Tag

Software Supply Chain

121 articles

Latest in Software Supply Chain

Blogs

Malicious Claude Code Extension Affects Up to 5,000 Cursor Users

Cursor has disclosed a security incident involving malicious versions of Anthropic’s Claude Code extension that attempted to install a persistent backdoor on developers’ computers. The company initially estimated that up to 5,000…

Oct 30, 20263 min

All Software Supply Chain Articles

Showing 1–24 of 121

Oct29

Blogs

Design and Specifications Are Not What Is in Your Infrastructure

Cyber Asset Intelligence helps CTOs uncover hidden dependencies, reduce technical debt and make smarter architecture decisions with runtime visibility.

3 min

Oct27

Blogs

Reddit’s r/opensource AI Ban Targets the Wrong Problem

Reddit’s largest open-source community is cracking down on AI-generated projects, prompting criticism over sweeping restrictions that could exclude legitimate developers. As Linux…

3 min

Oct06

Blogs

Security Teams Are Fixing Vulnerabilities Faster Than Ever. So Why Is Software Getting Riskier?

AI is speeding up dependency decisions, making point-of-selection security essential for reducing vulnerable components, downstream tickets and avoidable rework.

3 min

Sep28

Blogs

Survey: Lack of Confidence in Software Supply Chain Security Runs High

A survey of 400 platform and security engineers in the U.S and United Kingdom (UK), finds nearly three quarters (73%) are either only moderately confident (58%) or not confident (1…

3 min

Sep25

Blogs

Leaked GitLab Email Tokens Can Reach Code, Secrets and CI/CD Pipelines

Security researchers have uncovered a GitLab behavior that could let attackers use a leaked project email address to push code, trigger CI/CD jobs and reach other repositories acce…

3 min

Sep25

Blogs

DevSecOps Teams as Partners in Secure Software Delivery

DevSecOps teams can reduce last-minute release delays by shifting security decisions earlier, improving guardrails, clarifying ownership and making findings actionable.

3 min

Sep23

Blogs

Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters

ZCode’s default-on indexing feature reportedly uploaded entire developer workspaces to cloud storage, highlighting why AI coding assistants should be treated as privileged software…

3 min

Sep21

Blogs

Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent

Two patched OpenAI Codex vulnerabilities, Heapjack and Overpatch, exposed how coding agents can escape sandboxes and reach developer systems without approval prompts.

3 min

Sep21

Blogs

GitHub Separates Who Writes Code From Who Runs Your CI

GitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security.

3 min

Sep18

Blogs

Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface

CI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern…

3 min

Sep14

Blogs

More JFrog Artifactory Bugs Are Under Attack, and All Three Have Patches

Attackers are actively exploiting three JFrog Artifactory flaws, exposing how slow patching can turn artifact repositories into software supply chain attack paths.

3 min

Sep14

Blogs

GitLab’s Critical Patch Closes a Path Traversal Flaw Attackers Are Already Probing

GitLab patches two critical flaws, including a CVSS 10.0 unauthenticated file-read vulnerability, putting self-managed instances under urgent pressure to upgrade.

3 min

Sep11

Blogs

GitHub’s August Outages Show Growth Is Outpacing Infrastructure

GitHub’s August 2026 report details five outages tied to Actions and Copilot growth outpacing infrastructure. Here’s what platform teams should know.

3 min

Sep10

Blogs

Why AI Agents Shouldn’t Guess at Vulnerability Exploitability

Vulnerability prioritization is not a language problem. The safest agent architectures use models to interpret and explain, while deterministic systems traverse the evidence. Ask a…

3 min

Sep08

Blogs

EU-Funded CodeSupply Offers Grants for Open Source Software Supply Chain R&D

Software supply chain, security and compliance tools all depend on accurate information about the packages they analyze, but that data is often fragmented across multiple sources a…

3 min

Sep02

Blogs

CrowdStrike Moves to Secure Software Supply Chains at the Endpoint

CrowdStrike today at its Fal.con 2026 conference extended its reach into the realm of software supply chain security with the addition of an offering that blocks malicious open-sou…

3 min

Aug27

When AI Coding Agents Become Malware Delivery Systems

AI coding agents are becoming part of everyday development work. Developers use them to find libraries, configure projects, troubleshoot installation problems, and set up new tools…

3 min

Aug25

Blogs

Report Shines Spotlight on 91 Vulnerabilities Fixed in Latest Update to Spring Framework

Sonatype says 91 Spring vulnerabilities affecting more than 209,000 software components highlight how AI is accelerating vulnerability discovery and creating a new patching challen…

3 min

Aug17

Blogs

Is Your New DevSecOps Tooling Reducing Work Or Just Adding to It?

Security belongs in the software delivery pipeline. The harder question is where, how often and at what cost. Many pipeline teams eventually add security scanning to CI/CD, and rel…

3 min

Aug12

Blogs

Why CI/CD Security Testing Is Going Autonomous (and Why It Should Stay Local)

Continuous integration and delivery changed the tempo of software. Teams merge dozens of times a day, infrastructure is redefined on every commit, and a new build can reach product…

3 min

Jul31

Blogs

Open Source Code Just as Secure as Proprietary Software—If You Manage It Right, Says CISA

Open source can be just as safe as proprietary software, though government agencies (and private enterprises) should take additional measures to secure it properly, according to a…

3 min

Jul23

Blogs

The Trust Graph: Why Infrastructure Diagrams No Longer Describe Modern Systems

Traditional architecture diagrams miss the identity relationships that now drive breaches and outages. Platform teams need trust graphs that map who and what can act across modern…

3 min

Jul21

Blogs

Zero Trust Starts at the Code: Building Secure Systems with PKI and DevOps Automation

When a certificate expires, it can take down a production system, and teams usually only find out after something goes wrong. These issues are hard to catch because they rarely tri…

3 min