Black Duck
Get expert insights from the Black Duck software and application security blog. Explore topics from DevOps security, software news, analysis, intel and more.
- Posts
- 847 from 31 Mar 2004 to 29 Oct 2026
- Posting
- weekly (68 in the last year)
- Kind
- company blog
- Feed
- https://www.blackduck.com/feed
2026 61
- The security team’s guide to SBOM investigation with AI
- Introducing Signal Agentic Fix: Your 24×7 remediation team
- How to get Mythos-ready: Find, prioritize, and fix risk faster
- PHP2Shell: How to find and fix your exposure with SCA
- Polaris release update: Deeper detection, remediation you control, scanning wherever you work
- Improve collaboration with Defensics multiuser deployment
- The reality of using LLMs to identify open source risk: Helpful though limited
- Polaris release update: Bringing AI security findings, scan governance, and remediation together
- Top 10 free penetration testing tools
- The real and hidden costs of AI security programs
- Agentic AppSec on your infrastructure with Black Duck Signal
- The vulnerability you didn’t write
- Stories from the field, part 2: When vulnerability scores don’t tell the whole story
- OSSRA 2026: Open source vulnerability counts doubled year-over-year
- Polaris release update: Two-way bug tracker sync, AI-assisted fixes, scanning you can govern
- Polestar’s U.S. market exit is a warning for automakers
- The AI coding security gap: Why faster development demands stronger guardrails
- AI application security needs both reasoning and assurance
- The hidden liabilities in open source AI model adoption
- Countdown to the next EU CRA milestone
- Polaris achieves TX-RAMP certification: A milestone in our public sector commitment
- Polaris release update: Smarter risk scoring, AI-assisted triage, and complete container coverage
- What your scanner can’t see: Deep visibility into hardened container images with Black Duck
- What open source scans don’t see in M&A due diligence: stories from the field
- Black Duck named a Leader in the first-ever Gartner Magic Quadrant for Software Supply Chain Security
- From commit to confidence: Black Duck for Bitbucket
- Why the future of application security isn’t AI or SAST—it’s both
- Key deadlines and reporting requirements for the EU Cyber Resilience Act (CRA)
- Polaris release update: Automated remediation, reachability-driven prioritization, and deeper scanning coverage
- Why LLM API keys should be treated like tier‑zero secrets
- Beyond the noise: Better risk prioritization with Polaris reachability analysis
- Polaris release update: Expanded integrations, deeper detection, complete license governance
- Prompt injection: Can a fifth grader steal your data?
- Leading organizations address growing regulatory pressures with automation
- NVD Changes 2026: Why public vulnerability data is no longer enough
- Catch critical defects before embedded software ships
- Polaris release update: Streamlined workflows, stronger governance, smarter detection
- What Anthropic’s Project Glasswing means for software builders
- The third wave of application security: How AI is reshaping AppSec at scale
- Strange but true software licenses: No foolin’
- Decoding AI-enabled dev: Top concerns, hidden benefits, and smart investment strategies
- Coverity Connect Vulnerability Notification
- Black Duck Signal: Security that moves at the speed of AI
- AI is rewriting the rules of application security—and most organizations aren’t ready
- The importance of software quality audits during M&A due diligence: Stories from the field
- Feedback through agents: Moving beyond verdict‑only instrumentation
- Unlimited test cases: The power of generative fuzzing
- Guided by feedback: Smarter fuzzing with Defensics
- Beyond Confidence: Grounding Your AI Security Strategy in Reality
- Software governance in the AI era: Key findings from the 2026 OSSRA report
- Evaluating AI powered applications: A new frontier for M&A software due diligence
- The Olympics: A digital battleground where prevention is the best defense
- Event-driven AppSec is here: Thoughtful automation finds risk earlier
- The BSIMM16 report: What today’s software security programs are really doing—and why it matters
- Navigating the AI frontier: Risks, benefits, and uncharted territory in code development
- Navigating the AI security era: Key trends for software leaders in 2026
- Understanding generative AI risks in software development
- CyRC Advisory: High-severity vulnerability in TP-Link Archer BE400
- Key learnings from the latest CyRC Wi-Fi vulnerabilities
- CyRC advisory: Vulnerability in Broadcom chipset causes network disruption and client disconnection on wireless routers
- Vibe coding and its implications
2025 55
- AI coding security gap: 76% of orgs expose software supply chain to risk
- Bridging the divide: Why friction between dev and security persists (and how to fix it)
- The hidden costs of technical debt in M&A due diligence
- Introducing Black Duck Signal: Agentic AI that solves the noise crisis in application security
- Embracing AI in embedded software development: A balanced approach
- Vibe coding with a conscience: Why security must be in the mix
- Black Duck SCA takes on AI: Securing the future of software with model scanning
- Black Duck’s product release round-up: faster fixes, smarter security
- Making intelligent tradeoffs in software due diligence
- Scaling authenticated DAST with multimodal LLMs and vault-backed credentials
- Black Duck named a Leader in the 2025 Gartner Magic Quadrant for Application Security Testing for the eighth time
- AI in DevSecOps: A critical crossroads for security and risk management
- Polaris redefines application security: New release brings unmatched visibility, automation, and compliance
- What’s new in Polaris fAST Dynamic: AI-assisted authentication with expanded coverage and faster onboarding
- The next frontier in AppSec: Context-aware risk scoring
- The Shai-Hulud npm malware attack: A wake-up call for supply chain security
- From diligence to integration: How software audits inform post-close M&A strategies
- Get the best from AI in software development without risking the worst
- The recent npm supply chain attack: Lessons in securing your software dependencies
- Contextualizing risk in the AI era
- Key findings from “The State of Embedded Software Quality and Safety 2025” report
- Accelerate onboarding and testing of GitHub repos with the Black Duck Security app
- Addressing the hidden risks of AI coding tools
- Software due diligence: The home inspection of tech M&A
- Once and future code snippets: How AI reignites risk
- What you need to know about the NIST Secure Software Development Framework
- Black Duck Assist: AI code security assistance in your IDE
- The Importance of a Third-Party Due Diligence Perspective on Code Risk
- Faster, Smarter Vulnerability Alerts: AI in Black Duck Security Advisories
- Unlocking the full potential of application security: Key findings from the Black Duck customer value study
- Key takeaways from the “2024 Software Vulnerability Snapshot” report
- Navigating the EU Cyber Resilience Act
- The Black Duck Way: Strong culture drives leadership
- Understanding Section 524B of the FD&C Act
- Scaling application security across borders: Black Duck Polaris Platform empowers Saudi Arabian enterprises with in-region SaaS hosting
- Beyond detection: Understanding vulnerability reachability in SCA
