Security news aggregator

Latest coverage for Open Source

Open-source software enables code review and reuse, but known vulnerabilities and unmaintained dependencies can create cybersecurity risks.

3 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

Open source is software whose source code is available under a license that permits use, inspection, modification, and redistribution. It may be developed by a community, an organization, or a small group of maintainers; “open” does not guarantee that the code is actively reviewed, supported, or secure.

For security teams, the main concerns are vulnerabilities in dependencies and the software supply chain: a maintainer account, release process, or package can be compromised, while an unmaintained component may retain known flaws. Public code can enable review and faster fixes, but visibility alone is not a control. Maintain an inventory or SBOM of open-source components, pin and verify versions or signatures where possible, monitor vulnerability advisories, and apply updates through a controlled process.

Showing 3 most recent headlines Filtered view
Bank Info Security 1 year, 6 months ago

Veracode Fuels Supply Chain Security With Phylum Acquisition

Phylum's Product Delivers Real-Time Detection of Malicious Open-Source PackagesTo combat the rise in software supply chain attacks, Veracode has acquired Denver-area startup Phylum and its advanced tools to detect malicious open-source packages. The acquisition strengthens Veracode's software composition analysis offering and enables faster, more reliable threat mitigation.

Bank Info Security 8 Jan 2025, 9:30 p.m. Acquisition Mitigation Open Source Startup Supply Chain
Bank Info Security 1 year, 6 months ago

Veracode Boosts Supply Chain Security Via Phylum Acquisition

Phylum's Product Delivers Real-Time Detection of Malicious Open-Source PackagesTo combat the rise in software supply chain attacks, Veracode has acquired Denver-area startup Phylum and its advanced tools to detect malicious open-source packages. The purchase strengthens Veracode's software composition analysis offering and enables faster, more reliable threat mitigation.

Bank Info Security 8 Jan 2025, 12:30 p.m. Acquisition Mitigation Open Source Startup Supply Chain
Bank Info Security 1 year, 6 months ago

Nuclei Patches High Severity Flaw in Security Tool

Flaw Enabled Signature Bypassing on Nuclei ProjectDiscoveryOpen-source vulnerability scanner Nuclei patched a critical flaw in its open-source vulnerability management tool ProjectDiscovery. Security firm Wiz uncovered the flaw, a signature verification system flaw that could allow attackers to execute malicious code using custom code templates.

Bank Info Security 7 Jan 2025, 9:00 a.m. Critical Vulnerability Flaw Malicious Code Open Source Patch Vulnerability Vulnerability Management