PHP 8.0 reaches EOL leaving some websites vulnerable

PHP 8.0 reached its end of life (EOL) on 26 November 2023 and will no longer receive any updates or patches.

PHP 8.0 was released on 26 November 2020 and brought many new features and improvements such as named arguments, attributes, constructor property promotion, match expression, nullsafe operator, JIT, and more.

The EOL of PHP 8.0 means that any websites still using it will be exposed to potential security risks and compatibility issues if they do not upgrade to a...

27 November 2023 | Developer

Checkmarx uncovers persistent Python package threat

Checkmarx has uncovered a threat actor that has been quietly infiltrating the open-source ecosystem for nearly six months, planting malicious Python packages with a focus on deception and financial gain.

The malicious actor employed a systematic approach, disguising their packages with names closely resembling popular legitimate Python packages. These decoy packages, camouflaged to blend in, successfully garnered thousands of downloads. The malicious payload, embedded within the...

16 November 2023 | Developer

AI coding assistants: A double-edged sword for DevOps in 2024

A growing reliance on AI-powered coding assistants is reshaping how DevOps teams operate, for better or worse.

According to Forrester's 2024 cybersecurity, risk, and privacy predictions, AI coding assistants are becoming integral to boosting productivity. However, a cautionary note accompanies this technological shift, as Forrester warns of potential pitfalls that could lead to cybersecurity breaches.

Forrester predicts that the combination of inconsistent compliance and...

10 November 2023 | API

Wallarm highlights disturbing trends in API security threats

Wallarm has released its Q3 2023 API ThreatStats report which sheds light on the escalating threats targeting APIs and revealing vulnerabilities that have impacted industry giants such as Netflix, VMware, and SAP.

The report's revamped ‘Top 10 API Security Threats’ compilation outlines 239 vulnerabilities discovered during the quarter, with injections taking the lead.

Injections involve inserting malicious data or code into APIs, leading to unauthorised access and...

8 November 2023 | API

State of Java: Resilience amid licensing changes and security concerns

Azul has unveiled its first annual State of Java Survey & Report, which offers a deep exploration of the Java landscape.

The study – based on responses from over 2,000 Java users worldwide – aims to provide unparalleled insights into Java's current standing, particularly its influence on enterprises of various sizes.

Java's ubiquity and vital role

The report underscores Java's pervasive presence, with a staggering 98 percent of businesses surveyed utilising...

27 October 2023 | Developer

Sauce Labs exposes some developers’ risky habits

A survey by Sauce Labs of 500 US-based developers has put the spotlight on some concerning practices.

One alarming discovery was the tendency of developers to push code to production without adequate testing. 67 percent of respondents admitted to this practice, jeopardising software quality, user experience, and system stability.

Additionally, 68 percent confessed to merging their own pull requests without review—raising concerns about potential security...

3 October 2023 | Artificial Intelligence

Mathew Payne, GitHub: Protecting code while nurturing user experience

Developer caught up with Mathew Payne, Principal Field Security Specialist at GitHub, to discuss the platform’s security strategies and how they aim to strike a balance between robustness and a seamless user experience.

At the heart of GitHub's security philosophy lies a commitment to safeguarding user code. Payne emphasised that a major focus is on securing the code created by both users and developers.

“The first thing that we focus on at GitHub is the security...

18 August 2023 | Development Tools

Malicious PyPI package discovered in ongoing ‘PaperPin’ campaign

In a recent analysis conducted by Sonatype, a malicious Python Package Index (PyPI) package named 'VMConnect' was discovered masquerading as the legitimate VMware vSphere connector module 'vConnector'.

The counterfeit package was found to contain sinister code designed to compromise users' systems. Further investigation revealed an ongoing campaign involving additional packages like "ethter" and "quantiumbase," all sharing the same structure and payload.

The 'VMConnect'...

4 August 2023 | Hacking & Security

Apple will require developers to explain their API use

In an effort to bolster user privacy and crack down on fingerprinting, Apple has announced that developers will soon be required to provide detailed explanations for their app's use of certain APIs before submitting them to the App Store.

The APIs in question are now classified as "required reason APIs," meaning developers must articulate the purpose of these APIs in their apps when submitting them for review. Currently, there are around 30 APIs to which the new rule...

28 July 2023 | App Stores

Checkmarx uncovers supply chain attacks targeting banking

Checkmarx has uncovered a new and sophisticated cyber threat targeting the banking sector.

The security testing firm's research team detected two distinct open-source software supply chain attacks targeting financial institutions. These attacks, which involved advanced techniques and deceptive tactics, have raised alarm bells among cybersecurity experts.

Attack one: NPM

The first attack occurred on April 5th and 7th when a threat actor exploited the NPM platform,...

21 July 2023 | Hacking & Security