- Remain code-compliant in a regulated, AI-powered world
- Detecting compromised source code using Rapid Scan Static’s Malicious URLs feature
- Black Duck named a 2025 Intellyx Digital Innovator Award winner
- Transitive dependencies are exponentially increasing open source software risk
- Three steps to ensuring the reliability and security of your C++ projects
- Q&A: What You Need to Know About Open Source Software Risk in 2025
- How to build reliability into developer workflows without slowing down
- A decade of open source risk: Reflecting on 10 years of OSSRA report insights
- How to secure AI-generated code with DevSecOps best practices
- AI avalanche: Taming software risk with True Scale Application Security
- The 2025 OSSRA report uncovers answers to common open source questions
- AI-driven security: How AI is revolutionizing cybersecurity management
- Top open source licenses and legal risk for developers
- CyRC Advisory: Eight vulnerabilities discovered in LogicalDOC
- Understanding the DeepSeek model license: Balancing openness and responsibility
- Analyze AI-Generated Code with the Black Duck Snippet API
- Security automation and integration can smooth AppSec friction
- BSIMM15: New focus on securing AI and the software supply chain
- Overcome AST noise to find and fix software vulnerabilities
2024 56
- CyRC Vulnerability Advisory: CVE-2024-11144 Race condition with LightFTP
- Artificial intelligence widens the gap between security and development
- Forrester recognizes Black Duck as a Leader in software composition analysis
- Software Vulnerability Snapshot Report Findings
- Major changes and challenges of PCI DSS 4.0
- Addressing cloud-native app development challenges with scalable security tools
- Faster, better, stronger application security for developers in the IDE
- Key insights from Black Duck’s 2024 Global State of DevSecOps report
- Black Duck takes flight
- A new identity for the Synopsys Software Integrity Group
- Why penetration testing needs to be part of your IoT security
- A pragmatic guide to getting started with ASPM
- SSDF BSIMM mapping updated for BSIMM14
- Is AI-generated code secure? Maybe. Maybe not.
- CyRC Vulnerability Advisory: CVE-2024-5184s prompt injection in EmailGPT service
- CyRC Vulnerability Advisory: CVE-2024-5185 Data Poisoning Vulnerability in EmbedAI Application
- The changing face of software supply chain security risk
- Clearlake Capital Group and Francisco Partners reach agreement to purchase the Software Integrity Group
- Accelerate application code fixes with AI-powered Polaris Assist
- Building a software Bill of Materials with Black Duck
- Understanding Python pickling and how to use it securely
- Solving telecom network security challenges with Defensics
- Securing the software supply chain with Black Duck Supply Chain Edition
- Managing risk at scale
- What is the Xz Utils Backdoor : Everything you need to know about the supply chain attack
- SANS report: Securing the shifting landscape of application development
- How to detect, prevent, and mitigate buffer overflow attacks
- Guide to updating from NIST CSF 1.1 to 2.0
- 4 approaches to vulnerability remediation
- AppSec Decoded: Open source trends uncovered in the 2024 OSSRA report
- CyRC Vulnerability Advisory: CVE-2023-7060 Missing Security Control in Zephyr OS IP Packet Handling
- Five types of software licenses you need to understand
- Introducing fAST Dynamic: Streamlining dynamic application security testing
- 2024 OSSRA report: Open source license compliance remains problematic
- Six Python security best practices for developers
- SAST vs. DAST: What’s the best method for application security testing?
- Considerations before moving away from native apps
- What is a software bill of materials?
- CVE-2017-5638: The Apache Struts vulnerability explained
- Attesting to secure software development practices
- 2024 OSSRA Report: Outdated code risk in open source components
- Black Duck and GenAI
- The integrated DevSecOps playbook: Steps for successful DevSecOps
- The cybersecurity landscape – A discussion of future state and AI with Dr. Lisa Bradley
- Navigating complexity in AppSec
- How AI is changing software’s role in the SDLC
- DevSecOps best practices
- Test mode enhancements to Defensics fuzz testing
- Container security essentials
- AppSec Decoded: How to implement security in DevOps
- How to generate a software bill of materials
- AppSec Decoded:Tips for reaching DevSecOps maturity
- Mobile app security testing and development at the speed your business demands
- Mergers and acquisitions insurance
- CyRC Vulnerability Advisory: CVE-2023-51448 Blind SQL Injection in SNMP Notification Receivers
- DevSecOps practices to maintain developer velocity
2023 126
- Consolidating effort for enhanced application security
- Demystifying CVSS Scoring
- Black Duck named as a Customers’ Choice in the 2023 Gartner® Peer Insights™ Voice of the Customer for Application Security Testing
- Consolidate insight to enhance risk management
- Shifting everywhere: The importance of continuous testing in the software development life cycle
- Consolidate security tools and vendors to enhance risk management
- Audited vs. automated: What your automated open source tool isn’t seeing
- Building Security in Podcast: Cloud, AI, and quantum computing
- Why cross-site scripting still matters
- Critical aspects of a secure software supply chain
- Secure cloud-native apps and APIs at the speed your business demands
- SBOMs and SPDX: Now and in the future
- Bridging the gap between pentesting and automated scanners with business logic assessments
- DevSecOps Report: ASPM and its impact on software security
- Building Security In Podcast: Future State Challenges
- How to respond to the curl and libcurl vulnerabilities
- Preparing for critical libcurl and curl vulnerabilities (CVE-2023-38545)
- CyRC Vulnerability Analysis: XML external entity injection vulnerability in OpenNMS
- Integrations to elevate your DevSecOps program
- Defensics extends fuzzing capabilities for IoT markets
- Automate security: DevOps integrations for risk detection and remediation
- Forrester recognizes Black Duck as a Leader in static application security testing
- National Coding Week: Closing the skills gap with secure code training
- Black Duck audits reporting update: Streamlined view of risks and remediation steps
- How to safeguard your AI ecosystem: The imperative of AI/ML security assessments
- CyRC Vulnerability Advisory: CVE-2023-2453 Local File Inclusion in Forum Infusion and CVE-2023-4480 Arbitrary File Read in Fusion File Manager
- Gartner’s Guide to AppSec Testing Tools
- The SANS report: The dynamics of DevSecOps
- The SANS report: The dynamics of DevSecOps
- The parallels of AI and open source in software development
- How to make the future IoT more secure
- Building Security In Podcast: New strategies for managing risk
- Solving cross-platform DevSecOps challenges with Black Duck
- Eliminate false positives with Continuous Dynamic
- CyRC Vulnerability Advisory: CVE-2023-0871 Vulnerability in OpenNMS Horizon
- The rise of AI in software development
- Introducing Black Duck AI code analysis API
- Synopsys and NowSecure join forces
- Developer-first security to prevent downstream risks
- Simplify AppSec program management with Software Risk Manager
- Software Risk Is Business Risk. It’s Time for the C-Suite to Act.
