Third-party code

Online developer community Stack Overflow has been leveraged to facilitate the distribution of a malicious Python Package Index package containing cryptocurrency-stealing malware, reports The Hacker News.

San Francisco-based c/side has emerged from stealth mode with $1.7 million in funding to develop cybersecurity solutions targeting vulnerabilities in third-party scripts used within web browsers, reports Tech Funding News.

The Open Source Security Foundation has unveiled the new Siren threat intelligence sharing list that seeks to facilitate real-time information sharing regarding security flaws impacting open source projects, reports The Register.

Organizations must make software supply chain security a collaborative effort where everyone on the development team gets involved.

Ongoing intrusions targeting GitLab instances impacted by the maximum severity account takeover vulnerability, tracked as CVE-2023-7028, have prompted the flaw's inclusion in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, with federal agencies urged to remediate the security issue by May 22, reports BleepingComputer.

SiliconAngle reports that leading open network detection and response startup Corelight has landed $150 million from a Series E funding round.

SecurityWeek reports that online open-source service Judge0 used for arbitrary code execution within a sandbox has been impacted by three critical vulnerabilities, which could be leveraged to facilitate sandbox escapes, privilege escalation, and system takeovers.

More than three million of 4.79 imageless repositories uploaded to Docker Hub over the past five years have been leveraged to target the container registry's users in three separate malicious campaigns, reports The Hacker News.