Java

PRevent: Open-source tool to detect malicious code in pull requests

February 20, 2025

Apiiro security researchers have released open source tools that can help organizations detect malicious code as part of their software development lifecycle: PRevent (a …

Critical RCE bug in SolarWinds Web Help Desk fixed (CVE-2024-28986)

August 15, 2024

SolarWinds has fixed a critical vulnerability (CVE-2024-28986) in its Web Help Desk (WHD) solution that may allow attackers to run commands on the host machine. “While …

Users of JetBrains IDEs at risk of GitHub access token compromise (CVE-2024-37051)

June 11, 2024

JetBrains has fixed a critical vulnerability (CVE-2024-37051) that could expose users of its integrated development environments (IDEs) to GitHub access token compromise. …

The hidden costs of Java, and the impact of pricing changes

November 1, 2023

An overwhelming 98% of all the businesses surveyed use Java in their software applications or infrastructure, and 57% of those organizations indicate that Java is the backbone …

Google delivers secure open source software packages

April 13, 2023

Google has announced the Google Cloud Assured Open Source Software (Assured OSS) service, which aims to be a trusted source of secure open source packages, and the deps.dev …

CI Fuzz CLI: Open-source tool to test Java apps for unexpected behaviors

December 2, 2022

CI Fuzz CLI, the open-source Command-Line Interface (CLI) tool from Code Intelligence, now allows Java developers to easily incorporate fuzz testing into their existing JUnit …

Consumer behaviors are the root of open source risk

October 24, 2022

Sonatype unveiled its eighth annual State of the Software Supply Chain Report which, in addition to a massive surge in open source supply, demand, and malicious attacks, found …

Apache Commons Text flaw is not a repeat of Log4Shell (CVE-2022-42889)

October 19, 2022

A freshly fixed vulnerability (CVE-2022-42889) in the Apache Commons Text library has been getting attention from security researchers these last few days, worrying it could …

How to manage the intersection of Java, security and DevOps at a low complexity cost

August 15, 2022

In this Help Net Security video, Erik Costlow, Senior Director of Product Management at Azul, talks about Java centric vulnerabilities and the headache they have become for …

Spring4Shell: No need to panic, but mitigations are advised

March 31, 2022

Security teams around the world got another shock on Thursday when news of disclosure of a PoC for an unauthenticated RCE zero-day vulnerability in Spring Core, a massively …

Experts uncover Elephant Beetle, an organized financial-theft operation

January 6, 2022

Sygnia announced that it has released its comprehensive report uncovering an organized financial-theft operation it has termed Elephant Beetle. For the past two years, the …

Trojan Source bugs may lead to extensive supply-chain attacks on source code

November 2, 2021

Cambridge University researchers have detailed a new way targeted vulnerabilities can be introduced into source code while making them invisible to human code reviewers, …