- Software due diligence for PE & VC investors
- Compliance? Continuous Dynamic™ has you covered
- Avoiding pitfalls when integrating AppSec for DevOps
- The Polaris platform is redefining secure development
- Building Security In Podcast: Machine Learning + AI
- Why nontechnical organizations need due diligence
- AppSec integrations enable a more secure SDLC
- Consolidation: The wave of the (AST) future
- CyRC Vulnerability of the Month: curl
- Challenges of interoperability in fuzz testing
- Defending against malicious packages in the npm ecosystem and beyond
- Creating a well-rounded Microsoft 365 security program
- 2023 OSSRA deep dive: High-risk vulnerabilities
- Podcast: The current state of DevOps
- FDA: SBOMs requirement for connected medical devices
- Continuous scanning in your production environment is more important than ever
- AppSec Decoded: Ease of use with Polaris
- Software quality: Diligence prep for sellers
- Enhancing cloud security posture with an effective cloud governance framework
- CyRC Vulnerability Advisory: CVE-2023-32353, Apple iTunes local privilege escalation on Windows
- Fuzz Testing and Medical Devices
- Synopsys named in 2023 Fortress Cyber Security Awards
- An Enterprise Guide: Periodic Cloud Security Risk Assessments
- Connecting the dots: Development + business risk + due diligence
- AppSec Decoded: Easy to scale with Polaris
- Black Duck named a Leader in the 2023 Gartner® Magic Quadrant™ for Application Security Testing for the seventh year
- Detection strategies to unmask the source of malicious code
- Eliminate malicious code in your software supply chain
- AppSec Decoded: Easy deployment with Polaris
- The importance of software due diligence for private equity firms
- 2023 OSSRA deep dive: jQuery and open source security
- CRN’s 2023 Women of the Channel Awards list
- A deep-dive on Pluck CMS vulnerability CVE-2023-25828
- CyRC Vulnerability Advisory: CVE-2023-25826 and CVE-2023-25827 in OpenTSDB
- Fuzz testing for connected and autonomous vehicles
- Software due diligence in M&A: Key considerations and risks
- AppSec Decoded: Evaluating threats with threat modeling risk analysis
- Cloud detection and response, a key asset for cloud security
- Fast application security testing with the Polaris platform
- We’re one step closer to knowing how to comply with EO 14028
- Improving software supply chain security for cloud applications and workloads
- Friend or foe: AI chatbots in software development
- AppSec Decoded: Creating an attack model in threat modeling
- Polaris integrations: Secure development at the speed of business
- Black Duck SCA vs. Black Duck Audit Services
- AppSec Decoded: Creating a system model in threat modeling
- Improving cloud security posture with infrastructure-as-code
- What pen testing can tell you about the health of your SDLC
- AppSec Decoded: Scoping + data gathering in threat modeling
- Polaris: Your no-compromise SaaS AST solution
- OWASP Top 10: Security misconfiguration
- Synopsys Global Partner Program Receives CRN® 5-Star Rating for Second Consecutive Year
- Assessing design quality for better software due diligence
- CyRC Vulnerability Advisory: CVE-2023-25828 Authenticated Remote Code Execution in Pluck CMS
- Production-safe DAST: Your secret weapon against threat actors
- Automate your DevSecOps to take the pressure off triage
- AppSec Decoded: Continuous AppSec testing in DevSecOps with Seeker IAST
- OWASP Top 10: Insecure design
- DevSecOps uses policy to take the pressure off testing
- Static analysis + penetration testing = More than the sum of their parts
- Secure software development for modern vehicles
- AppSec Decoded: Managing your open source risks
- OWASP Top 10: Injection
- Instantly scalable dynamic application security testing
- AppSec Decoded: Takeaways from the 2022 “Software Vulnerability Snapshot” report
- Take the pressure off coding for your developers
- The M&A Open Source Risk Number
- The step-by-step guide to threat modeling
- OWASP Top 10: Cryptographic failures
- Navigating software due diligence with a Black Duck Audit
- Spotlight on CRED: Benchmarking security with a BSIMM assessment
- Tom Herrmann of the Synopsys Software Integrity Group recognized as 2023 CRN Channel Chief
- CyRC special report: Secure apps? Don’t bet on it
- CyRC Special Report: How companies fared in the aftermath of Log4Shell
- CyRC Vulnerability Advisory: CVE-2023-23846 Denial-of-Service Vulnerability in Open5GS GTP Library
- Open source software: A pillar of modern software development
- Black Duck’s New Year’s Resolution
- Software risks and technical debt: The role of process in determining good software
- 2023 cybersecurity predictions that should be on your radar
- Prioritizing open source vulnerabilities in software due diligence
- OWASP Top 10: Broken access control
- Finding hard-coded secrets before you suffer a breach
- AppSec Decoded: The research behind the 2022 “Software Vulnerability Snapshot”
- How to choose React Native libraries for secure mobile application development
- Cybersecurity Research Center Developer Series: The OWASP Top 10
2022 84
- The top cyber security stories of 2022
- Automating web security testing within your DevOps pipelines
- SBOM: What’s in your software ingredients list?
