Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In today's fast-paced digital landscape, security vulnerabilities are constant concerns for organizations that rely on cloud-based services and distributed systems. Recently, GitLab addressed a critical security flaw that affected both its Community Edition (CE) and Enterprise Edition (EE). This flaw, tracked as CVE-2024-45409, has been categorized as a critical vulnerability with a CVSS score of 10.0, the highest possible score, signifying its severity.

Thousands of our customers are leveraging Snyk to implement their DevSecOps and shift-left strategies. However, with the increasing speed and complexity of applications, we also know it’s harder to stay in sync with development. It is increasingly difficult to maintain a clear view of all the software assets being developed, identify ownership and their importance to the business, and, most importantly, ensure that these assets are properly secured by Snyk.

Foundationally, the OWASP Top 10 for Large Language Model (LLMs) applications was designed to educate software developers, security architects, and other hands-on practitioners about how to harden LLM security and implement more secure AI workloads. The framework specifies the potential security risks associated with deploying and managing LLM applications by explicitly naming the most critical vulnerabilities seen in LLMs thus far and how to mitigate them.

With external threats looming as a constant source of potential disruption, multiple government agencies have coordinated to compile a catalog of Known Exploited Vulnerabilities (KEV). The Known Exploited Vulnerabilities Catalog, or KEV catalog, is a database of actively exploited vulnerabilities, including those that have been exploited by ransomware campaigns, that can help application security professionals in the public and private sectors monitor threats and prioritize fixes.

The “Zero-Day” term highlights the critical nature of the threat, as the system remains exposed until the vulnerability is addressed. Attackers aim to exploit this gap before a fix can be implemented. Below are some terms to clarify.

On September 17, 2024, Broadcom released fixes for a critical vulnerability impacting VMware vCenter Server and Cloud foundation, tracked as CVE-2024-38812. This vulnerability is a heap-overflow flaw in the implementation of the DCERPC protocol that a remote attacker can use to send specially crafted network packets to vCenter Server, potentially leading to Remote Code Execution (RCE).