Python is a programming language whose libraries, runtimes, and dependencies can introduce vulnerabilities into software and security tooling.
Search across headline titles and summaries.
Background for this topic.
Python is a high-level, general-purpose programming language used for applications, automation, data processing, and security tooling. Its reference implementation, CPython, includes a standard library, while third-party packages extend the language for web services, networking, and system administration. Python’s broad deployment means vulnerabilities can affect both the interpreter and widely used libraries.
Security concerns include flaws in Python or dependencies, malicious or compromised packages introduced through typosquatting or dependency confusion, and unsafe application behavior. For example, deserializing untrusted data with pickle, evaluating untrusted expressions with eval, or constructing shell commands from unchecked input can enable code execution. Practitioners should inventory transitive dependencies, pin and review versions, use trusted package sources and integrity checks, apply security updates, and run services with least privilege. Python is also commonly used to automate scanning, analysis, and response, so those scripts require the same access control, code review, and secret-handling discipline as other production software.
Wiz Research details flaws in Python backend that expose AI models and enable remote code execution Security researchers have lifted the lid on a chain of high-severity vulnerabilities that could lead to remote code execution (RCE) on Nvidia's Triton Inference Server.…
PXA Stealer pilfers data from nearly 40 browsers, including Chrome More than 4,000 victims across 62 countries have been infected by stealthy infostealers pilfering people's passwords, credit card numbers, and browser cookies, which are then sold to other criminals on Telegram-based marketplaces.…
Python-based PXA Stealer has stolen data from more than 4000 victims in over 62 countries, according to SentinalLabs
Cybersecurity researchers are calling attention to a new wave of campaigns distributing a Python-based information stealer called PXA Stealer