CISA urges software devs to weed out SQL injection vulnerabilities

CISA and the FBI issued a joint alert urging technology manufacturers to eliminate SQL injection (SQLi) vulnerabilities following Clop ransomware group's mass exploitation of a zero-day SQLi in Progress MOVEit that enabled extensive data theft and high-value extortion; the agencies recommend secure-by-design practices such as parameterized queries and prepared statements to prevent SQLi and reduce future risk.