- What is the cost of poor software quality in the U.S.?
- CyRC Vulnerability Advisory: Remote code execution vulnerabilities in mouse and keyboard apps
- Custom and variant licenses: What’s in the fine print?
- Beyond NVD data: Using Black Duck Security Advisories for version accuracy
- The top three differences between an open source audit and an open source scan
- JavaScript security best practices for securing your applications
- Scalable SAST and SCA in a single solution with Polaris fAST services
- Defensics adds gRPC support for distributed web and mobile application security testing
- CyRC Vulnerability Advisory: CVE-2022-43945 buffer overflow vulnerabilities in NFSD
- Synopsys introduces GitHub Actions integration for developers
- Synopsys introduces GitHub Actions integration for developers
- Avoid anaphylactic shock by auditing dependencies in software due diligence
- Experts warn of critical security vulnerability discovered in OpenSSL
- New government directives and persistent threats reinforce urgency of securing software
- Real-time OWASP vulnerabilities as you code with Code Sight and Rapid Scan Static
- I have my Black Duck Audit reports; What’s next?
- CyRC Vulnerability Advisory: CVE-2022-39064 IKEA TRÅDFRI smart lighting
- Open source dependency best practices for developers
- CyRC Vulnerability Advisory: CVE-2022-39065 IKEA TRÅDFRI smart lighting gateway
- IDE-based application security for developers in IntelliJ
- Commercial software licenses in software due diligence
- CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS
- Smart home under fuzzing
- Understanding the hows and whys of open source audits
- AppSec Decoded: Addressing NIST guidelines begins with understanding your risk profile
- Establishing trust in your software supply chain with an SBOM
- Black Duck and the new Automated Source Code Data Protection Measure have you covered
- What I wish I knew about security when I started programming
- API authentication and authorization best practices
- AppSec Decoded: The NIST guidance on supply chain risk management
- The four most important aspects of software due diligence audits
- CyRC Case Study: Exploitable memory corruption using CVE-2020-25669 and Linux Kernel
- AppSec Decoded: An introduction to the Black Duck Cybersecurity Research Center
- Synopsys and ESG report points to prevalence of software supply chain risks
- Secure SDLC 101: Mastering software development life cycle security
- CyRC Vulnerability Advisory: Local privilege escalation in Kaspersky VPN
- CyRC Vulnerability Analysis: Repo jacking in the software supply chain
- Introducing IaC Security from Black Duck
- Bridging the security gap in continuous testing and the CI/CD pipeline
- Interview-based due diligence or software audits?
- AppSec Decoded: Application security orchestration and correlation
- AppSec Decoded: Get the most out of your open source software
- Build a holistic AppSec program
- OWASP API Security Top 10: Security risks that should be on your radar
- CyRC Vulnerability of the Month: Spring Framework
- Celebrating one year of Rapid Scan Static
- M&A, trust in software, and a good night’s sleep
- WhiteHat brings new dimension to DAST capabilities at Synopsys
- Enterprise applications run your business, so how can you secure them?
- Why supply chain risk management is a top priority
- AppSec Decoded: Security at the speed of DevOps
- Celebrating Pride 2022: Out in open source
- CyRC Case Study: Securing BIND 9
- AppSec Decoded: Managing software supply chain risks
- CyRC Vulnerability Advisory: Sensitive data exposure in JSON enables account compromise in Strapi
- Tech tales: Achieving PCI compliance with application security testing
- Building security into existing source code management workflows
- Two-factor authentication misconfiguration bypass
- Black Duck Open Source Audits: Working through licensing issues like a pro
- Product Security Advisory: Reflected cross-site scripting in Black Duck Hub
- Synopsys to expand portfolio, SaaS offerings with WhiteHat Security acquisition
- CyRC Vulnerability Analysis: CVE-2022-1271 in gzip, but it’s not as bad as it sounds
- CyRC Vulnerability Advisory: Stored XSS in Directus
- What is the maturity level of your AppSec program?
- AppSec Decoded: Is an SBOM a silver bullet for software supply chain security?
- BYOD in the workforce: MDM and MAM with Microsoft Intune
- CyRC Vulnerability Analysis: Two distinct Spring vulnerabilities discovered – Spring4Shell and CVE-2022-22963
- How to cybersecurity: Software supply chain security is much bigger than you think
- NIST provides recommended criteria for cybersecurity labeling for consumer software and IoT products
- Black Duck contributes to the Linux Foundation Census II of the most widely used open source application libraries
- #BreakTheBias: A conversation about tackling gender equality in the workforce
- Navigating the road ahead for automotive cybersecurity
- Black History Month: Uplifting voices at Black Duck
- What the cybersecurity executive order means for the private sector
- Code Sight Standard Edition: Application security optimized for the needs of developers
- How to cybersecurity: Gravity is a harsh mistress
- AppSec Decoded: Building security into DevSecOps
- CyRC Vulnerability Analysis: Local privilege escalation vulnerability discovered
- Scale and mature your AppSec program with a managed services partner
- Bob Saget and open source license compliance
- Five cryptography best practices for developers
2021 74
- AppSec Decoded: A proactive approach to building trust in your software supply chain
- Detecting Log4j (Log4Shell): Mitigating the impact on your organization
- How to cyber security: Software supply chain risk management
- CyRC Vulnerability Analysis: Remote code execution zero-day exploit in Java logging library (log4j2)
- Safety Detectives interview with Tim Mackey
- CyRC Vulnerability Advisory: Multiple vulnerabilities discovered in GOautodial
- Effective software security activities for managing supply chain risks
- Don’t let Trojan Source sneak into your code
- A stitch in BIND saves nine
- Top seven logging and monitoring best practices
- AppSec Decoded: Why Biden’s executive order should be on your radar
- How to cybersecurity: Heartbleed deep dive
- Top 10 Spring Security best practices for Java developers
