Interesting finding on application dependencies from Sonatype State of Open Source Report.

Most Pulled Ecosystems
- JS: 4.5 Trillion
- Python: 530 Billion
Outdated software continued to be pulled
- 13% of Log4J downloads are vulnerable
- 80% of Application dependencies are never upgraded

Language Ecosystems Coverage
- Only 10.5% of open-source components are actively used out of the 7 million available
- 180 is the average number of Open Source components per application

Vulnerability Remediation
- The report states the average fix times for even critical vulnerabilities is 200-250 days, with some taking over 500 days to fix.

What application frameworks are you mostly using in your environment? What makes it challenging for application development teams to keep all dependencies up to date during initial development and once in production?

Check out how you can use Faction to create an entire #pentesting report in less than 3 minutes.

#appsec #redteam #owasp #cybersecurity #hacking #applicationsecurity

https://youtu.be/D897o5Ks7pY

Evaluating your organization’s application risk management journey https://www.helpnetsecurity.com/2024/11/12/chris-wysopal-veracode-application-risk-management/ #applicationsecurity #riskmanagement #cybersecurity #supplychain #automation #Don'tmiss #Features #Hotstuff #strategy #Veracode #opinion #News #CISO

Your CI/CD pipeline is vulnerable, but it's not your fault - Elad Pticha, Oreen Livni

https://youtu.be/3dHZ-l3XSsE

"Breaking Down Multipart Parsers: File upload validation bypass" by @themiddle

https://blog.sicuranext.com/breaking-down-multipart-parsers-validation-bypass/

#Hashtags for being found by: I'm a #treehugger, #bicycle commuter, #SoftwareDeveloper, #ApplicationSecurity enthusiast, and #Linux user. I love #reading #ScienceFiction but have to parse it out slowly.

I'm something of a #hippie -- I go #barefoot much of the time, I don't have a smartphone (#NoSmartphone?), I try to "Eat Food, #MostlyPlants, Not Too Much". And I have a deep respect and love of #nature and its systems, even the uncharismatic parts.

I think #FreeSpeech is super important, but that it comes with the responsibility to #BeKind to others in the process.