ransomware hospital — both words
"data breach" — exact phrase
malware -android — exclude a word
(apple OR microsoft) patch — either company, plus patch
ransom* — a wildcard match
Searches article titles, summaries, keywords and sources. Filters use publication dates.
1–10 of 43 articles
Best match · title matches first
Dark Reading
AI models often hallucinate or make costly mistakes when tasked with recommending software versions, upgrade paths, and security fixes — leading to significant technical debt.
The Register
Czech researcher lays out a business case for reducing reliance on Redmond A sharply argued blog post warns that heavy reliance on Microsoft poses serious strategic risks for organizations – a viewpoint unlikely to win favor with Redmond or its millions of corporate customers.… Comment
The Hacker News
Researchers have identified a dependency confusion vulnerability impacting an archived Apache project called Cordova App Harness. Dependency confusion attacks take place owing to the fact that package managers check the public repositories before private registries, thus allowing a threat actor to publish a malicious package with the same name to a public package repository. This&
Dark Reading
Bad actors practice to deceive package managers with a tangled web of methods. Here's how to hoist them by their own petard.
Dark Reading
Google has opened up its software-dependency database, adding to the security data available to developers and tool makers. Now developers need to use it.
Dark Reading
With deps.dev API and Assured OSS, Google is addressing the common challenges software developers face in securing the software supply chain.
The Register
System data was exfiltrated during attack, but an anonymous person says it was a research project gone wrong An unknown attacker used the PyPI code repository to get developers to download a compromised PyTorch dependency that included malicious code designed to steal system data.…
The Hacker News
The maintainers of the PyTorch package have warned users who have installed the nightly builds of the library between December 25, 2022, and December 30, 2022, to uninstall and download the latest versions following a dependency confusion attack. "PyTorch-nightly Linux packages installed via pip during that time installed a dependency, torchtriton, which was compromised on the Python Package
Bleeping Computer
PyTorch has identified a malicious dependency with the same name as the framework's 'torchtriton' library. This has led to a successful compromise via the dependency confusion attack vector. [...]
Dark Reading
Existing software security firms and new startups tackle the tasks of exposing dependencies and helping developers manage their use of open-source components.