- CyRC Vulnerability Advisory: SQL injection, path traversal leading to arbitrary file deletion and XSS in Nagios XI
- BSIMM: Top five software security activities that create a better software security initiative
- AppSec Decoded: Cyber security measures for technology buyers and suppliers
- A new approach to AppSec
- Strengthen your cloud security posture with Azure Sentinel
- ASOC series part 2: How to scale AppSec with application security automation
- ASOC series part 1: How application security orchestration and correlation can improve DevSecOps efficiency
- New banking paradigm requires better security paradigm
- Managing license compliance with Black Duck SCA
- Reflections on trusting plugins: Backdooring Jenkins builds
- Keep infrastructure as code secure with Black Duck
- How to run your CodeXM checker
- AppSec Decoded: New executive order changes dynamic of software security standards
- Build developer trust with faster, accurate AppSec testing from Rapid Scan
- Shift even further left with blazing-fast Rapid Scan SAST
- Practical solutions for a secure automotive software development process following ISO/SAE 21434
- Reduce open source software risks in your supply chain
- Getting started with writing checkers using CodeXM
- Optimizing software composition analysis for developer workflows with Black Duck Rapid Scan
- How to cyber security: Embedding security into every phase of the SDLC
- How an open source software audit works
- CyRC Vulnerability Advisory: Denial-of-service vulnerabilities in Zephyr Bluetooth LE stack
- Reduce open source risk in M&A with software due diligence
- Ransomware prevention begins with securing your applications
- Data privacy laws drive urgency to create a data security strategy
- How to achieve MISRA and AUTOSAR coding compliance
- CyRC Vulnerability Advisory: Denial of service vulnerabilities in RabbitMQ, EMQ X, and VerneMQ
- Code Dx brings game-changing capabilities to Synopsys
- Web application security testing at scale with Coverity SAST
- Addressing 5G security with threat modeling
- A CISO’s guide to sensitive data protection
- How to protect your Wi-Fi devices from new FragAttacks vulnerabilities
- Cybersecurity Executive Order requires new software security standards
- Open source license compliance and dependencies: Peeling back the licensing layers
- Top 10 DevSecOps best practices for building secure software
- Biden on cyber security after 100 days: A good start, but now comes the hard part
- How to cyber security: 5G is not magic
- Securing the IoT tsunami
- The 411 on Stack Overflow and open source license compliance
- Penetration testing: A yearly physical for your applications
- Integrating fuzzing into DevSecOps
- Don’t be the weak link in your customers’ supply chain security
- Black Duck CyRC named a CVE Numbering Authority
- Hacking medical devices: Five ways to inoculate yourself from attacks
- Closing the gender gap in today’s tech industry
- WLAN under fuzzing with Defensics
- Why should DevOps teams choose IAST?
- Don’t let supply chain security risks poison your organization
- Get earlier, actionable vulnerability insights from Black Duck Security Advisories
- CyRC Vulnerability Advisory: Denial of service vulnerability in Jetty web server
- How to cyber security: Containerizing fuzzing targets
- Analysis of an attack on automotive keyless entry systems
- 8 must-have features in an IAST solution
- How to integrate automated AST tools in your CI/CD pipeline
- AppSec Decoded: Manufacturing more-secure IoT devices
- Discovery capabilities: A core differentiator for Black Duck SCA
- Securing your code: GDPR best practices for application security
- How to manage open source risks using Black Duck SCA
- How to evaluate the ROI of your software security program
- How to cyber security: Faceplanting in 10 lines of code
- Don’t get overwhelmed with trivial defects. Manage them!
2020 69
- DevSecOps: The good, the bad, and the ugly
- Things to consider when choosing a software composition analysis tool
- CyRC analysis: Authentication bypass vulnerability in Bouncy Castle
- How to cyber security: Software security is everyone’s responsibility
- How to build a serial port fuzzer with Defensics SDK
- Fuzzing Bitcoin with the Defensics SDK, part 2: Fuzz the Bitcoin protocol
- 6 Findings from DevSecOps Practices’ Survey
- Configure security tools for effective DevSecOps
- Fuzzing Bitcoin with the Defensics SDK, part 1: Create your network
- Four requirements for open source vulnerability management in a DevOps environment
- Automotive threat analysis and risk assessment method
- Can your security keep pace in a DevOps environment?
- How to cyber security: Gotta go fast … but why?
- The roles and responsibilities that lead to better software security initiatives
- Three DevSecOps challenges and how to mitigate them
- Cyber security assurance levels in the automotive supply chain
- CyRC analysis: Circumventing WPA authentication in wireless routers with Defensics fuzz testing
- AppSec Decoded: The security dilemma of IoT devices
- Get effective DevSecOps with version control
- Are you ready for ISO SAE 21434 Cybersecurity of Road Vehicles?
- Making SCA part of your AST Strategy
- CyRC Vulnerability Advisory: Authentication bypass vulnerabilities in multiple wireless router chipsets (CVE-2019-18989, CVE-2019-18990, and CVE-2019-18991)
- Open source licenses: No license, no problem? Or … not?
- MITRE releases 2020 CWE Top 25 most dangerous software weaknesses
- TANSTAAFL! The tragedy of the commons meets open source software
- Black Duck continues to expand vulnerability prioritization methods
- Developing a COVID-19 track and trace app — through the lens of Black Duck
- Apache Struts research at scale, Part 3: Exploitation
- Security bugs and flaws: Both bad, but in different ways
- Are you making software security a requirement?
- How to Cyber Security: Fuzz a tank
- Open source audits: The secret ingredient for successful M&A
- Find more bugs by detecting failure better: An introduction to Defensics Agent instrumentation sanitizer options
- Are you following the top 10 software security best practices?
- An introduction to installing Black Duck
- Authentication Token Obtain and Replace (ATOR) Burp plugin to handle complex login sequences
- How to overcome the top 6 application security challenges
- Why developers need a supplemental source to NVD vulnerability data
- Are you ready for API security?
