https://osmondvanhemert.nl/tags/cybersecurity/Recent content in Cybersecurity on Osmond van HemertHugo -- gohugo.ioen© Osmond van Hemert. All rights reserved.Thu, 30 Apr 2026 00:00:00 +0000https://osmondvanhemert.nl/posts/260430-pytorch-lightning-supply-chain-malware/Thu, 30 Apr 2026 00:00:00 +0000https://osmondvanhemert.nl/posts/260430-pytorch-lightning-supply-chain-malware/A Dune-themed malware campaign targeting the PyTorch Lightning library highlights how AI/ML supply chains are becoming prime targets for sophisticated attacks.https://osmondvanhemert.nl/posts/260409-xz-utils-supply-chain-anniversary/Thu, 09 Apr 2026 00:00:00 +0000https://osmondvanhemert.nl/posts/260409-xz-utils-supply-chain-anniversary/Nearly two years after the xz Utils backdoor shocked the open source world, the supply chain security landscape has changed — but not enough.https://osmondvanhemert.nl/posts/260312-supply-chain-security-slsa-adoption/Thu, 12 Mar 2026 00:00:00 +0000https://osmondvanhemert.nl/posts/260312-supply-chain-security-slsa-adoption/Supply chain security frameworks like SLSA and SBOM requirements are moving from recommendations to mandates. Here’s what developers need to know about the shifting landscape.https://osmondvanhemert.nl/posts/260115-nist-post-quantum-crypto-migration/Thu, 15 Jan 2026 00:00:00 +0000https://osmondvanhemert.nl/posts/260115-nist-post-quantum-crypto-migration/NIST’s post-quantum cryptography standards are finalized, and the migration timeline is no longer theoretical — it’s operational.https://osmondvanhemert.nl/posts/251218-ultralytics-supply-chain-attack/Thu, 18 Dec 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/251218-ultralytics-supply-chain-attack/A supply chain attack on the popular Ultralytics YOLO package highlights the persistent vulnerability of the Python ecosystem’s distribution pipeline.https://osmondvanhemert.nl/posts/251113-zero-day-treadmill-patch-tuesday/Thu, 13 Nov 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/251113-zero-day-treadmill-patch-tuesday/November’s Patch Tuesday brought critical zero-days being actively exploited, reminding us that patch management is still the unglamorous foundation of security.https://osmondvanhemert.nl/posts/251009-cisa-secure-by-design-traction/Thu, 09 Oct 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/251009-cisa-secure-by-design-traction/CISA’s Secure by Design initiative is moving from voluntary pledges to measurable industry impact, and software vendors are starting to feel the pressure.https://osmondvanhemert.nl/posts/250925-eu-chatcontrol-encryption-threat/Thu, 25 Sep 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/250925-eu-chatcontrol-encryption-threat/The EU’s latest push to scan encrypted messages reignites the fundamental debate about whether governments can mandate backdoors without destroying security for everyone.https://osmondvanhemert.nl/posts/250619-aws-reinforce-2025-ai-security/Thu, 19 Jun 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/250619-aws-reinforce-2025-ai-security/AWS re:Inforce 2025 puts AI workload security front and center, with new guardrails, identity controls, and data protection features that signal where cloud security is headed.https://osmondvanhemert.nl/posts/250605-npm-supply-chain-security-lessons/Thu, 05 Jun 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/250605-npm-supply-chain-security-lessons/Another wave of malicious npm packages reminds us that JavaScript’s dependency ecosystem remains one of software’s biggest security challenges.https://osmondvanhemert.nl/posts/250424-spring-2025-exploit-wave-fortinet-ivanti/Thu, 24 Apr 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/250424-spring-2025-exploit-wave-fortinet-ivanti/A surge of active exploitation targeting Fortinet and Ivanti edge devices highlights the persistent vulnerability of network perimeter infrastructure.https://osmondvanhemert.nl/posts/250327-ingress-nightmare-kubernetes-vulnerability/Thu, 27 Mar 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/250327-ingress-nightmare-kubernetes-vulnerability/CVE-2025-1974 and related vulnerabilities in the Kubernetes ingress-nginx controller allow unauthenticated remote code execution, affecting an estimated 40% of Kubernetes clusters.https://osmondvanhemert.nl/posts/250313-github-actions-supply-chain-attack/Thu, 13 Mar 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/250313-github-actions-supply-chain-attack/A compromised GitHub Action exposed secrets from thousands of repositories, highlighting how CI/CD pipelines have become prime targets for supply chain