Help Net Security جمعه ۱۵ آبان ۱۴۰۵ · ۱۰:۰۰

Security certification is a snapshot, and buyers read too much into it

In this Help Net Security video, Mariia Bakhtina, a research specialist at Masaryk University, explains what a Common Criteria or FIPS-140 certificate does and does not promise. In her team’s analysis, about 6 in 10 vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date. She also describes sec-certs and SCRUTINY, two open-source tools her lab builds, and the one q…

Vulnerabilities & Zero-Day Open Source Governance, Risk & Compliance

Read the full article at Help Net Security Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

Help Net Security جمعه ۱۵ آبان ۱۴۰۵ · ۱۰:۳۰

November 2026 Patch Tuesday forecast: Old software continues to bite

How did you enjoy October 2026 Patch Tuesday? Were there enough CVEs reported to keep you busy for the rest of the year or are you finished and ready for another round next week? They released the regularly scheduled update nearly two and a half hours late, but Microsoft did resolve another record-breaking 1,407 unique CVEs. As in previous months, there were limited CVEs we needed to immediately deal with. In October…

Vulnerabilities & Zero-Day

Source

Help Net Security جمعه ۱۵ آبان ۱۴۰۵ · ۰۹:۳۰

87% say their AI controls need to work better

The AI running inside large companies has stopped waiting for permission. Across five categories of AI, from chatbots to process automation, more than half of 3,600 business decision-makers say the systems their teams use can act within defined rules without routine review, or finish whole processes with no human approval. 87% of those same respondents say their organization needs a better way to approve, monitor and…

AI Security AI & Machine Learning

Source

The Hacker News جمعه ۱۵ آبان ۱۴۰۵ · ۰۹:۰۹

Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a

Vulnerabilities & Zero-Day

Source

Help Net Security جمعه ۱۵ آبان ۱۴۰۵ · ۰۹:۰۰

99% of repository access tokens never expire

Developers, automated tools and AI coding agents hold permissions that can outlast the work they were granted for. Without access reviews, organizations can leave accounts able to copy or change company code after the work ends, according to BlueFlag Security’s The State of Developer Risk 2026 report. Development accounts and tools create security blind spots Software development spans code repositories, review syste…

Source