Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In a day and age when cyber threats are top of mind, it may be difficult for an organization to shift gears and take its physical security precautions into consideration. This is to protect not only a firm’s physical assets but direct access to networks and information that an attacker could use at a later date for a cyberattack.

On September 9, 2025, Adobe released an out-of-band security update to address a critical vulnerability in Adobe Commerce and Magento Open Source. The vulnerability, tracked as CVE-2025-54236 and referred to in open-source reporting as “SessionReaper,” allows a remote unauthenticated threat actor to take over customer accounts through the Commerce REST API.

Risk doesn’t live in just one place—it comes from vendors, suppliers, partners, and from inside your business through processes, people, and systems. ‍ Managing that risk is often fragmented, too. Vendor reviews live in one system, internal issues in another, and leadership reports take hours to compile. And every new vendor, tool, or requirement contributes to another layer of risk.

Intruder is a cloud-based vulnerability scanner that provides an automated overview of an organization’s attack surface. Its primary function is to proactively identify weaknesses across internet-facing infrastructure and applications before they are exploited. The platform’s scanning engine runs a set of checks for both infrastructure-level misconfigurations and application-layer vulnerabilities, like those in the OWASP Top 10. It leverages open-source engines like ZAP to execute its checks.

The IONIX research team is tracking CVE-2025-42944, an insecure deserialization vulnerability affecting SAP NetWeaver AS Java’s RMI-P4 module—a critical issue warranting immediate attention.

Picture this: A new developer joins your team, excited to start contributing. On day one, they spend hours installing and configuring their IDE, searching for the “right” extensions. Their setup ends up being completely different from everyone else’s. Sound familiar? Worse yet, what if that “productivity-boosting” extension or new MCP server they just installed also secretly opened a backdoor in your codebase?

Most DevSecOps pipelines have a gap: source code security and binary security are handled in separate silos. This creates blind spots, slows teams down, and increases risk. At swampUP 2025, we’re unveiling the next evolution of the JFrog and GitHub integration, a deeply integrated DevSecOps experience that unifies best-of-breed code and binary platforms.

Summary: Privileged Access Management (PAM) is essential to securing today’s complex IT environments, as organizations rapidly adopt multi-cloud infrastructures, DevOps practices and hybrid work models. Yet, complexity remains a major barrier – 68% of IT leaders say their current PAM solution includes unnecessary features they rarely use.

In this episode of Security Matters, host David Puner speaks with Andy Parsons, CyberArk’s Director of EMEA Financial Services and Insurance, whose career spans from the British Army to CISO and CTO roles in global financial institutions. Andy shares hard-earned lessons on leadership, risk management, and the evolving cybersecurity landscape in banking—from insider threats to machine identity governance and the rise of agentic AI.

iOS Security Suite is an open-source library designed for iOS app developers to implement various security measures within their applications. One of the primary purposes of this library is to help developers detect if an iOS device is jailbroken, which can pose security risks to the application and its users.