attacks.https://osmondvanhemert.nl/posts/250227-kubernetes-container-security-hardening/Thu, 27 Feb 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/250227-kubernetes-container-security-hardening/With Kubernetes pushing security features to GA and CISA issuing container hardening guidance, the container ecosystem is growing up on security. Here’s what matters for platform teams.https://osmondvanhemert.nl/posts/250102-salt-typhoon-treasury-breach/Thu, 02 Jan 2025 00:00:00 +0000https://osmondvanhemert.nl/posts/250102-salt-typhoon-treasury-breach/The Chinese state-sponsored Salt Typhoon campaign breached the US Treasury Department, exposing how even the most security-conscious organizations remain vulnerable.https://osmondvanhemert.nl/posts/241219-salt-typhoon-telecom-hack/Thu, 19 Dec 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/241219-salt-typhoon-telecom-hack/The Salt Typhoon campaign has compromised major US telecoms at a staggering scale. What developers and architects need to understand about this ongoing threat.https://osmondvanhemert.nl/posts/241114-salt-typhoon-telecom-breach/Thu, 14 Nov 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/241114-salt-typhoon-telecom-breach/The Salt Typhoon campaign has compromised major US telecom providers, exposing the fragility of critical infrastructure and the growing sophistication of state-sponsored cyber operations.https://osmondvanhemert.nl/posts/240926-cups-vulnerability-linux-printing-security/Thu, 26 Sep 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240926-cups-vulnerability-linux-printing-security/A chain of vulnerabilities in CUPS, the Linux printing system, enables remote code execution — and highlights how forgotten infrastructure becomes a security liability.https://osmondvanhemert.nl/posts/240815-nist-post-quantum-cryptography/Thu, 15 Aug 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240815-nist-post-quantum-cryptography/NIST has published its first three finalized post-quantum cryptography standards. Here’s what developers need to know and do.https://osmondvanhemert.nl/posts/240718-crowdstrike-global-outage/Thu, 18 Jul 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240718-crowdstrike-global-outage/A faulty CrowdStrike Falcon sensor update has caused one of the largest IT outages in history, bricking millions of Windows machines worldwide.https://osmondvanhemert.nl/posts/240704-regresshion-openssh-vulnerability/Thu, 04 Jul 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240704-regresshion-openssh-vulnerability/CVE-2024-6387 reveals a critical remote code execution flaw in OpenSSH, and it’s a regression from a fix made back in 2006.https://osmondvanhemert.nl/posts/240627-polyfill-io-supply-chain-attack/Thu, 27 Jun 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240627-polyfill-io-supply-chain-attack/The polyfill.io domain was acquired by a Chinese company and began injecting malware into over 100,000 websites, exposing fundamental weaknesses in how we trust third-party CDN dependencies.https://osmondvanhemert.nl/posts/240613-microsoft-recall-delayed-security/Thu, 13 Jun 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240613-microsoft-recall-delayed-security/Microsoft pulls Windows Recall from the upcoming Copilot+ PC launch after security researchers demonstrate alarming vulnerabilities in the feature’s data storage.https://osmondvanhemert.nl/posts/240502-rsa-conference-2024-ai-security/Thu, 02 May 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240502-rsa-conference-2024-ai-security/RSA Conference 2024 kicks off in San Francisco with AI dominating every conversation. But beneath the marketing buzz, there are real security challenges emerging that practitioners need to face.https://osmondvanhemert.nl/posts/240328-xz-utils-backdoor-cve-2024-3094/Thu, 28 Mar 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240328-xz-utils-backdoor-cve-2024-3094/A sophisticated supply chain attack via the xz Utils compression library was caught just days before reaching stable Linux distributions.https://osmondvanhemert.nl/posts/240222-lockbit-takedown-operation-cronos/Thu, 22 Feb 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240222-lockbit-takedown-operation-cronos/An international law enforcement coalition takes down the LockBit ransomware group’s infrastructure in a landmark operation.https://osmondvanhemert.nl/posts/240125-jenkins-cve-2024-23897-cicd-security/Thu, 25 Jan 2024 00:00:00 +0000https://osmondvanhemert.nl/posts/240125-jenkins-cve-2024-23897-cicd-security/A critical Jenkins vulnerability allows arbitrary file reads through the CLI. Here’s why this