Software Supply Chain Security

supply, chain, Blue Yonder, secure, Checkmarx Abnormal Security cyberattack supply chain cybersecurity

Securing the Software Supply Chain: Checkmarx One Expands its Offerings

Alan Shimel | November 20, 2024 | SBOMs, shift left, supply chain security, zero trust

The software supply chain is under siege. Threat actors increasingly exploit weaknesses in code repositories, dependencies and mismanaged secrets to infiltrate and disrupt software development processes. In response, organizations are turning to ...

Security Boulevard

Microsoft Fixes Four 0-Days — One Exploited for SIX YEARS

Richi Jennings | September 11, 2024 | CVE-2024-38014, CVE-2024-38217, CVE-2024-38226, CVE-2024-43491, KB5043083, KB5043936, Mark of the Web, Microsoft, Microsoft Patch Tuesday September 2024, Microsoft Windows, Microsoft Windows Zero Day, Patch Tuesday, SB Blogwatch, Windows, Windows Update

Week B: Bugs begone! This month Redmond fixes 79 security flaws in Windows and other products ...

Security Boulevard

Yikes, YubiKey Vulnerable — ‘EUCLEAK’ FIDO FAIL?

Richi Jennings | September 4, 2024 | CVE-2024-45678, ECDSA, EUCLEAK, FIDO, FIDO2, Infineon, Passkeys, SB Blogwatch, YSA-2024-03, Yubikey

USB MFA SCA😱: Infineon hardware and software blamed for timing side-channel attack on popular auth tokens ...

Security Boulevard

China Cyberwar Coming? Versa’s Vice: Volt Typhoon’s Target

Richi Jennings | August 28, 2024 | CenturyLink, china, china espionage, China-linked Hackers, China-nexus cyber attacks, China-nexus cyber espionage, CVE-2024-39717, Lumen, Lumen Technologies, Peoples Republic of China, SB Blogwatch, Versa Director, Versa Neworks, VersaMem, Volt Typhoon

Xi whiz: Versa Networks criticized for swerving the blame ...

Security Boulevard

Patch Tuesday not Done ’til LINUX Won’t Run?

Richi Jennings | August 21, 2024 | CVE-2022-2601, Dual boot, GRUB2 Bootloader Secure Boot Bypass, Linux, Microsoft, Microsoft Patch Tuesday August 2024, Microsoft Windows, Patch Tuesday, SB Blogwatch, SBAT, secure boot, Secure Boot Advanced Targeting, Windows

Redmond reboot redux: “Something has gone seriously wrong.” You can say that again, Microsoft ...

Security Boulevard

The word “Tuesday” in cutout paper letters on a textured background

August Patch Pileup: Microsoft’s Zero-Day Doozy Dump

Richi Jennings | August 14, 2024 | Adobe patch, august patch tuesday, CVE-2024-21302, CVE-2024-38106, CVE-2024-38107, CVE-2024-38178, CVE-2024-38189, CVE-2024-38193, CVE-2024-38199, CVE-2024-38200, CVE-2024-38202, CVE-2024-38213, Microsoft patch tuesday, Microsoft Patch Tuesday August 2024, Patch Tuesday, SB Blogwatch

See These CVEs: Patch Tuesday—ten zero-days, seven Critical vulns, zero time to waste ...

Security Boulevard

WTH? DPRK WFH Ransomware Redux: 3rd Person Charged

Richi Jennings | August 13, 2024 | Andrew M., DPRK, Korea, Korean military, Korean ransomware, Matthew Isaac Knoot, North Korea, North Korean Hacking, North Korean Threat Actors, northkorea, Noth Korea, SB Blogwatch

North Korean army of remote IT workers enabled by Matthew Isaac Knoot, alleges DoJ ...

Security Boulevard

David Boies, founding partner and chairman of Boies Schiller Flexner, LLP

CrowdStrike Sued? — Delta Dials David Boies

Richi Jennings | July 31, 2024 | CrowdStrike, CrowdStrike Falcon, CrowdStrike incident;, Delta Airlines, falcon, SB Blogwatch

Is Delta the First of Many? Airline calls in attorneys Boies Schiller Flexner to claw back its cash ...

Security Boulevard

An open padlock on a PC keyboard, with the word “FAIL” superimposed

PKfail: 800+ Major PC Models have Insecure ‘Secure Boot’

Richi Jennings | July 26, 2024 | Binarly, BIOS, BIOS update, Certificate and Key Management, hardware supply chain, key management, Key Management Problem, PKfail, Private Key Management, SB Blogwatch, secure boot, UEFI, UEFI Failing, UEFI firmware, UEFI vulnerabilities, Unified Extensible Firmware Interface (UEFI)

Big BIOS bother: Hundreds of PC models from vendors such as HP, Lenovo, Dell, Intel, Acer and Gigabyte shipped with useless boot protection—using private keys that aren’t private ...

Security Boulevard