Latest Open Source news

CISA: Most critical open source projects not using memory safe code

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published research looking into 172 key open-source projects and whether they are susceptible to memory flaws.
- Bill Toulas
- June 26, 2024
- 01:56 PM
- 6
Intel and Lenovo servers impacted by 6-year-old BMC flaw

An almost 6-year-old vulnerability in the Lighttpd web server used in Baseboard Management Controllers has been overlooked by many device vendors, including Intel and Lenovo.
- Bill Toulas
- April 11, 2024
- 12:50 PM
- 0
Sponsored Content
Implementing container security best practices using Wazuh

Maintaining visibility into container hosts, ensuring best practices, and conducting vulnerability assessments are necessary to ensure effective security. In this article Wazuh explores how its software can help implement best security practices for containerized environments.
- Sponsored by Wazuh
- April 09, 2024
- 10:01 AM
- 0
Notepad++ wants your help in "parasite website" shutdown

The Notepad++ project is seeking the public's help in taking down a copycat website that closely impersonates Notepad++ but is not affiliated with the project. There is some concern that it could pose security threats—for example, if it starts pushing malicious releases or spam someday either deliberately or as a result of a hijack.
- Ax Sharma
- April 08, 2024
- 05:51 AM
- 5
Japan warns of malicious PyPi packages created by North Korean hackers

Japan's Computer Security Incident Response Team (JPCERT/CC) is warning that the notorious North Korean hacking group Lazarus has uploaded four malicious PyPI packages to infect developers with malware.
- Bill Toulas
- February 28, 2024
- 10:04 AM
- 0
Sponsored Content
Role of Wazuh in building a robust cybersecurity architecture

Leveraging open source solutions and tools to build a cybersecurity architecture offers organizations several benefits. Learn more from Wazuh about the benefits of open source solutions.
- Sponsored by Wazuh
- January 26, 2024
- 10:01 AM
- 0
Over 1,450 pfSense servers exposed to RCE attacks via bug chain

Roughly 1,450 pfSense instances exposed online are vulnerable to command injection and cross-site scripting flaws that, if chained, could enable attackers to perform remote code execution on the appliance.
- Bill Toulas
- December 12, 2023
- 09:00 AM
- 2
Over 30% of Log4J apps use a vulnerable version of the library

Roughly 38% of applications using the Apache Log4j library are using a version vulnerable to security issues, including Log4Shell, a critical vulnerability identified as CVE-2021-44228 that carries the maximum severity rating, despite patches being available for more than two years.
- Bill Toulas
- December 10, 2023
- 10:35 AM
- 1
Multiple NFT collections at risk by flaw in open-source library

A vulnerability in an open-source library that is common across the Web3 space impacts the security of pre-built smart contracts, affecting multiple NFT collections, including Coinbase.
- Bill Toulas
- December 05, 2023
- 06:08 PM
- 0
Sponsored Content
Leveraging Wazuh to combat insider threats

Effective strategies for mitigating insider threats involve a combination of detective and preventive controls. Such controls are provided by the Wazuh SIEM and XDR platform.
- Sponsored by Wazuh
- November 27, 2023
- 10:02 AM
- 0
Open-source Blender project battling DDoS attacks since Saturday

Blender has confirmed that recent site outages have been caused by ongoing DDoS (distributed denial of service) attacks that started on Saturday.
- Bill Toulas
- November 22, 2023
- 11:12 AM
- 4
Malicious NuGet packages abuse MSBuild to install malware

A new NuGet typosquatting campaign pushes malicious packages that abuse Visual Studio's MSBuild integration to execute code and install malware stealthily.
- Bill Toulas
- October 31, 2023
- 10:23 AM
- 0
Decentralized Matrix messaging network says it now has 115M users

The team behind the Matrix open standard and real-time communication protocol has announced the release of its second major version, bringing end-to-end encryption to group VoIP, faster loading times, and more.
- Bill Toulas
- October 24, 2023
- 12:44 PM
- 0
FBI shares AvosLocker ransomware technical details, defense tips

The U.S. government has updated the list of tools AvosLocker ransomware affiliates use in attacks to include open-source utilities along with custom PowerShell, and batch scripts.
- Ionut Ilascu
- October 12, 2023
- 07:38 PM
- 0
Hundreds of malicious Python packages found stealing sensitive data

A malicious campaign that researchers observed growing more complex over the past half year, has been planting on open-source platforms hundreds of info-stealing packages that counted about 75,000 downloads.
- Bill Toulas
- October 04, 2023
- 05:31 PM
- 0
ShellTorch flaws expose AI servers to code execution attacks

A set of critical vulnerabilities dubbed 'ShellTorch' in the open-source TorchServe AI model-serving tool impact tens of thousands of internet-exposed servers, some of which belong to large organizations.
- Bill Toulas
- October 03, 2023
- 12:37 PM
- 0
Yes, there's an npm package called @(-.-)/env and some others like it

Strangely named npm packages like -, @!-!/-, @(-.-)/env, and --hepl continue to exist on the internet's largest software registry. While not all of these may necessarily pose an obvious security risk, some were named before npm enforced naming guidelines and could potentially break tooling.
- Ax Sharma
- September 02, 2023
- 08:00 AM
- 0
Amazon AWS distances itself from Moq amid data collection controversy

Amazon AWS has withdrawn its association with open source project Moq after the project drew sharp criticism for its quiet addition of data collection features, as first reported by BleepingComputer.
- Ax Sharma
- August 11, 2023
- 10:04 AM
- 2
Hackers use open source Merlin post-exploitation toolkit in attacks

Ukraine is warning of a wave of attacks targeting state organizations using 'Merlin,' an open-source post-exploitation and command and control framework.
- Bill Toulas
- August 09, 2023
- 05:32 PM
- 1
Popular open source project Moq criticized for quietly collecting data

Open source project Moq (pronounced "Mock") has drawn sharp criticism for quietly including a controversial dependency in its latest release. Moq's 4.20.0 release from this week included another project, SponsorLink, which caused an uproar among open source software consumers, who likened the move to a breach of trust.
- Ax Sharma
- August 09, 2023
- 01:42 PM
- 4