How to mitigate OWASP vulnerabilities while staying in the flow
Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities
Uptick in healthcare organizations experiencing targeted DDoS attacks
Over the past few days, Cloudflare, as well as other sources, have observed healthcare organizations targeted by a pro-Russian hacktivist group claiming to be Killnet.
CVE-2022-47929: traffic control noqueue no problem?
In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands.
Inside Geo Key Manager v2: re-imagining access control for distributed systems
Using the story of Geo Key Manager v2 as an example, let’s re-imagine access control for distributed systems using a variant of public-key cryptography, called attribute-based encryption.
Bypassing OGNL sandboxes for fun and charities
Object Graph Notation Language (OGNL) is a popular, Java-based, expression language used in popular frameworks and applications, such as Apache Struts and Atlassian Confluence. Learn more about bypassing certain OGNL injection protection mechanisms including those used by Struts and Atlassian Confluence, as well as different approaches to analyzing this form of protection so you can harden similar
From Farmer to Security Engineer: How Dev Degree Helped Me Find My Dream Job - Shopify
This story looks at the opportunity Dev Degree gave me, the challenges I overcame, and the weaknesses that turned out to be strengths. If you’re thinking about a career in tech, but don’t think you have the stuff for it, this story is for you.
Armed to Boot: an enhancement to Arm's Secure Boot chain
Enhancing the Arm Secure Boot chain to improve platform security on modern systems.
What We Learned from Building GovSlack
Slack launched GovSlack in July 2022. With GovSlack, government agencies, and those they work with, can enable their teams to seamlessly collaborate in their digital headquarters, while keeping security and compliance at the forefront. Using GovSlack includes the following benefits: Supports key government security standards, such as FedRAMP High, DoD IL4, and ITAR Runs in…
Introducing the GitHub Bug Bounty swag store
We’re excited to share the newest addition to our GitHub Bug Bounty Program!
Pwning the all Google phone with a non-Google bug
It turns out that the first “all Google” phone includes a non-Google bug. Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. Join me on my journey through reporting the vulnerability to the Android security team, and the exploit that used this vulnerability to gain arbitrary kernel code execution and root on a Pixel 6 from an Android app.
Unlocking security updates for transitive dependencies with npm
How Dependabot integrated with npm to address security vulnerabilities on transitive dependencies and increase the likelihood of success for JavaScript security updates by 40%.
Remediation made simple: Introducing new validity checks for GitHub tokens
GitHub now tells you whether GitHub tokens found by secret scanning are active so you can prioritize and escalate remediation efforts.
CIO Week 2023 recap
Learn about all the new products, partnerships, and innovations Cloudflare announced during CIO Week to help organizations modernize their IT and security.
Expanding our Microsoft collaboration: proactive and automated Zero Trust security for customers
As CIOs navigate the complexities of stitching together multiple solutions, we are extending our collaboration with Microsoft to create one of the best Zero Trust solutions available.
A smarter, quieter Dependabot
Dependabot is getting a little smarter—and, a little quieter—by reducing bot-based noise from repositories based on your interaction with Dependabot.
How Cloudflare Area 1 and DLP work together to protect data in email
Customers can leverage the power of Email Security and Cloudflare One to prevent data loss in their corporate network.
One-click data security for your internal and SaaS applications
Protect sensitive data on any Access app for any user on any device.
Passwordless deployments to the cloud
Discovering passwords in our codebase is probably one of our worst fears. But what if you didn’t need passwords at all, and could deploy to your cloud provider another way? In this post, we explore how you can use OpenID Connect to trust your cloud provider, enabling you to deploy easily, securely and safely, while minimizing the operational overhead associated with secrets (for example, key rotat
Cloudflare DDoS threat report for 2022 Q4
In Q4, Cloudflare mitigated millions of DDoS attacks. Attack durations increase, volumetric attacks surged, and ransom DDoS attacks persist. Travel & events industries were hit hardest and over 90% of traffic to Chinese Internet properties were L3/4 DDoS attacks. Read more on our recent report.
