Although the hole in the CocoaPods tool is now closed, developers are advised to verify there's nothing rotten in the dependencies used in their existing code.

By John Leyden

Jul 2, 2024 5 mins

Development ToolsEndpoint ProtectionMobile Security

Critical PyTorch flaw puts sensitive AI data at risk

Researchers have discovered a critical flaw in PyTorch’s distributed RPC system, allowing attackers to execute arbitrary commands on the OS and steal AI training data.

By Lucian Constantin

Jun 10, 2024 3 mins

Artificial IntelligenceLibraries and FrameworksVulnerabilities

Major flaw in Java-based Spring Framework allows remote-code execution by attackers

By Ellen Messmer

Jan 17, 2013 2 mins

Data and Information SecurityJavaLibraries and Frameworks

New npm malware finds a way around install script defenses

NPM ecosystem hit with two new supply chain compromises

Mistral AI SDK, TanStack Router hit in npm software supply chain attack

Attackers trojanize Axios HTTP library in highest-impact npm supply chain attack

Critical bug in popular vm2 Node.js sandboxing library puts projects at risk

React2Shell is the Log4j moment for front end development

Poisoned models in fake Alibaba SDKs show challenges of securing AI supply chains

Attackers hide malicious code in Hugging Face AI model Pickle files

Supply chain compromise of Ultralytics AI library results in trojanized versions

Articles

CocoaPods flaws left iOS, macOS apps open to supply-chain attack

Critical PyTorch flaw puts sensitive AI data at risk

Major flaw in Java-based Spring Framework allows remote-code execution by attackers

Resources

Managing modern identity complexity and reducing executive risk

The new era of executive risk: Why identity security must be continuous

5 identity security questions CISOs must be ready to answer