appsec.fyi · Sources

cybersecurity-insiders.com

5 curated AppSec resources from cybersecurity-insiders.com across 2 topics on appsec.fyi.

cybersecurity-insiders.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-07-19.

Supply Chain 4 AI 1
Date Added Resource Excerpt
2026-07-19 2026Software Supply Chain Security Miss Drained $3M from PolymarketSupply ChainAnalysis of front-end software supply chain attacks, exemplified by the Polymarket incident where malicious JavaScript injected via a third-party vendor drained $3 million, highlights critical security gaps. This threat wave, involving npm dependency poisoning and contractor credential abuse, impacts organizations like Medtronic and AdaptHealth. Veracode's briefing emphasizes the need to monitor deployed JavaScript and third-party script sources continuously, expand external attack surface management to include these domains, and require continuous verification of contractor and vendor sessions, rather than relying solely on point-in-time vendor assessments.
2026-06-27 2026Container Security Requires More Than Scanning: Why Provenance Verification Matters Before DeploymentSupply ChainLibrary for verifying container image provenance, which provides cryptographic evidence about how an artifact was built, including source repository, commit, build environment, and responsible identity. This library enables organizations to validate software trust before deployment by confirming image authenticity using technologies like Sigstore, ensuring provenance applies to the correct image digest, verifying builder identities (e.g., GitHub Actions, GitLab CI/CD), and checking source code and build inputs against organizational policies. It emphasizes extending verification to base images for a complete software supply chain security posture.
2026-06-08 2026How Cyber Attacks across the Supply Chain can be Smartly ThwartedSupply ChainLibrary on thwarting supply chain cyber-attacks, detailing rigorous vendor risk management, least privilege principles, multi-factor authentication, continuous monitoring, software supply chain security practices like SBOMs, employee awareness training, incident response planning, and Zero Trust architecture.
2026-05-26 2026Google blocks AI Powered Cyber Attack on 2FA and Megalodon Malware attack on GitHubSupply ChainAnalysis of AI-powered attacks and supply chain threats, detailing Google's blocking of an AI-driven attack on 2FA using PROMPTSPY malware, which leveraged Gemini AI to automate exploitation of server vulnerabilities, and the Megalodon malware campaign infecting over 5,500 GitHub repositories through poisoned pipeline execution attacks targeting automated workflows.
2026-05-25 2026Three Prompt Injection Patterns Your AI Security Detection Stack MissesAILibrary for detecting prompt injection attacks on LLMs, addressing gaps in traditional WAF and EDR coverage. It details three injection patterns: indirect injection via document content (AML.T0054.002), second-order injection through AI agent tool calls, and conversation-history poisoning (AML.T0054.001). Detection logic focuses on analyzing RAG pipeline logs, agent orchestration logs (tool-call/response pairs), and conversation-session metadata to identify instruction-formatted text and behavioral shifts, aligning with MITRE ATLAS subtechniques and OWASP's LLM Top 10.