Blog

Multi-patch vulnerability fixes can leave open source exposed

Vulnerability management runs on a shorthand. A CVE shows a linked patch, someone applies it, and the ticket moves to closed. That shorthand covers most open source fixes. A share work in a different way, arriving as a run of two or more commits where the first one leaves the flaw in place. Researchers at the University of Texas at Dallas went through 1,646 open source CVEs that carry more than one patch in the … More → The post Multi-patch vulnerability fixes can leave open source exposed appeared first on Help Net Security.
http://news.poseidon-us.com/TTg9Zk

The AI code vulnerabilities that grow with your app

Theori built 28 apps with AI coding agents and scanned each one through its pentesting platform. Five models did the building, split between Anthropic and OpenAI, across apps written from a spec, thrown together from a casual prompt, and rewritten from an aging PHP codebase. The team went in expecting injection everywhere. SQL injection, cross-site scripting, the bugs that fill security tutorials. Those barely showed up. The models reached for prepared statements and ORMs on … More → The post The AI code vulnerabilities that grow with your app appeared first on Help Net Security.
http://news.poseidon-us.com/TTg9Zf

Building a defense in depth strategy for sensitive data

In this Help Net Security video, Venkata Pavan Kumar Gummadi, Professional Software Engineer at Broadridge, explains how to build a defense in depth strategy for protecting sensitive data. He argues that a single control, like encrypting a disk or turning on DLP, leaves gaps that attackers exploit by finding the seams between layers. Venkata walks through four layers that work together across the data life cycle. Classification labels fields such as Social Security numbers and … More → The post Building a defense in depth strategy for sensitive data appeared first on Help Net Security.
http://news.poseidon-us.com/TTg9Z8