Third-party code

Third-party risk may be unavoidable, but it is manageable. Here’s a 15-point checklist to help minimize the risks you run from working with vendors, services and suppliers. Download the infographicDownload

SecurityWeek reports that organizations have been conducting complete security reviews on only 54% of major application code changes.

A GitHub Actions workflow could have been used for a command injection vulnerability in Bazel, which had the potential for threat actors to add malicious code into the production environment for projects using the Google open-source product.

Numerous cybersecurity researchers have already released their proof-of-concept exploits for a critical vulnerability impacting open-source automation server Jenkins on GitHub, reports BleepingComputer.

Supply chain attacks possible with TensorFlow CI/CD misconfigurations TensorFlow instances on GitHub and PyPi could have been subjected to supply chain attacks involving the exploitation of continuous integration and continuous delivery vulnerabilities within the open-source machine learning framework, reports The Hacker News.

BleepingComputer reports that more than 6,700 WordPress sites leveraging Popup Builder plugin vulnerable to the cross-site scripting bug, tracked as CVE-2023-6000, have been compromised in a new Balada Injector campaign that commenced last month.

Could threat actors leverage “dependency hell” to exploit open-source software repositories?

Healthcare security came under scrutiny in 2023, and supply-chain attacks became all too common.