- Critical gap in developer security training puts applications at risk
- How to Cyber Security: Fuzzing does not mean random
- 3 ways to boost your security with role-based security compliance training
- 3 long-term benefits of an application security training strategy
- CyRC analysis: CVE-2020-7958 biometric data extraction in Android devices
- The Complete Application Security Checklist
- What the open source community can teach the suddenly remote workforce
- CyRC Vulnerability Advisory: CVE-2020-7958 biometric data disclosure vulnerability in OnePlus 7 Pro Android phone
- How to Cyber Security: Application security is critical for data security
- How 5G and IoT devices open up the attack surface on enterprises
- What is the Ghostcat vulnerability (CVE-2020-1938)?
- 3 ways to improve your software development skills
- 3 ways to improve your software development skills
- How to deal with legacy vulnerabilities
- What is security debt, and how do I get out of it?
- How do you effectively remediate the increasing sea of vulnerabilities?
- Apache Struts research at scale, Part 2: Execution environments
- How does IAST fit into DevSecOps?
- 5G: Vast potential, but better security needed
- Thoreau’s ‘simplify’ exhortation hovers over RSA
- Want to comply with privacy laws? Start with security
- There’s no such thing as TMI when it comes to open source software
- Find and fix open source and proprietary code security defects in the IDE with Polaris and Code Sight
- Top 10 FOSS legal developments in 2019
- Extending Black Duck’s capability with Red Hat OpenShift to scan Red Hat Quay images
- Mobile security app-titude best practices for secure app design and data privacy
- Ask the Experts: What’s most rewarding about your career in cyber security?
- Coverity & Black Duck together. Better. Faster. Stronger.
- Synopsys acquires Tinfoil Security, DAST and API testing solutions provider
- The journey to better medical device security: Still slow, still bumpy
2019 64
- Mackey: Security isn’t ‘front of mind’ in the IoT
- Cost of data breaches in 2019: The 4 worst hits on the corporate wallet
- How to Cyber Security: Software is critical infrastructure
- The blockchain train: Get on board—with caution
- SAST vs. SCA: What’s the difference? Do I need both?
- Blue Yonder: Extending their SDLC to remediate open source issues
- How to Cyber Security: Unicorns and donkeys
- It’s past time to put passwords out of our misery
- The due diligence of a deal
- Apache Struts research at scale, Part 1: Building 115 versions of Struts
- Don’t let your supply chain undermine your security
- CloudBees and Synopsys: Putting “Sec” into DevSecOps
- Best practices for secure application development
- Seeker FAQ: Interactive application security testing and CI/CD
- Wormwood – An Explicit Way to Test Absinthe GraphQL APIs
- Coverity release ties in well to the latest MITRE CWE Top 25
- Hackers needed to defeat hackers
- Q&A: Fuzz testing, agent instrumentation, and Defensics
- Let’s Talk Licenses: Beware the Beerware License
- Awash in regulations, companies struggle with compliance
- What are the different types of security vulnerabilities?
- Review of Apache Struts vulnerabilities yields 24 updated advisories
- [Infographic] Financial cybersecurity by the numbers
- The license and security risks of using Node.js
- Ask the Experts: How can we prevent ransomware attacks?
- Apollo 11 software lessons still relevant today
- 3 use cases where source code scanning doesn’t cut it
- Securing software development: NIST joins the parade
- Top 3 cloud security trends for 2019
- Why hackers are targeting your web apps (and how to stop them)
- Join Synopsys at codenomi-con and Black Hat USA 2019
- Patch now or pay later: Report
- Top 3 operational open source risk factors
- More medical mega-breaches thanks to third-party insecurity
- Web AppSec interview questions every company should ask
- Q&A: Interactive application security testing (IAST) and Seeker
- You’re using open source software, and you need to keep track of it
- The Verizon DBIR and the art of the breach
- Ask the Experts: Should the US have a data privacy law similar to GDPR?
- It’s not just autonomous cars of the future that need security
- How are code quality and code security related?
- Don’t let insider threats rain on your cloud deployment
- Announcing Code Sight 2019.4
- Synopsys and Red Hat OpenShift 4: One smooth Operator!
- Feds seek to up their cybersecurity game
- Are you making these software standards compliance mistakes?
- The Black Duck Cybersecurity Research Center (CyRC): Advancing the state of software security
- Complex but helpful: Negotiating FDA guidance to build a cybersecurity program
- The cyber-physical convergence is accelerating—and so are the risks
- Want to secure your apps? Build security in with the right toolchain
- Bug bounties: A good tool, but don’t make them the only tool in security
- The days (and nights) of an ‘always on’ sales engineer
- Connected cars need better connection to cybersecurity
- Advances in healthcare security since the Anthem data breach
- 3 takeaways from “Managing the Business Risks of Open Source” webinar
- Study shows security challenges in the auto industry
- Container scanning for security with Black Duck OpsSight 2.2
- How to “shift left” with application security tools, and how not to
- Why dependencies matter for SAST
- Server-side GraphQL Querying with Elixir Absinthe
- The future of open source software: More of everything
- Top 10 software vulnerability list for 2019
- Throwback Thursday: Whatever happened to Stuxnet?
- GAO report confirms major gaps in government cybersecurity
2018 66
- Next-generation audit reports: Enhanced visibility into open source risks in M&A transactions
- President’s ‘cybersecurity moonshot’: Transformational or pie in the sky?
- NPM dependencies, supply chain attacks, and Bitcoin wallets
- Hard questions raised when a software ‘glitch’ takes down an airliner
- Air gaps in ICS going, going … and so is security
- Should I include CSRF protection on a login form?
- WPA2 encryption bypass: Using Defensics to uncover behavioral vulnerabilities
- CyRC Vulnerability Advisory: CVE-2018-18907 authentication bypass vulnerability in D-Link DIR-850L wireless router
- Don’t expect jailed CEOs, but Wyden at least puts consumer privacy on the table
- Today I Learned: Using SCSS in your Vue Components
- GPLv2 and the right to cure
- Threats obvious, but electronic voting systems remain insecure
- Shared responsibility model: Who owns cloud security?
