Blog | ReversingLabs | Paul Roberts

Paul Roberts

Director of Content and Editorial at RL. Paul is a reporter, editor and industry analyst with 20 years’ experience covering the cybersecurity space. He is the founder and editor in chief at The Security Ledger, a cybersecurity news website. His writing about cyber security has appeared in publications including Forbes, The Christian Science Monitor, MIT Technology Review, The Economist Intelligence Unit, CIO Magazine, ZDNet and Fortune Small Business. He has appeared on NPR’s Marketplace Tech Report, KPCC AirTalk, Fox News Tech Take, Al Jazeera and The Oprah Show.

Find Paul Roberts on: LinkedIn

Recent Posts from Paul Roberts

Malicious Python packages target popular Bitcoin library

April 3, 2025

Malicious Python packages target popular Bitcoin library

RL researchers detected two Python libraries that are designed to steal sensitive data while posing as fixes for a popular cryptocurrency library.

Less malware, more risk: The changing face of open-source security

March 19, 2025

Less malware, more risk: The changing face of open-source security

Instances of malware on open-source software repositories dropped in 2024 — but OSS risk is on the rise. Here’s what you need to know.

Hidden threats lurk in commercial software: How to manage risk

March 12, 2025

Hidden threats lurk in commercial software: How to manage risk

While open-source software risks are not going away, attack trends show third-party software presents the greatest risk to the enterprise.

SEC action raises the bar on software transparency

December 10, 2024

SEC action raises the bar on software transparency

The firms have been fined for playing down the impact of the attack on SolarWinds. It’s part of a government push for greater transparency.

Malware found in Solana npm library raises the bar for crypto security

December 5, 2024

Malware found in Solana npm library raises the bar for crypto security

Two recent versions of the Solana web3.js open source library were infected with code to steal private keys, putting crypto platforms and wallets at risk.

Downgrade attacks open patched systems to malware

November 6, 2024

Downgrade attacks open patched systems to malware

Researcher Alon Leviev warns that the Microsoft Windows compromise posed risks that were structural — stretching well beyond the specific flaws.

When hackers get hacked: Sam Curry on his career — and his latest research

October 1, 2024

When hackers get hacked: Sam Curry on his career — and his latest research

In this latest ConversingLabs podcast, the independent security researcher shares insights into his intriguing journey — and his latest research.

Hacker Summer Camp: Reboot needed to tackle software supply chain threats

August 13, 2024

Hacker Summer Camp: Reboot needed to tackle software supply chain threats

Leaders from the private sector and government called for a rethink of outdated security tools and practices in an age of API-driven services and AI.

The big cybersecurity themes at Black Hat 2024 — and why they matter

July 31, 2024

The big cybersecurity themes at Black Hat 2024 — and why they matter

The state of supply chain security is broken, and that leaves Black Hat attendees with a sense of urgency — and lots to discuss. Here are two main themes.

NSA: Nation state actors aren't after your data — they want your OT

May 9, 2024

NSA: Nation state actors aren't after your data — they want your OT

APT actors are thinking beyond data theft and targeting CI. That means you need to look deeper and longer for signs of compromise, the NSA said at RSAC.

Verizon 2024 DBIR: Software supply chain risks fuel a data breach epidemic

May 2, 2024

Verizon 2024 DBIR: Software supply chain risks fuel a data breach epidemic

The new Data Breach Investigations Report sounds the alarm over software supply chain security — and calls for higher standards for development organizations.

XZ Trojan highlights software supply chain risk posed by 'sock puppets'

April 11, 2024

XZ Trojan highlights software supply chain risk posed by 'sock puppets'

There is no fool-proof method to identify phony developer accounts — but there are telltale signs. Threat researchers share three key indicators.