SaaS & technology security news

A tidal wave of bug reports is overwhelming software vendors, exposing secure-by-design failures and creating disclosure bottlenecks.

In early August, GitGuardian researchers found that a recent Shai-Hulud infostealer worm variant had evolved to scan for credentials across 469 locations across developer environments, Continuous Integration/Continuous Deployment (CI/CD) tooling, cloud configurations, and even AI tool configs. Earlier variants of the infostealer worm only checked 189 paths. The jump says a lot. Attackers have

Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program. "The Fairwind Program gives high-priority defenders (like governments, healthcare providers, and telecommunications services) early access to advanced models that help them

Hosting software vendor tells customers to reset credentials and hunt for malicious packages

Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls

The European Telecommunications Standards Institute has launched an approval process for standards vendors will have to meet under the Cyber Resilience Act

Six npm packages queried an Ethereum wallet to locate C2 infrastructure

A new npm worm has compromised packages with over two billion monthly installs

Cloud and SaaS are now the preferred operating environments for threat actors, amid a continued shift to identity attacks