- Lance Spitzner: How to secure the human operating system | NCSAM at Synopsys
- Automation: One of the keys to DevSecOps
- Why you need to perform open source due diligence in an M&A transaction
- Shield your home from spies | NCSAM at Synopsys
- CVE-2018-11776 and why you need Black Duck Security Advisories
- How and why business is migrating to the cloud
- Tineola: Taking a bite out of enterprise blockchain
- Let’s write more CodeXM checkers (second-stage ignition)
- The IoT within us: Network-connected medical devices
- What’s so special about zero-day vulnerabilities?
- A Quick Guide to the Complex: Ecto.Multi
- These hacks brought to you by ‘leaky’ APIs
- The intersection between IAST and SCA and why you need both in your security toolkit
- CVE-2018-11776: The latest Apache Struts vulnerability
- Securing applications with Coverity’s static analysis results
- Integrating Coverity static analysis into development workflows
- The Apache Software Foundation can take a joke, but not when it comes to licensing
- The AppSec alphabet soup: A guide to SAST, IAST, DAST, and RASP
- How to help your medical devices meet the UL (and FDA) standard
- Slim Docker Images for Rails
- LifeLock lesson—Third party security is your security
- SingHealth hit with ‘unprecedented’ cyber attack
- FDA adopts UL 2900-2-1, improves cyber security of connected medical devices
- Remediating XSS: Does a single fix work?
- How RASP complements application security testing to minimize risk
- Common security challenges in CI/CD workflows
- Vulnerable routers are still out there—and hackers are noticing
- The what, why, and who of runtime application self-protection (RASP)
- 5 DevSecOps essentials and how to achieve them
- How does the TeenSafe data leak present a classic false sense of security?
- How to integrate SAST into the DevSecOps pipeline in 5 simple steps
- 8 takeaways from NIST’s Application Container Security Guide
- Data breaches and more data breaches—oh my!
- How to break car kits with Bluetooth fuzz testing
- IMF wants to pierce the blockchain anonymity veil
- Using containers? What’s hidden in your container images?
- Cracking XenForo corpuses: An unsupported sha256(sha256($pass).$salt) hash type
- Detecting Spectre vulnerability exploits with static analysis
- Weighing the pros and cons of open sourcing election software
- What’s the difference between agile, CI/CD, and DevOps?
- Still just recommendations, not regulation, for IoT security
- Closing the CVE gap still a work in progress
- The GitHub Memcached DDoS: It shouldn’t have happened
- Subscribe to stay on top of the latest in software security
- Can Coverity automatically ignore issues in third-party or noncritical code?
- Small crypto mining attack points to big browser problem
- In an IoT-filled world, be alert in the wake of ‘Hide and Seek’
- Migrating to Docker on Black Duck
- When software is the company, tech due diligence is critical
- Is shadow engineering developing your applications?
- The Data Protection Directive versus the GDPR: Understanding key changes
- What does GDPR enforcement mean for your business?
- Is breach of the GPL license breach of contract?
2017 66
- PayPal uncovers TIO Networks data breach affecting 1.6 million users
- Attacks on TLS vulnerabilities: Heartbleed and beyond
- Navigating responsible vulnerability disclosure best practices
- It’s time to enlist Security Champions to fuel Agile development
- Streamlining development with a DevSecOps life cycle
- How to proactively protect IoT devices from DDoS attacks
- KRACK: Examining the WPA2 protocol flaw and what it means for your business
- ROCA: Cryptographic flaws in BitLocker, Secure Boot, and millions of smartcards
- What is cloud-native container security?
- Black Duck and Google Grafeas: Improving container visibility and security
- Examining Apache Struts remote code execution vulnerabilities
- How to implement security measures without negatively affecting software quality
- Why do companies need a software security program?
- Equifax, Apache Struts, and CVE-2017-5638 vulnerability
- Pandora’s box: Exploits show package manager blind spots
- So Apache broke up with Facebook. How does that affect you?
- What you need to know about BlueBorne Bluetooth flaws
- Black Duck finds 3 Linux kernel vulnerabilities
- Did lack of visibility into Apache Struts lead to the Equifax breach?
- What can your firm learn from the unfolding Equifax hack?
- “Easy” to hack Apache Struts vulnerability CVE-2017-9805
- A journey through the secure software development life cycle phases
- DEF CON 25 exposes voting system vulnerabilities
- Hub Detect: Comprehensive open source scanning
- Scan nirvana: Hub Detect for all native build and CI tools
- The quietly accelerating adoption of the AGPL
- Insecure example code leads to insecure production code
- Is threat modeling compatible with Agile and DevSecOps?
- Building your DevSecOps pipeline: 5 essential activities
- 3 permissive licenses and why they deserve a little respect
- A primer on protecting keys and secrets in Microsoft Azure
- Introducing Black Duck CoPilot
- Security topics every software developer should know
- Encryption technology in your code impacts export requirements
- Why should every eCommerce website have an SSL certificate?
- 4 key differences moving from Java to .NET Core
- When should threat modeling take place in the SDLC?
- Node.js: Preventing common vulnerabilities in the MEAN stack
- AngularJS: Preventing common vulnerabilities in the MEAN stack
- DoublePulsar continues to expose older Windows boxes: What you need to know
- .NET component vulnerability analysis in production
- Heartbleed: OpenSSL vulnerability lives on
- What are the signs your web application has been hacked?
- ExpressJS: Preventing common vulnerabilities in the MEAN stack (Part 1)
- How to mitigate third-party security risks
- MongoDB: Preventing common vulnerabilities in the MEAN stack
- Attributes of secure web application architecture
- Cloudera IPO: Risk for cyber attacks, lawsuits, and loss of IP?
- Top 4 software development methodologies
- Does software quality equal software security? It depends
- Does software quality equal software security? It depends
- Forging a SHA-1 MAC using a length-extension attack in Python
- Swift: Close to greatness in programming language design, Part 2
- Vulnerability management and triage in 3 steps
- CVE-2017-2636 strikes Linux kernel with double free vulnerability
- New Apache Struts 2 zero-day vulnerability: What you need to know
- Howard Schmidt, the United States’ first Cybersecurity Czar, has died
- Responsible disclosure on a timetable
- AngularJS security series part 1: Angular $http service
- What is dual licensing? 3 software licensing models to consider
- Cloudbleed, like Heartbleed, may affect millions
- Moving beyond ‘moving left’: The case for developer enablement
- Examining vulnerability criticality when risk ranking vulnerabilities
- An overview of open standards for IoT communication protocols
- 3 things to consider when risk ranking your applications
- How much do bugs cost to fix during each phase of the SDLC?