matters more than your typical CVE and what it reveals about CI/CD security.https://osmondvanhemert.nl/posts/231221-terrapin-ssh-attack-vulnerability/Thu, 21 Dec 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/231221-terrapin-ssh-attack-vulnerability/Researchers disclose the Terrapin attack against SSH, demonstrating that even our most trusted protocols can harbor subtle cryptographic weaknesses.https://osmondvanhemert.nl/posts/231116-icbc-lockbit-ransomware-attack/Thu, 16 Nov 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/231116-icbc-lockbit-ransomware-attack/The LockBit ransomware attack on ICBC’s US operations disrupted Treasury market trading and exposed critical vulnerabilities in financial infrastructure.https://osmondvanhemert.nl/posts/231012-http2-rapid-reset-attack/Thu, 12 Oct 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/231012-http2-rapid-reset-attack/CVE-2023-44487 exploits a fundamental aspect of HTTP/2 to enable record-breaking DDoS attacks. Here’s what you need to know and do.https://osmondvanhemert.nl/posts/230921-mgm-resorts-social-engineering-attack/Thu, 21 Sep 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230921-mgm-resorts-social-engineering-attack/The MGM Resorts cyberattack that started with a phone call is a stark reminder that the most sophisticated defenses can be undone by human vulnerability.https://osmondvanhemert.nl/posts/230803-intel-downfall-cpu-vulnerability/Thu, 03 Aug 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230803-intel-downfall-cpu-vulnerability/A new Intel CPU vulnerability called Downfall exposes sensitive data through speculative execution, and the performance impact of mitigations is significant.https://osmondvanhemert.nl/posts/230629-moveit-breach-supply-chain-security/Thu, 29 Jun 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230629-moveit-breach-supply-chain-security/The MOVEit Transfer vulnerability has now impacted hundreds of organizations worldwide — a stark reminder that managed file transfer tools remain critical and under-secured attack surfaces.https://osmondvanhemert.nl/posts/230601-moveit-zero-day-supply-chain-nightmare/Thu, 01 Jun 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230601-moveit-zero-day-supply-chain-nightmare/A critical zero-day in Progress MOVEit Transfer is being actively exploited, and the scope of the damage is still emerging.https://osmondvanhemert.nl/posts/230504-google-passkeys-passwords-future/Thu, 04 May 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230504-google-passkeys-passwords-future/Google enables passkey sign-in for all Google Accounts, marking the most significant push yet toward a passwordless future built on FIDO2 and WebAuthn.https://osmondvanhemert.nl/posts/230427-samsung-chatgpt-data-leak/Thu, 27 Apr 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230427-samsung-chatgpt-data-leak/Samsung employees accidentally leaked proprietary source code and meeting notes via ChatGPT, exposing the urgent need for enterprise AI usage policies.https://osmondvanhemert.nl/posts/230406-italy-chatgpt-ban-gdpr/Thu, 06 Apr 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230406-italy-chatgpt-ban-gdpr/Italy’s data protection authority blocks ChatGPT over GDPR concerns, setting a precedent for how AI services will navigate European privacy law.https://osmondvanhemert.nl/posts/230330-italy-bans-chatgpt-gdpr-ai-collision/Thu, 30 Mar 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230330-italy-bans-chatgpt-gdpr-ai-collision/Italy’s data protection authority blocks ChatGPT over GDPR concerns, raising questions every company building with AI needs to answer.https://osmondvanhemert.nl/posts/230309-us-national-cybersecurity-strategy-2023/Thu, 09 Mar 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230309-us-national-cybersecurity-strategy-2023/The Biden administration’s new cybersecurity strategy shifts liability toward software vendors, and developers need to pay attention.https://osmondvanhemert.nl/posts/230202-esxiargs-ransomware-vmware-esxi/Thu, 02 Feb 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230202-esxiargs-ransomware-vmware-esxi/A massive ransomware campaign is exploiting a two-year-old VMware ESXi vulnerability, and the scale of unpatched systems is alarming.https://osmondvanhemert.nl/posts/230105-circleci-security-incident/Thu, 05 Jan 2023 00:00:00 +0000https://osmondvanhemert.nl/posts/230105-circleci-security-incident/CircleCI discloses a security incident and urges all customers to immediately rotate secrets stored in the platform. A reminder of the risks in our CI/CD supply