Tag

Software Supply Chain Security

68 articles

Latest in Software Supply Chain Security

AI Coding Assistants’ Built-In Browsers Open a Path to Developer Secrets

Security researchers uncovered a class of embedded-browser vulnerabilities affecting five popular AI coding tools, including Cursor, Copilot, Codex, VS Code and Claude Desktop. The findings reveal how malicious pages can exploit t…

Nov 2, 20263 min

All Software Supply Chain Security Articles

Showing 1–24 of 68

Nov01

IBM Extends Scope and Reach of DevSecOps Workflows in the AI Era

IBM is expanding its Terraform infrastructure-as-code platform and Bob AI coding assistant with new policy-as-code capabilities, automated vulnerability remediation and AI governan…

3 min

Oct28

Blogs

Rethinking Application Updates: Solutions for Faster, More Efficient CVE Patching

Slow CVE patching leaves applications exposed. Discover how buildpacks, shared components and AI agents can accelerate vulnerability remediation.

3 min

Oct28

Blogs

CI/CD Cache Poisoning Is No Longer a Theoretical Attack

CI/CD cache poisoning can turn untrusted code into compromised releases. Learn how to secure caches, isolate workflows and protect software supply chains.

3 min

Oct21

Blogs

GitHub Puts a Firewall Between npm and Your CI Runners

GitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detectio…

3 min

Oct19

Blogs

From Static Scans to Runtime Awareness: The Next Phase of Software Supply Chain Security

A growing wave of software supply chain attacks, including Shai-Hulud, Axios and LiteLLM, is exposing weaknesses in conventional security tooling. Malicious open-source packages ca…

3 min

Oct14

Noma Security Discloses Claude Code Desktop Exploit

Security researchers at Noma Security uncovered SneakPeek, a vulnerability in Anthropic’s Claude Code Desktop that allowed malicious JavaScript embedded in large HTML files to bypa…

3 min

Oct14

Blogs

GitHub Ties Every Commit to the Account That Pushed It

GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer informat…

3 min

Oct01

Blogs

DevOps Dozen 2026 Nominations Are Open: Recognizing the People and Technology Moving DevOps Forward

When we launched the DevOps Dozen in 2015, we wanted to recognize the people, projects and companies helping this community move forward. We saw the work happening across DevOps ev…

3 min

Sep24

Why Software Supply Chain Security Is Moving to the Gate

March 2026: malicious versions of axios get published directly to npm. May 2026: attackers forge valid provenance for 42 TanStack packages on npm, with 84 malicious versions shippe…

3 min

Sep24

Blogs

GitHub Gives Enterprises a Full Count of Who Holds the Keys

GitHub Enterprise Cloud now lets organizations export a full inventory of credentials, helping security teams identify stale, overprivileged and forgotten access across users, apps…

3 min

Sep23

Cycode Extends DevSecOps Reach to Software Packages Developers Download

Cycode is adding workstation-level protection to stop developers and AI coding agents from downloading malicious or insufficiently vetted software packages.

3 min

Sep23

Blogs

Why Shift Left is Dead

AI-driven development is exposing risks before code is written, forcing security teams to move beyond shift-left and govern agents, prompts, tools and data across the entire develo…

3 min

Sep11

Blogs

GitHub Widens the Door on Advanced Security Trials

GitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free.

3 min

Aug31

Broadcom Launches Trusted Artifact Service for Spring Framework

Broadcom launches TrueSource Trusted Artifacts to provide hardened Spring dependencies, secure open source packages and automated vulnerability remediation.

3 min

Aug21

Blogs

Why Cryptographic Inventory Is the First Step Toward Quantum Readiness

Post-quantum readiness starts with visibility. DevOps teams need a continuous cryptographic inventory to map algorithms, keys, certificates, libraries, infrastructure and third-par…

3 min

Aug13

The Agent Proposes, the Pipeline Disposes: Controls for AI-Authored Change

When agents write code and open pull requests faster than humans can read them, ‘the diff looked fine’ stops being a control. The durable controls live outside the agent’s reasonin…

3 min

Aug04

Blogs

Shift Left Security: 4 Automated Security Gates in GitHub Actions

Learn how to add four automated security gates to GitHub Actions using npm audit, Snyk, Trivy, CodeQL and OWASP ZAP—without an enterprise licence.

3 min

Jul31

CISA’s 2026 SBOM Guidance Adds Hash Requirements and AI Coverage

CISA’s updated 2026 SBOM minimum elements expand software transparency requirements to AI, SaaS and open source while adding hashes, licenses and stronger validation.

3 min

Jul27

Blogs

GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks

GitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads.

3 min

Jul22

Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem

A developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma…

3 min

Jun12

Blogs

Why Endpoint Protection Matters More than Ever in CI/CD Environments

CI/CD environments depend on far more than repositories and deployment infrastructure. Developer endpoints hold sensitive data: cloud credentials, SSH keys, deployment permissions,…

3 min

Jun09

Blogs

GitHub Takes Down 73 Microsoft Repos After Miasma Worm Attack

GitHub pulled 73 Microsoft repositories offline after the self-replicating Miasma worm weaponized IDEs and AI coding tools to harvest developer credentials.

3 min

Apr02

Blogs

Survey Surfaces Increased Reliance on Open Source Software to Build Apps

Open source adoption is surging, with 49% of IT teams increasing usage. However, 47% of staff spend 75% of their time on maintenance. Explore the impact of AI threats and EU regula…

3 min