[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f86AwZ-Yd9fbZvnQkVgZJxrR0KakYp4Z2cmYyLzlAhuY":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"c23ff7b9-1cac-4586-9585-589273e08fe5","Undead Software Projects Continue to Raise Security Risks","undead-software-projects-continue-to-raise-security-risks-8f5324","A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.","A security firm recently patched a vulnerability in a decade-old application, demonstrating the ongoing security risks posed by abandoned software projects. Attackers can exploit abandoned domains associated with these projects to gain control of millions of machines, underscoring the need for diligent maintenance and monitoring of even legacy software.","Security firm patched a decade-old app, highlighting risks from abandoned domains.","https:\u002F\u002Fwww.darkreading.com\u002Fapplication-security\u002Fundead-software-projects-raise-security-risks","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fbltd40811c92b905082\u002F6ae3b49914ffedf86f1c84cc\u002Fzombies-in-graveyard-zef_art-shutterstock.jpg?width=720&quality=80&disable=upscale","2026-10-30T14:10:37+00:00","2026-10-30T15:00:22.378049+00:00",7,[17],{"name":18,"type":19},"software","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":20,"icon":22,"name":23,"slug":24},null,"Vulnerabilities","vulnerabilities",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":41,"vendors":127},[42,71,99],{"slug":43,"name":44,"problem":45,"products":46},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":72,"name":73,"problem":74,"products":75},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":94,"url":97,"description":98},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":37,"name":100,"problem":101,"products":102},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":140},"abandoned-software-projects-create-lasting-security-vulnerabilities","Abandoned Software Projects Create Lasting Security Vulnerabilities","A decade-old application required patching after researchers identified an exploitable vulnerability, highlighting how legacy and abandoned software remains a persistent attack surface. Attackers can seize control of expired or abandoned domains associated with these projects, potentially hijacking update mechanisms or package distributions to compromise millions of downstream machines. Organizations often deprioritize legacy software maintenance, mistakenly assuming low-usage systems pose minimal risk. This incident underscores that software without active stewardship is not merely a technical liability — it is an open door for large-scale supply chain-style attacks.",[133,134,135,136,137,138,139],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 2: Inventory and Control of Software Assets","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":141,"PCI DSS Requirement 6":142,"NIST SP 800-53 SI-2: Flaw Remediation":143,"OWASP A06:2021 Vulnerable and Outdated Components":144,"CIS Control 7: Continuous Vulnerability Management":145,"CIS Control 2: Inventory and Control of Software Assets":146,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":147},"NIS2 mandates that essential and important entities handle incidents and maintain security across their full asset lifecycle, including legacy systems that pose ongoing supply chain risks.","Requirement 6 mandates that organizations develop and maintain secure systems and software, including processes to identify and protect against known vulnerabilities in all deployed applications regardless of age.","SI-2 requires organizations to identify, report, and correct information system flaws on a timely basis, which would have mandated a process for tracking and patching even legacy application vulnerabilities.","This category directly addresses the risk of using abandoned or unmaintained software components, which is the precise mechanism through which this vulnerability persisted for years.","Regular, automated vulnerability scanning of all assets — including legacy applications — would have identified the decade-old flaw and prioritized it for remediation before attackers could exploit it.","Maintaining a comprehensive, up-to-date software inventory with assigned ownership would have ensured the abandoned application was flagged, monitored, and either patched or retired.","This control requires timely identification and remediation of technical vulnerabilities across all assets, explicitly covering legacy systems that organizations might otherwise neglect."]