chain.https://osmondvanhemert.nl/posts/221222-lastpass-breach-vault-data/Thu, 22 Dec 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/221222-lastpass-breach-vault-data/LastPass reveals attackers obtained copies of customer vault data, turning an already serious breach into one of the worst password manager incidents in history.https://osmondvanhemert.nl/posts/221215-log4shell-one-year-later/Thu, 15 Dec 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/221215-log4shell-one-year-later/A year after Log4Shell shook the software industry, we examine what’s improved in supply chain security — and what still keeps us up at night.https://osmondvanhemert.nl/posts/221103-openssl-critical-vulnerability-response/Thu, 03 Nov 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/221103-openssl-critical-vulnerability-response/The OpenSSL 3.0.7 patch for CVE-2022-3602 and CVE-2022-3786 arrived this week — here’s what happened and what it teaches us about vulnerability response.https://osmondvanhemert.nl/posts/220915-uber-breach-social-engineering/Thu, 15 Sep 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220915-uber-breach-social-engineering/A teenager allegedly breached Uber’s internal systems through social engineering and MFA fatigue, exposing fundamental weaknesses in how we think about authentication.https://osmondvanhemert.nl/posts/220804-twilio-phishing-breach/Thu, 04 Aug 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220804-twilio-phishing-breach/Twilio’s breach through a sophisticated phishing attack targeting employees raises hard questions about SMS-based authentication and supply chain trust.https://osmondvanhemert.nl/posts/220707-cloudflare-mantis-record-ddos/Thu, 07 Jul 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220707-cloudflare-mantis-record-ddos/Cloudflare mitigated the largest HTTPS DDoS attack ever recorded at 26 million requests per second. The Mantis botnet represents a new generation of volumetric threats.https://osmondvanhemert.nl/posts/220602-follina-zero-day-msdt/Thu, 02 Jun 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220602-follina-zero-day-msdt/CVE-2022-30190, dubbed Follina, exploits Microsoft’s diagnostic tool through Office documents — no macros required.https://osmondvanhemert.nl/posts/220421-heroku-security-breach-supply-chain/Thu, 21 Apr 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220421-heroku-security-breach-supply-chain/Heroku’s OAuth token breach exposes the fragile trust chain in platform-as-a-service dependencies and what it means for developers.https://osmondvanhemert.nl/posts/220331-spring4shell-cve-2022-22965/Thu, 31 Mar 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220331-spring4shell-cve-2022-22965/A critical RCE vulnerability in Spring Framework has the internet in panic mode, but the actual risk profile is more nuanced than the Log4Shell comparisons suggest.https://osmondvanhemert.nl/posts/220324-lapsus-group-okta-microsoft-breach/Thu, 24 Mar 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220324-lapsus-group-okta-microsoft-breach/The Lapsus$ hacking group has breached both Okta and Microsoft, exposing critical weaknesses in identity provider security and third-party access management.https://osmondvanhemert.nl/posts/220317-node-ipc-protestware-supply-chain/Thu, 17 Mar 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220317-node-ipc-protestware-supply-chain/A popular npm package was deliberately sabotaged by its own maintainer, raising urgent questions about supply chain trust in open source.https://osmondvanhemert.nl/posts/220224-hermeticwiper-ukraine-cyber-warfare/Thu, 24 Feb 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220224-hermeticwiper-ukraine-cyber-warfare/As conflict erupts in Ukraine, destructive wiper malware targeting critical infrastructure signals a new chapter in state-sponsored cyber operations.https://osmondvanhemert.nl/posts/220217-alpha-omega-open-source-security/Thu, 17 Feb 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220217-alpha-omega-open-source-security/The Linux Foundation’s new Alpha-Omega Project, backed by Google and Microsoft, aims to systematically improve the security of critical open source software.https://osmondvanhemert.nl/posts/220113-white-house-open-source-security-summit/Thu, 13 Jan 2022 00:00:00 +0000https://osmondvanhemert.nl/posts/220113-white-house-open-source-security-summit/The White House convened tech leaders to address open source security after Log4Shell. Here’s what was discussed and what it means for developers.https://osmondvanhemert.nl/posts/211216-software-supply-chain-security-after-log4j/Thu, 