Bring your own certificates to Cloudflare Gateway
Security and IT administrators can now bring their own custom certificates to encrypt user side connections for Zero Trust
Understanding Authentication In Websites: A Banking Analogy — Smashing Magazine
This article is Eric Burel’s attempt at making the implementation of authentication less obscure. You’ll learn about tokens, authorization, CORS, credentials, HTTP headers, and such.
Welcome to CIO Week 2023
This CIO Week we’ll demonstrate how Cloudflare is helping CIOs keep data, devices and employees both safe and fast across hybrid and remote environments. We’ll show how Cloudflare accelerates digital transformation and modernizes networking and security towards a Zero Trust model
How Cloudflare can help stop malware before it reaches your app
Today, we’re making the job of application security teams easier, by providing a content scanning engine integrated with our Web Application Firewall (WAF), so that malicious files being uploaded by end users, never reach origin servers in the first place
GitHub and the Ekoparty 2022 Capture the Flag
Learn about the design behind, and solutions to, several of GitHub’s CTF challenge for Ekoparty’s 2022 event!
GitHub’s top 10 blog posts of 2022
As the year winds down, we’re highlighting some of the incredible work from GitHub’s engineers, product teams, and security researchers.
Increase developer productivity, save time on developer onboarding, and drive ROI in 2023
Forrester’s Total Economic Impact™ study dives into how GitHub Enterprise Cloud and GitHub Advanced Security help businesses drive ROI, increase developer productivity, and save time on developer onboarding.
Not just flightless birds: How EMUs secure and scale identity and access management for your GitHub Enterprise
GitHub Enterprise has evolved to support the needs of enterprise administrators, corporate security teams, and individual developers who contribute to open source.
How we use GitHub to be more productive, collaborative, and secure
Our engineering and security teams do some incredible work. Let’s take a look at how we use GitHub to be more productive, build collaboratively, and shift security left.
Deployment Protection: Added security controls now available on all plans
Deployment protection on all plans - Secure your deployment previews and create shareable links to share with collaborators
How Linear made the most of a DDoS
A conversation with the small, but mighty web team about why they made Figma files their homepage, and how they unintentionally threw the Figma party of the year.
Leaked a secret? Check your GitHub alerts…for free
GitHub now allows you to track any leaked secrets in your public repository, for free. With secret scanning alerts, you can track and action on leaked secrets directly within GitHub.
GitHub Advanced Security customers can now push protect their custom patterns
With just one click, admins in GitHub Advanced Security organizations can protect their custom patterns on push.
How To Prioritize User Security When Collecting Offline Data — Smashing Magazine
Concerns over online privacy and security are nothing new. In this article, Suzanne Scacca explores how the right CSV importer can help businesses better prioritize user security.
Cloudflare achieves FedRAMP authorization to secure more of the public sector
Cloudflare for Government expands Cloudflare’s ability to protect and secure the Public Sector
Raising the bar for software security: next steps for GitHub.com 2FA
GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023. Learn more about our approach, when we’ll begin our rollout, and what you can expect as we begin requiring 2FA.
How Cloudflare helps secure the inboxes of democracy
Cloudflare email security tool worked hard in the 2022 midterm elections to ensure that the email inboxes of those seeking office were secure.
Expanding Area 1 email security to the Athenian Project
We are excited to share that we have grown our offering under the Athenian Project to include Cloudflare’s Area 1 email security suite to help state and local governments protect against a broad
New! Security Analytics provides a comprehensive view across all your traffic
Security Analytics gives you a security lens across all of your HTTP traffic, not only mitigated requests, allowing you to focus on what matters most: traffic deemed malicious but potentially not mitigated.
Stop attacks before they are known: making the Cloudflare WAF smarter
Today we are making the WAF smarter by increasing availability of our new machine learning powered enhancement, the WAF Attack Score!