2016 66
- AngularJS 1.6: Life outside the sandbox
- How to prevent SQL injection attacks: A cheat sheet
- The fly in the ointment of the JSON license
- 5 reasons to use third-party authentication instead of creating your own
- Here are the top 10 best practices for securing Android apps
- Hearts and minds: Culture management vs. human resources
- Sweet32: Time to retire 3DES?
- Set up a software security group in 5 steps
- How to respond to application security incidents
- Abuse cases: How to think like a hacker
- How to choose between closed source and open source software
- OSS warranties and indemnities in technology transactions
- How to create an open source management policy
- Synopsys expands security signoff solution with Cigital and Codiscope acquisition
- Dyn DDoS attack: IoT vulnerabilities
- The pursuit of Hapi-ness: 5 must-have Hapi security plugins
- Brace yourselves: Application transport security is coming
- Vulnerability management: Designing severity risk ranking systems
- Open source security management: A question of when, not whether
- Why isn’t cyber security taught in schools?
- Guide to open source licenses
- Identifying and resolving software vulnerabilities: A balancing act
- AAMI TIR57 recognized by the FDA as a foundational cybersecurity standard for medical devices
- Why there are at least 6,000 vulnerabilities without CVE-IDs
- AGPL: Out of the shadows
- Software testing included in final ISA / IEC 62443-4-1
- The greatest security vulnerability: Humans
- The Complete Security Vulnerability Assessment Checklist
- Heartbleed bug: How it works and how to avoid similar bugs
- Recognizing Another Type of Threat: Non-targeted Attacks
- 4 ineffective security controls that leave you with a false sense of security
- Pseudorandom number generation means pseudosecurity
- 4 principles of secure software design
- Avoiding false positives in application security through customization
- An escape room called the ‘AngularJS sandbox’
- Web application security threats and countermeasures
- The 5 pillars of a successful threat model
- How to mitigate the Java deserialization vulnerability in JBoss application servers
- Rocket.Chat: Enabling privately hosted chat services
- 4 threat modeling questions to ask before your next Agile sprint
- What are the real security implications of the Hillary Clinton email scandal?
- For want of a CVE: MITRE’s ongoing CVE backlog
- 10 ways to infuse security into your software development life cycle
- Best practices for free and open source software vulnerability management
- Are SaaS companies immune to open source risk?
- Man in the middle: When Bob met Alice, and Eve heard everything
- The open perimeter: Is your internal network protected?
- Node.js and Socket.IO: How security fails when ‘null’ is ‘false’
- The complete web application security testing checklist
- Application security vs. software security: What’s the difference?
- TLS 1.3 and the future of cryptographic protocols
- Black Duck discovers CVE-2015-5370 in Samba’s DCE/RPC protocol implementation
- How to avoid the top 10 software security flaws
- Proper use of Java SecureRandom
- How to do static analysis testing in 6 easy steps
- Web application security basics: 3 tips to get started
- What’s the difference? OAuth 1.0 vs OAuth 2.0
- An examination of ineffective certificate pinning implementations
- Security risks in mergers and acquisitions
- Static analysis tools: Are they the best for finding bugs?
- Do you believe the 7 myths of software security?
- 7 fundamentals of an application security program
- When and how to support static analysis tools with manual code review
- 3 security risks that architecture analysis can resolve
- Pen testing best practices to take the pain out of penetration testing
- 5 essentials of cloud-based application security testing
2015 28
- How to mitigate your third-party mobile keyboard risk
- Android WebViews and the JavaScript to Java bridge
- The top hacking techniques of 2015 and how they work
- What Is Cross-Site Request Forgery?
- What are cryptographic hash functions?
- 3 ways abuse cases can drive security requirements
- Software security myth #3: Penetration testing solves everything
- Using the SafetyNet API
- 3 fundamentals of a software security initiative
- Adding security steps to your agile development process
- Benefits of Code Scanning for Code Review
- Agile and application security: A promising pair
- 5 ways to pay your technical debt back
- The cathedral and the bazaar of software security vulnerabilities
- Serving resources over SSL with CSP upgrade-insecure-requests
- Software is everywhere
- Integrating Touch ID into your iOS applications
- 3 reasons software security governance is essential to your business
- How to build a red teaming playbook
- How to build a game-changing red team
- Samsung Galaxy phone hack: Making sense of the “Samsung” RCE vulnerability
- 4 application security skills every expert ought to have
- How mapping the Ocean’s Eleven heist can make you better at application security testing
- Is conventional penetration testing enough to secure e-commerce applications?
- The 3 laws of robots.txt
- XML External Entity Injection
- Build software security in. Don’t rely on a tower defense strategy.
- The role of randomness in online gambling
2014 15
- How to fix cross-site scripting: A developer’s guide
- Understanding Python bytecode
- Poodle: Yet another attack on SSLv3 (SSL 3.0)
- How To Fix POODLE (And Why You’re Probably Still Vulnerable)
- Multi-Stack Integration Tests with CircleCI
- Standard versus proprietary security protocols
- Cordova InAppBrowser remote privilege escalation
- Software due diligence: Before you buy it, look under the hood
- Understanding fragment injection
- On detecting Heartbleed with static analysis
- Heartbleed vulnerability: What should you do?
- Understanding the Apple ‘goto fail;’ vulnerability
- SHA2 ‘vs.’ SHA1
- SecureRandom implementation (sun.security.provider.SecureRandom – SHA1PRNG)
- Issues to be aware of when using Java’s SecureRandom
2013 7
- Remote code execution in Apache Roller via OGNL injection
- 2 path traversal defects in Oracle’s JSF2 implementation
- Protect Your Website From Its Embedded Content With iFrames
- Stop Paying For SSL Certificates You Don’t Need
- Cross-Browser Development Tips: Part 1 – CSS
- Ruby Demystified: and vs. &&
- Who’s afraid of GPL3?