By now, you have likely heard about the latest OpenSSH security issue (dubbed regreSSHion, since all good bugs require a catchy name). And as usual, we’re seeing many blog posts that…
It’s been a week since the xz backdoor dropped. I stand by my earlier conclusion that the community really dodged a bullet, and this is reaffirmed by many other well-respected…
(When you're done reading this, make sure to check out Part 2 of the series here.) Yesterday’s discovery of the xz backdoor was an accident. But what a fortunate accident…
Another August, another Hacker Summer Camp. The annual gathering of 25,000 like-minded hackers and security enthusiasts descended on Vegas for a week of get togethers, talks, and parties. This year…
CVE-2023-38408, discovered by the Qualys Threat Research Unit (TRU), describes an RCE (remote code execution) vulnerability made possible by an unwanted interaction between OpenSSH’s ssh-agent executable, the dlopen() and dlclose()…
A recent vulnerability came across my radar earlier this week. The description was vague but said: "There is a stack overflow vulnerability caused by strcpy." This API first appeared in…
BSides LV / Black Hat 25 / DEF CON 30 (aka Hacker Summer Camp 2022) in Las Vegas is now in the rear-view mirror. In addition to news that continues…
Deepfactor is a developer security platform that enables engineering teams to observe unexpected and risky application behavior during software development, helping developers quickly discover and resolve security vulnerabilities, supply chain…
Happy Holidays! If you're responsible for application security (AppSec) in your organization—and especially if your applications are written in Java—you received an early Christmas present this past weekend in the…
This week at KubeCon + CloudNativeCon North America 2021, we announced the first major architectural upgrade to our Continuous Application Security Testing (CAST) solution, Deepfactor. This upgrade brought with it…
When a developer wants to know what an application they've developed is doing, there are a number of different techniques that can be used. But before I dive…
Are there no observability tools purpose-built for developers? When meeting with our customers’ dev teams, I'm continually amazed that basically nobody I talk with needs much selling on the reasons…
