived like a teenager in the basement of a bigger house. It was a line item inside the sprawling application security testing (AST) world — important, occasionally praised at dinner, but never quite trusted with its own keys. Everybody nodded along about software bills of material (SBOMs) and provenance the way you nod along about flossing.On June 17, the basement kid got the keys. Gartner published its very firstMagic Quadrant™ for Software Suppl

The inaugural Gartner Magic Quadrant™ for Software Supply Chain Security evaluates 18 vendors across more than 37  pages of research. Most security teams will read the executive summary, look at the graphic, and move on.That’s a miss because the evaluation criteria, the Mandatory Features list, Gartner identified across the field give AppSec leaders exactly the framework they need to run a sharper, faster vendor evaluation.In our experience, here are the five things that matter most.[ Learn howR

More than 80% of organizations’ cybersecurity operations are currently getting an assist from AI or are planning to adopt it, but nearly seven out of 10 security pros say their jobs have gotten harder since the widespread adoption of AI began. That’s a finding from the latest cybersecurity report from the Information Systems Security Association (ISSA) and research and consulting firm Omdia.TheLife and Times of Cybersecurity Professionals studynoted that job satisfaction numbers have been consis

We believe the release of a new Gartner Magic Quadrant is always a watershed moment for the technology sector. In our opinion,  it signals that a specific category of software has matured from a niche collection of tools into a vital, formalized market. For software engineering and security testing teams, the latest report covering software supply chain security represents a massive shift in how organizations protect their code, their infrastructure, and their customers.Before this formal recogn

When appraising the legitimacy of packages in software repositories, developers and even security tools often rely on download counts. Nonetheless, the metric can be weaponized by threat actors who use automated systems such as repository mirrors and analysis bots to poison software packages and infect supply chains.Researchers at Tenable discovered the new technique, which they’re calling “download pumping,” while analyzing npm packages uploaded to the public registry, senior security researche

Last week, RL discovered an active Microsoft 365 device code phishing campaign that abuses Microsoft’s legitimate OAuth 2.0 Device Authorization Grant flow to obtain access to victim accounts.Rather than stealing passwords through a counterfeit login page, the phishing kit persuades victims to complete a legitimate Microsoft authentication process that authorizes an attacker-controlled device.In this companion Spectra Analyze in Action post, you’ll find a deep dive on how it works, including the

Organizations investing in software bill of materials (SBOM) practices are starting to see the payoff as it becomes easier and less of a time sink to chase down what’s actually running in production when supply chain incidents make headlines. The only problem is that with AI, the software supply chain visibility goalposts are moving.AI supply chain attacks are in their infancy, but this spring has given us a preview of what life with AI-embedded software is going to look like. In March, two PyPI

Somewhere between a fake CAPTCHA page and an open Run dialog, the security model at most organizations breaks down. That is the uncomfortable conclusion of ReversingLabs’ new threat research report,”Copy, Paste, Compromise: The Tale of ClickFix,”by RL researcher Toni Dujmović and the RL Threat Intelligence Research team.ClickFix, a social engineering technique first identified in 2023, is one of the most widely deployed attack methodologies in the current threat landscape — precisely because to