How empowering developers helps teams ship secure software faster
AppSec expert Niroshan Rajadurai says putting developers at the center of everything will enable you to meet your security goals.
The Linux Kernel Key Retention Service and why you should use it in your next application
Many leaks happen because of software bugs and security vulnerabilities. In this post we will learn how the Linux kernel can help protect cryptographic keys from a whole class of potential security vulnerabilities: memory access violations.
Bringing authentication and identification to Workers through Mutual TLS
We’re excited to announce that Workers will soon be able to send outbound requests through a mutually authenticated channel via mutual TLS authentication!
2022 US midterm elections attack analysis
For Athenian Project and Cloudflare for Campaigns participant websites, overall traffic volume ramped as Election Day approached
Protecting election groups during the 2022 US midterm elections
We at Cloudflare are proud to be able to play a role in helping safeguard the integrity of the electoral process. Through our Impact programs, we provide cyber security products to help protect access
The importance of improving supply chain security in open source
We think a lot about a high-profile supply chain attack that might cause developers, teams, and organizations to lose trust in open source. That’s why we’re investing in new ways to protect the open source ecosystem.
GitHub Enterprise Server 3.7 is now generally available
GitHub Enterprise Server 3.7 is available now, including a single view of code risk, new forking and repository policies, and security enhancements to the management console.
How GitHub converts previously encrypted and unencrypted columns to ActiveRecord encrypted columns
This post is the second part in a series about ActiveRecord::Encryption that shows how GitHub upgrades previously encrypted and unencrypted columns to ActiveRecord::Encryption.
Cloudflare is not affected by the OpenSSL vulnerabilities CVE-2022-3602 and CVE-2022-3786
Information on CVE-2022-3602 and CVE-2022-3786, and why Cloudflare was not impacted
How we handled a recent phishing incident that targeted Dropbox
Spotify’s Vulnerability Management Platform
We started developing our vulnerability management platform (VMP) at Spotify in Q2, 2020, and now that we’ve implemented it and use the system in our day-to-day work, we wanted to take a moment to share our journey to help reduce security risks in an efficient and scalable manner.
Creating a more inclusive security research field
A glimpse into the backgrounds and day-to-day work of several GitHub employees in cybersecurity roles.
Cybersecurity spotlight on bug bounty researcher @ahacker1
As we wrap up Cybersecurity Awareness Month, the GitHub bug bounty team is excited to spotlight one of the security researchers who participates in the GitHub Security Bug Bounty Program.
Stronger than a promise: proving Oblivious HTTP privacy properties
In this blog post, we describe a formal, computer-aided security analysis of Oblivious HTTP, an emerging IETF standard that applications can use to improve user privacy
What we learned from the Security Lab’s Community Office Hours
The GitHub Security Lab provided office hours for open source projects looking to improve their security posture and reduce the risk of breach. Here’s what we learned and how you can also participate.
Why we’re excited about the Sigstore general availability
The Sigstore GA means you can protect your software supply chain today with GitHub Actions, and will power new npm security capabilities in the near future.
Hubble: Our Tool for Encapsulating and Extending Security Tools - Shopify
With the end of office centricity at Shopify, suddenly the work of securing our devices got a lot more important, and a lot more difficult. So, we built Hubble.
Introducing fine-grained personal access tokens for GitHub
Fine-grained personal access tokens offer enhanced security to developers and organization owners, to reduce the risk to your data of compromised tokens.
5 tips for embedding security into your workflows
Having a robust security plan is key to innovation. These tips will empower you to gain the upper hand on cyberattacks, so you can ship quickly and innovate with ease.
Our approach to security at speed
Learn about how the Figma security team helps us ship products securely, without impacting the pace of development.Our approach to security at speed.
Introducing GitHub Advanced Security SIEM integrations for security professionals
Learn about using GitHub Advanced Security (GHAS) alerts with Security Information and Events Management (SIEM) tools. Check out the integrations, and read more about getting started.