The Cato CTRL and Cato Application Security Research teams recently discovered CVE-2023-49559, a directive overload Denial of Service (DoS) vulnerability in the gqlparser library, which is a crucial component in the development and running of GraphQL applications. The vulnerability is of medium severity (CVSS score of 5.3). The gqlparser library is an integrated component of the gqlgen Golang GraphQL server, widely used in web applications to handle GraphQL queries.

Pulumi customers can secure and simplify their secrets management workflows with a new integration built for 1Password.

Snyk Learn, our developer security education platform, just got better! We have expanded our lesson coverage and created a new learning path that covers the OWASP Top 10 for LLMs and GenAI, and is entirely free! As AI continues to revolutionize industries, ensuring the security of AI-driven systems has never been more critical.

In the past, organizations could control how, when, and where their employees accessed sensitive data. Now, in the age of hybrid and remote work, employees can connect to company networks from any location over nearly any device. Safeguarding data while granting employees the access they need is a delicate balance. That’s where zero trust remote access solutions come into play.

In the fast-paced world of cybersecurity and system observability, timely and accurate incident investigations are crucial. Whether you’re a SOC admin hunting down vulnerabilities, a developer resolving critical system outages, or a team member tracking Real User Monitoring (RUM) errors, the ability to piece together evidence, understand the timeline, and collaborate effectively is the difference between days and weeks of investigation.

An offensive security program is an excellent component of a mature cybersecurity program, but kicking off that process can be overwhelming for some organizations. After all, offensive security has several components, such as Penetration Testing, Red Team exercises, incorporating threat intelligence, etc., so it can be hard to decide where to start. The answer to this dilemma starts with Managed Vulnerability Scanning (MVS).

Keeper Security is excited to announce that passphrases are now supported for mobile platforms on Android and coming soon for iOS, extending the same passphrase experience users have enjoyed in the Keeper Web Vault. In addition, Keeper’s latest update provides enhanced autofill capabilities for long-tap autofilling and Time-based One-Time Passwords (TOTP) on iOS.

In the critical and constantly evolving identity security space, organizations are focused on three essential needs: While identity security disciplines like identity security posture management (ISPM), identity threat detection and response (ITDR) and privileged access management (PAM) address various aspects of these needs, none offer a complete solution.

Are your legacy technologies slowing down your security operations? You’re not alone. Seventy percent of critical incidents take over 12 hours to resolve. Legacy SIEMs burden security teams with endless manual processes and agonizingly slow search speeds, delaying investigation and response while increasing the risk of a breach. The future of security requires next-gen SIEM technology built for scale and speed, powered by automation and AI.

On September 17, 2024, Broadcom released fixes for a critical vulnerability impacting VMware vCenter Server and Cloud foundation, tracked as CVE-2024-38812. This vulnerability is a heap-overflow flaw in the implementation of the DCERPC protocol that a remote attacker can use to send specially crafted network packets to vCenter Server, potentially leading to Remote Code Execution (RCE).