16 Dec 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/211216-software-supply-chain-security-after-log4j/A week after Log4Shell, the patching chaos continues. But the bigger lesson is about software supply chain security and why we need SBOMs now.https://osmondvanhemert.nl/posts/211209-log4shell-zero-day/Thu, 09 Dec 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/211209-log4shell-zero-day/A critical remote code execution vulnerability in Apache Log4j has sent the entire industry scrambling. Here’s what you need to know and do right now.https://osmondvanhemert.nl/posts/211111-npm-coa-rc-supply-chain-attacks/Thu, 11 Nov 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/211111-npm-coa-rc-supply-chain-attacks/Popular npm packages coa and rc were hijacked to distribute malware, impacting thousands of projects and raising urgent questions about supply chain security.https://osmondvanhemert.nl/posts/211021-ua-parser-js-npm-supply-chain-attack/Thu, 21 Oct 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/211021-ua-parser-js-npm-supply-chain-attack/The popular ua-parser-js npm package was hijacked to deliver cryptominers and credential stealers, affecting millions of weekly downloads.https://osmondvanhemert.nl/posts/210923-owasp-top-10-2021-update/Thu, 23 Sep 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210923-owasp-top-10-2021-update/The OWASP Top 10 gets its first update since 2017, and the changes reflect how fundamentally our attack surface has evolved.https://osmondvanhemert.nl/posts/210916-azure-omigod-vulnerability-cloud-agents/Thu, 16 Sep 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210916-azure-omigod-vulnerability-cloud-agents/The OMIGOD vulnerabilities in Azure’s silently-installed OMI agent expose a troubling pattern: cloud providers deploying software on your VMs without your knowledge or consent.https://osmondvanhemert.nl/posts/210902-confluence-rce-cve-2021-26084/Thu, 02 Sep 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210902-confluence-rce-cve-2021-26084/The critical Confluence Server RCE vulnerability is being actively exploited in the wild, raising urgent questions about the sustainability of self-hosted enterprise software.https://osmondvanhemert.nl/posts/210819-tmobile-data-breach-api-security/Thu, 19 Aug 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210819-tmobile-data-breach-api-security/The T-Mobile breach exposing 40+ million records highlights systemic failures in API security and data protection that the entire industry needs to address.https://osmondvanhemert.nl/posts/210715-pegasus-spyware-zero-click-exploits/Thu, 15 Jul 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210715-pegasus-spyware-zero-click-exploits/The Pegasus Project revelations expose industrial-grade zero-click exploits targeting journalists and activists — and raise uncomfortable questions about software supply chains.https://osmondvanhemert.nl/posts/210708-kaseya-vsa-supply-chain-ransomware/Thu, 08 Jul 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210708-kaseya-vsa-supply-chain-ransomware/The REvil ransomware group exploited Kaseya’s VSA platform to hit over 1,500 businesses simultaneously. This is what supply chain attacks look like at scale.https://osmondvanhemert.nl/posts/210506-colonial-pipeline-ransomware/Thu, 06 May 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210506-colonial-pipeline-ransomware/The Colonial Pipeline ransomware attack exposes how deeply intertwined our digital infrastructure has become with physical systems we take for granted.https://osmondvanhemert.nl/posts/210415-codecov-supply-chain-attack/Thu, 15 Apr 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210415-codecov-supply-chain-attack/Codecov’s compromised Bash Uploader script exposed CI/CD secrets for thousands of organizations, highlighting a systemic weakness in how we trust third-party tools in our build pipelines.https://osmondvanhemert.nl/posts/210401-php-git-server-compromise/Thu, 01 Apr 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210401-php-git-server-compromise/Attackers pushed malicious commits to PHP’s official Git repository, exposing the fragile trust model behind open-source supply chains.https://osmondvanhemert.nl/posts/210304-microsoft-exchange-hafnium-zero-day/Thu, 04 Mar 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210304-microsoft-exchange-hafnium-zero-day/Four zero-day vulnerabilities in Microsoft Exchange Server are being actively exploited at scale, and the fallout is only beginning.https://osmondvanhemert.nl/posts/210225-python-392-security-release/Thu, 25 Feb 