[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F16":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","16","Control 16","Application Software Security",770,"Center for Internet Security (CIS)","**What it asks for.** Organisations should manage the security life cycle of software they develop, host or acquire to prevent, detect and fix weaknesses before they cause harm. It covers secure development processes, third party components and vulnerability handling.\n\n**In practice.** Good practice includes a documented secure development process, threat modelling for significant changes, code review and automated testing such as static and dynamic analysis, and an inventory of third party components with tracking of their vulnerabilities. Developers receive secure coding training, environments are separated, and a process exists for receiving and fixing reported vulnerabilities. Evidence includes pipeline configurations, test results, component inventories and records of fixed vulnerabilities.\n\n**Common gaps.** Third party dependencies are often unmanaged and scan findings pile up without triage. Security testing tends to cover the main application while internal tools and scripts are ignored.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fapplication-software-security","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":23,"title":24,"published_at":25},"federal-agencies-issue-cybersecurity-guidance-for-frontier-ai-systems","Federal Agencies Issue Cybersecurity Guidance for Frontier AI Systems","2026-10-17T02:20:17.238+00:00",{"slug":27,"title":28,"published_at":29},"openbsd-root-exploit-chains-decades-old-bug-to-bypass-kernel-protections","OpenBSD Root Exploit Chains Decades-Old Bug to Bypass Kernel Protections","2026-10-16T20:20:45.22+00:00",{"slug":31,"title":32,"published_at":33},"nist-nsa-cisa-issue-guidance-on-ai-incident-readiness-for-high-risk-ai-systems","NIST, NSA & CISA Issue Guidance on AI Incident Readiness for High-Risk AI Systems","2026-10-16T18:21:54.014+00:00",{"slug":35,"title":36,"published_at":37},"governing-open-weight-ai-models-requires-structured-enterprise-risk-frameworks","Governing Open-Weight AI Models Requires Structured Enterprise Risk Frameworks","2026-10-16T18:21:38.63+00:00",{"slug":39,"title":40,"published_at":41},"aomei-backupper-update-servers-hijacked-to-distribute-backdoor","AOMEI Backupper Update Servers Hijacked to Distribute Backdoor","2026-10-16T18:21:08.893+00:00",{"slug":43,"title":44,"published_at":45},"claude-code-desktop-flaw-enabled-html-based-credential-theft","Claude Code Desktop Flaw Enabled HTML-Based Credential Theft","2026-10-16T18:20:18.997+00:00",{"slug":47,"title":48,"published_at":49},"ics-sniper-xworm-rce-and-ai-introduced-software-flaws-highlight-diverse-attack-surface","ICS-Sniper, XWorm RCE, and AI-Introduced Software Flaws Highlight Diverse Attack Surface","2026-10-16T16:20:31.539+00:00",{"slug":51,"title":52,"published_at":53},"eclipse-milo-vulnerabilities-enable-data-loss-impersonation-and-dos","Eclipse Milo Vulnerabilities Enable Data Loss, Impersonation, and DoS","2026-10-15T18:21:51.861+00:00",{"slug":55,"title":56,"published_at":57},"malicious-aur-packages-execute-root-level-malware-via-typosquatting","Malicious AUR Packages Execute Root-Level Malware via Typosquatting","2026-10-15T18:20:20.988+00:00",{"slug":59,"title":60,"published_at":61},"pythons-new-startup-files-reduce-but-dont-eliminate-supply-chain-risk","Python's New Startup Files Reduce But Don't Eliminate Supply Chain Risk","2026-10-15T16:21:36.544+00:00",{"slug":63,"title":64,"published_at":65},"cikabika-rat-abuses-discord-and-ngrok-to-evade-detection","CikaBika RAT Abuses Discord and Ngrok to Evade Detection","2026-10-15T12:20:40.147+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",275,{"slug":73,"name":74,"problem":75,"stories":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",270,{"slug":78,"name":79,"problem":80,"stories":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",215,{"slug":83,"name":84,"problem":85,"stories":86},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",156,{"slug":88,"name":89,"problem":90,"stories":91},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",139,{"slug":93,"name":94,"problem":95,"stories":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",125,[98,104,109,115,120,126,131,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"gdpr","32","Article 32","Security of processing",324,{"family":5,"item":105,"code":106,"title":107,"together":108},"2","Control 2","Inventory and Control of Software Assets",314,{"family":110,"item":111,"code":112,"title":113,"together":114},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",297,{"family":5,"item":116,"code":117,"title":118,"together":119},"7","Control 7","Continuous Vulnerability Management",237,{"family":121,"item":122,"code":123,"title":124,"together":125},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",208,{"family":110,"item":127,"code":128,"title":129,"together":130},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",193,{"family":132,"item":122,"code":133,"title":133,"together":134},"itil","ITIL",182,{"family":136,"item":137,"code":138,"title":139,"together":140},"nist-800-53","ac-6","AC-6","Least Privilege",154]