Software development is evolving at a breakneck pace, with developers under increasing pressure to deliver projects faster and more efficiently. As a result, they are turning to tools like StackOverflow, Unity Answers, Github, and AI-based tools like ChatGPT and Github co-pilot to reduce development time and improve efficiency. These AI-based tools improve developer efficiency, and […]
Category: open source security
Software composition analysis (SCA) tools are becoming increasingly popular for managing the security risks associated with open source software. These tools help identify and mitigate potential vulnerabilities and other security issues in open source components used to build applications. While many SCA tools focus on scanning the final built code, the importance of build-time scans […]
On Oct 25, 2022, The OpenSSL project announced a forthcoming release of OpenSSL (version 3.0.7) to address a critical security vulnerability. This release is now live. The last critical vulnerability in OpenSSL was released in 2016. Our security team has today added this vulnerability to the Threatrix vulnerability database. Vulnerability Details The OpenSSL project has marked this vulnerability as critical […]
Having researched the importance of securing your company’s intellectual property, you have started down the road towards what tools work best for securing it. Let’s look at the three most common tools companies should consider purchasing and where best to allocate your cybersecurity funds. The three most popular tools are SCA, SAST, and DAST. Software […]
Open-source software is in all software development, and we’ll see even more growth continue in 2022. Every industry vertical uses and develops open-source software, and all businesses are considered software companies. As a result of the pandemic, more businesses offer their products and services online or through apps. The increase in open source adoption and […]
The most critical challenge your organization faces when choosing a software composition analysis (SCA) vendor is understanding that some miss up to 60% of the open source, exposing your organization to security and licensing risks. We’re also seeing challenges surrounding the accuracy of the results. A vendor will find some open source but then mismatch […]
Keeping current with Log4j dependencies and new exploits is a complex and ongoing challenge. Organizations struggle to find the proverbial needle in hundreds of haystacks in a constantly changing environment. Then there is the issue of finding the right security tool to use across numerous applications and networks. Our Truematch technology gives us the unique […]
As a result of Log4Shell’s popularity and easy exploitability, its potentially severe impact is tremendous. What has emerged is not just how mainstream it is, but how deeply woven it is into the software we use, and how difficult it is to detect. Log4Shell Detection Because it is common across open source and third-party applications, […]
Log4Shell exploits are present in 17,000 unpatched Log4J packages in the Maven Central ecosystem, posing a significant supply-chain risk. Google security estimates that approximately 17,000 Java packages in the Maven Central repository are vulnerable to Log4j – and that it will take “years” for it to be fixed across the ecosystem. The Log4j bug impacts […]
According to two recent security research reports* on open source software, internally developed software contains up to 75% of open-source software. The report also concludes that open-source used within codebases contain on average 158 vulnerabilities and 60% of the codebases have ‘high risk’ open-source vulnerabilities that have been actively exploited. According to research, the three […]