Third-party code

Compromised accounts were used to push malicious GitHub Actions workflows.

Go module works as advertised as a brute-force tool while secretly exfiltrating credentials.

The flaw could allow an unauthenticated attacker to read any file, including wp-config.php.

While not confirmed, security pros say the attack resembles recent attacks on airlines and retailers by Scattered Spider.

Incident underscores impact of third-party breaches on health organizations, security experts say.

Picking over code doesn’t guarantee problem-free software. Only automated scans that analyze first- and third-party code can provide the total visibility required to comply with the CRA and other new digital-security regulations.