Aggregator

安全通知｜NPM官方仓库遭遇coa等恶意包投毒攻击

腾讯安全响应中心
4 years ago
腾讯洋葱入侵检测系统发现开源软件沙箱主机出现异常行为，跟进发现npm官方仓库的coa、rc被投毒攻击，已经在腾讯软件源紧急拦截相关版本。目前npm官方仓库已将相应版本的恶意包删除，但由于国内开源镜像站均同步npm官方仓库且存在缓存，所以恶意包还可能通过各个开源镜像站影响广大用户。

Keeping Up with Biden Administration Cybersecurity Mandates

The Akamai Blog
4 years ago
With Wednesday’s sweeping cybersecurity mandates issued by the Biden administration, patching Common Vulnerabilities and Exposures (CVEs) are top of mind — for both federal and private-sector companies alike — to help prevent damaging intrusions. Intensifying the pressure surrounding the latest round of mandates, federal agencies are required to address high-risk vulnerabilities discovered in 2021 within two weeks. However, for the vast majority of organizations and their security teams, addressing every critical vulnerability at the software or infrastructure level quickly is not feasible. Instead, many enterprise defenders look to virtual patching via solutions like WAF policy updates and rule changes as a quick fix to help reduce immediate risk, while longer-term software updates are issued.
Amol Mathur

Managed ad