https://www.msbiro.net/tags/vulnerability-management/ Recent content in Vulnerability Management on Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.164.0 en-us Sun, 09 Aug 2026 09:00:00 +0000 https://www.msbiro.net/posts/sctphantom-cve-2026-64564-threat-modeling/ Sun, 09 Aug 2026 09:00:00 +0000 https://www.msbiro.net/posts/sctphantom-cve-2026-64564-threat-modeling/ CVE-2026-64564 (SCTPhantom) is a critical Linux kernel use-after-free in SCTP ASCONF with a high CVSS score and a demonstrated container escape. A DevSecOps threat-modeling walkthrough of when to care, who is actually at risk, and how to prioritize patching without panic, accounting for attacker-creatable SCTP associations. https://www.msbiro.net/posts/owasp-genai-llm-top-10-2026/ Wed, 05 Aug 2026 07:00:00 +0000 https://www.msbiro.net/posts/owasp-genai-llm-top-10-2026/ OWASP released the GenAI LLM Top 10 2026, the first edition grounded in 7,714 real AI security incidents. Prompt Injection stays at number one. Excessive Agency climbs. Misinformation is the widest gap between what practitioners fear and what the evidence shows. https://www.msbiro.net/posts/ecb-ai-enabled-cybersecurity-threats-letter/ Fri, 10 Jul 2026 08:30:00 +0100 https://www.msbiro.net/posts/ecb-ai-enabled-cybersecurity-threats-letter/ ECB letter on AI-enabled cybersecurity threats: action plan due October 2026, ITRQ deadline extension, CNAPP, hardened images, SBOMs and DORA resilience. https://www.msbiro.net/posts/top25mitre2025/ Wed, 17 Dec 2025 05:19:07 +0000 https://www.msbiro.net/posts/top25mitre2025/ Mitre's 2025 CWE Top 25 reveals persistent threats like XSS and SQL Injection atop the list, with rising authorization flaws and memory bugs signaling DevSecOps priorities for cloud-native apps. Explore the top 10 changes from 2024, key trends, and how CWE root causes differ from CVEs. https://www.msbiro.net/posts/openssf-sbom-whitepaper/ Fri, 03 Oct 2025 16:30:03 +0000 https://www.msbiro.net/posts/openssf-sbom-whitepaper/ This article explores the OpenSSF white paper 'Improving Risk Management Decisions with SBOM Data,' highlighting how Software Bill of Materials (SBOMs) provide critical visibility into software components, vulnerabilities, and licensing. It covers 13 practical SBOM use cases, the SBOM lifecycle from creation to consumption, and key OpenSSF tooling for managing SBOMs in cloud-native environments to enhance security, compliance, and supply chain risk management. https://www.msbiro.net/posts/0day-cves-secrets-manager/ Mon, 11 Aug 2025 12:39:03 +0000 https://www.msbiro.net/posts/0day-cves-secrets-manager/ This article highlights recent zero-day vulnerabilities discovered in CyberArk and HashiCorp secrets managers, emphasizes the importance of timely software updates, and offers practical advice for staying proactive about security patches. https://www.msbiro.net/posts/secrets-cnapp-0cve-dora/ Thu, 07 Aug 2025 06:30:03 +0000 https://www.msbiro.net/posts/secrets-cnapp-0cve-dora/ Why Secrets Manager, Zero-CVE container images, and CNAPPs are essential for cybersecurity resilience and DORA compliance https://www.msbiro.net/posts/sighup-secure-container-how-choose-base-image-security/ Thu, 13 Apr 2023 12:30:03 +0000 https://www.msbiro.net/posts/sighup-secure-container-how-choose-base-image-security/ This post discusses how to choose the right OCI base image for your workloads, emphasizing the importance of security, vulnerability management, and timely updates. It showcases SIGHUP’s Secure Containers service, which offers a curated, proactively patched container catalog with support, SLAs, and automation benefits to help teams maintain secure, compliant container supply chains. https://www.msbiro.net/posts/how-make-developers-and-security-officers-happy-with-snyk/ Fri, 13 Jan 2023 16:23:03 +0000 https://www.msbiro.net/posts/how-make-developers-and-security-officers-happy-with-snyk/ Snyk is a powerful security platform offering tools for static analysis (SAST), software composition analysis (SCA), container security, infrastructure as code, and cloud security. This post explains how Snyk helps developers maintain secure codebases while enabling security officers to oversee vulnerabilities without slowing development. Learn about Snyk’s integrations in IDEs, CI/CD, and Git workflows, customizable dashboards for security teams, and its open-source vulnerability database. A free plan makes testing easy for anyone interested in improving software security.