open source

Cloud-native adoption shifts security responsibility across teams

March 28, 2022

Styra released a research report which explores how in sync, or misaligned, IT leaders and developers are when it comes to cloud-native technology use and security during …

The Linux Foundation’s Census of OSS app libraries helps prioritize security work

March 3, 2022

The Linux Foundation announced the final release of “Census II of Free and Open Source Software – Application Libraries,” which identifies more than one thousand of the …

Software supply chain security still a pain point

February 18, 2022

ActiveState announced the results of its survey, providing insights into the security challenges of the software industry’s open source supply chain, which includes the …

Kali Linux 2022.1 released: New tools, kali-linux-everything, visual changes

February 15, 2022

Offensive Security has released Kali Linux 2022.1, the latest version of its popular open source penetration testing platform. Visually refreshed and with improved usability …

Samba bug may allow code execution as root on Linux machines, NAS devices (CVE-2021-44142)

February 2, 2022

A critical vulnerability (CVE-2021-44142) in Samba, a widely used open source implementation of the Server Message Block (SMB) networking protocol, could allow attackers to …

Open-source code: How to stay secure while moving fast

January 26, 2022

Open source has transformed the software world, tremendously reducing the cost of introducing new technology by enabling broad reuse across products and industries. However, …

EU launches bug bounty programs for five open source solutions

January 25, 2022

The European Union is, once again, calling on bug hunters to delve into specific open source software and report bugs. This time around, the list of software that should be …

Log4Shell is a dumpster fire that should have been avoided

December 23, 2021

On Thursday, December 9, 2021, my young, Minecraft-addicted kids were still completely oblivious of the Log4j vulnerabilities in their favorite game. Then again, so was every …

Open-source software holds the key to solving Log4Shell-like problems

December 22, 2021

Earlier this month, the existence of a critical vulnerability in Apache Log4j 2 was revealed and a PoC for it published. Dubbed Log4Shell, it’s an issue in a logging library …

GoTestWAF: Open-source project for evaluating web application security solutions

December 20, 2021

GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, WebSockets, SOAP, XMLRPC, etc. It was …

Immudb: Open-source database, built on a zero trust model

December 17, 2021

Now, with full transactional support for everyday business applications, the open source immudb tamper-proof database can serve as the main transactional database for …

Log4Shell update: Attack surface, attacks in the wild, mitigation and remediation

December 13, 2021

Several days have passed since the dramatic reveal of CVE-2021-44228 (aka Log4Shell), an easily exploitable (without authentication) RCE flaw in Apache Log4j, a popular …