InfoQ Homepage Application Security Content on InfoQ
-
Cursor 1.7 Adds Hooks for Agent Lifecycle Control
Cursor has introduced a Hooks system in version 1.7 that allows developers to intercept and modify agent behavior at defined lifecycle events. Hooks can be used to block shell commands, run formatters after edits, or observe agent actions in real time.
on Oct 01, 2025 -
Linux Security Tools Bypassed by io_uring Rootkit Technique, ARMO Research Reveals
Security researchers at ARMO have uncovered a significant vulnerability in Linux runtime security tools that stems from the io_uring interface, an asynchronous I/O mechanism that can completely bypass traditional system call monitoring. The research demonstrates how attackers can exploit this blind spot to operate undetected by most existing security solutions.
on Sep 16, 2025 -
Agentic AI Expands into SecOps to Ease Human Workloads
Agentic AI is beginning to reshape malware detection and broader security operations. These systems are being used not to replace humans, but to take on the lower value jobs that have historically tied up analysts — from triaging alerts to reverse-engineering suspicious files.
on Sep 02, 2025 -
Supply Chain Security: Provenance Tools Becoming Standard in Developer Platforms
Software provenance is gaining new importance as organizations look for ways to secure their supply chains against tampering and comply with emerging standards like SLSA.
on Aug 19, 2025 -
"A Security Nightmare": Docker Warns of Risks in MCP Toolchains
A new blog post from Docker warns that AI-powered developer tools built on the Model Context Protocol (MCP) are introducing critical security vulnerabilities — including real-world cases of credential leaks, unauthorized file access, and remote code execution.
on Aug 04, 2025 -
Kubernetes Introduces Post-Quantum Support for TLS
A recent Kubernetes enhancement aims to pave the way to future-proofing cluster security against quantum computing threats. In a blog post, the Kubernetes community highlighted support for post-quantum cryptography (PQC) via a hybrid key exchange mechanism integrated with the Kubernetes Key Management Service (KMS) plugin system.
on Jul 28, 2025 -
Uber Unveils Multi-Cloud Secrets Management Platform to Secure 150,000+ Credentials
Uber has revealed details of its internally developed Multi-Cloud Secrets Management Platform, designed to address the security challenges of managing over 150,000 secrets across its massive distributed infrastructure. The platform represents a significant evolution in how large-scale technology companies approach credential security in multi-cloud environments.
on Jul 25, 2025 -
Guardian's Secure Messaging: Open Source Messaging Uses Millions of App Users as Traffic Cover
The Guardian has recently released Secure Messaging, a highly secure and user-friendly tool designed to protect journalistic sources by concealing the very fact that messaging is occurring. The open source project achieves strong plausible deniability by generating bait traffic through the routine activity of existing users of The Guardian's mobile app.
on Jul 12, 2025 -
AWS Shield Network Security Director: Network Topology Visibility and Remediation Guidance
Introducing AWS Shield Network Security Director: a game-changer in DDoS protection and network security visibility. This innovative feature automates resource discovery, evaluates configurations against best practices, and prioritizes security findings. With actionable remediation steps and natural language queries via Amazon Q Developer, organizations can enhance their security posture.
on Jun 22, 2025 -
Docker Launches Hardened Base Images
Docker has launched its Docker Hardened Images (DHI), a security-focused range of base images that reduce vulnerabilities by up to 95%. Built using a distroless approach, these minimal images eliminate unnecessary components, offering automatic patching and compatibility with existing Dockerfiles. Ideal for regulated environments, DHI enhances software supply chain security and transparency.
on Jun 21, 2025 -
Goodbye CVE? European Vulnerability Database EUVD Now Live
The European Union Agency for Cybersecurity (ENISA) has recently launched the beta of the European Vulnerability Database (EUVD), a new public platform operating alongside, but independently from, the widely used Common Vulnerabilities and Exposures (CVE) system. The new platform aims to improve coordination and transparency in vulnerability handling within the EU.
on Jun 03, 2025 -
Have I Been Pwned 2.0 Adds New Tools for Data Breach Monitoring
Have I Been Pwned (HIBP) - the widely used data breach notification service created by security expert Troy Hunt, has launched a major front-end redesign in version 2.0, introducing several new features aimed at improving how individuals and organizations monitor breach exposure.
on Jun 01, 2025 -
Docker Introduces Hardened Images to Strengthen Container Security
Docker has launched Docker Hardened Images, a catalog of enterprise-grade, security-hardened container images designed to protect against software supply chain threats. By relieving DevOps teams from the chore of securing their containers on their own, hardened images provide an easier way to meet enterprise-grade security and compliance standards, Docker says.
on May 21, 2025 -
QCon London 2025 Day 3: AMQP Politics, Serverless Databases, Betrayal in Security and Architecture
The 19th annual QCon London conference took place at The Queen Elizabeth II Conference Centre in London, England. This three-day event, organized by C4Media, consists of presentations by expert practitioners. Day Three, scheduled on April 9th, 2025, included two keynote addresses by John O'Hara and Hannah Foxwell and presentations from five conference tracks.
on May 02, 2025 -
QCon London: a Three-Step Blueprint for Managing Open Source Risk
At QCon London 2025, Johnson Matthey's vulnerability manager, Celine Pypaert, discussed managing open-source dependency risks while maintaining momentum in innovation. She described a three-part blueprint for handling the security challenges that arise with the now widespread use of open-source dependencies.
on Apr 08, 2025