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210225-python-392-security-release/Python’s latest security releases fix critical vulnerabilities and highlight the increasingly professional security posture of the Python ecosystem.https://osmondvanhemert.nl/posts/210211-solarwinds-supply-chain-security/Thu, 11 Feb 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210211-solarwinds-supply-chain-security/Three months after the SolarWinds breach disclosure, the full scope is still unfolding and the implications for software supply chain security demand fundamental changes in how we build and deploy software.https://osmondvanhemert.nl/posts/210121-signal-surge-whatsapp-privacy/Thu, 21 Jan 2021 00:00:00 +0000https://osmondvanhemert.nl/posts/210121-signal-surge-whatsapp-privacy/WhatsApp’s updated privacy policy drives millions to Signal, highlighting the growing demand for privacy-respecting open-source alternatives.https://osmondvanhemert.nl/posts/201217-solarwinds-supply-chain-attack/Thu, 17 Dec 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/201217-solarwinds-supply-chain-attack/The SolarWinds supply chain attack is a watershed moment for software security — and it has profound implications for how we build, ship, and trust code.https://osmondvanhemert.nl/posts/201210-fireeye-breach-red-team-tools/Thu, 10 Dec 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/201210-fireeye-breach-red-team-tools/FireEye discloses that sophisticated attackers stole their red team tools. The implications for the security industry — and every organization using those tools — are serious.https://osmondvanhemert.nl/posts/201022-nsa-cisa-china-advisory/Thu, 22 Oct 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/201022-nsa-cisa-china-advisory/A joint NSA/CISA advisory details 25 CVEs actively exploited by Chinese state-sponsored actors. The uncomfortable truth: most are well-known and patchable.https://osmondvanhemert.nl/posts/200910-zerologon-cve-2020-1472/Thu, 10 Sep 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/200910-zerologon-cve-2020-1472/CVE-2020-1472, dubbed Zerologon, scores a perfect 10.0 CVSS and allows full domain takeover with a handful of packets. Here’s what you need to know.https://osmondvanhemert.nl/posts/200716-twitter-bitcoin-hack-social-engineering/Thu, 16 Jul 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/200716-twitter-bitcoin-hack-social-engineering/The massive Twitter compromise that hit Barack Obama, Elon Musk, and Apple wasn’t a sophisticated zero-day — it was social engineering targeting internal tools. That’s the scary part.https://osmondvanhemert.nl/posts/200618-iot-growth-pandemic-security/Thu, 18 Jun 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/200618-iot-growth-pandemic-security/Home IoT device sales have surged during lockdowns, and every one of those devices just joined a corporate network via VPN. The security implications are significant.https://osmondvanhemert.nl/posts/200611-cicd-pipeline-security-remote-work/Thu, 11 Jun 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/200611-cicd-pipeline-security-remote-work/As teams rushed to enable remote development workflows, CI/CD pipelines became a prime target. Here’s what’s going wrong and how to harden your build infrastructure.https://osmondvanhemert.nl/posts/200430-apple-google-exposure-notification-api/Thu, 30 Apr 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/200430-apple-google-exposure-notification-api/Apple and Google collaborate on a Bluetooth-based exposure notification system that puts privacy-preserving architecture front and center.https://osmondvanhemert.nl/posts/200326-zoom-security-crisis/Thu, 26 Mar 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/200326-zoom-security-crisis/Zoom’s explosive pandemic-driven growth is exposing serious security and privacy issues. The ‘Zoombombing’ phenomenon is just the tip of the iceberg.https://osmondvanhemert.nl/posts/200213-cia-crypto-ag-backdoor/Thu, 13 Feb 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/200213-cia-crypto-ag-backdoor/The Washington Post reveals the CIA secretly owned Crypto AG for decades, selling compromised encryption to governments worldwide. The supply chain trust implications are staggering.https://osmondvanhemert.nl/posts/200109-nsa-cve-2020-0601-windows-cryptoapi/Thu, 09 Jan 2020 00:00:00 +0000https://osmondvanhemert.nl/posts/200109-nsa-cve-2020-0601-windows-cryptoapi/The NSA disclosed CVE-2020-0601, a critical vulnerability in Windows CryptoAPI’s certificate validation. The fact that they reported it instead of hoarding it marks a notable shift.