139 results

Weaponizing the Exit: Input Privacy Leakage via Exit Routing Manipulation in Multi-Exit Networks

arXiv:2610.31246v1 Announce Type: new Abstract: Multi-exit networks improve inference efficiency by allowing inputs to terminate early at intermediate exits. We identify a privacy vulnerability in cloud deployments of these networks: a mali

The adversary economy: How threat actors are reacting to PHP2Shell

Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. Key takeaways The

CVE-2026-109618 · CVE-2026-109619

Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain

arXiv:2610.28794v1 Announce Type: new Abstract: Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the Shai-Hulud worm and the Axios compromise demo

PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks

arXiv:2609.13719v2 Announce Type: replace Abstract: Open-source software ecosystems are web-scale dependency networks. A downstream package can become exposed to security risk not because its own source code changes, but because one of its

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

In this article What's happening What is ARTEX? Mitigation and protection guidance References Learn more As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automat

Shadow AI Detection Now Extends to Developer Workstations

ZIP files shared between co-workers containing new agent skills, locally-developed MCP servers passed between developers, and locally stored newly-minted agents are all seemingly harmless files that are commonly used in corporate software d

Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals

arXiv:2606.17562v2 Announce Type: replace Abstract: LiDAR sensors are widely deployed in autonomous systems for safety-critical 3D perception. We identify a previously unexplored attack surface in which dormant malware, embedded in the LiDA

Unpacking Security Scanners for GitHub Actions Workflows

arXiv:2601.14455v3 Announce Type: replace-cross Abstract: GitHub Actions is a widely used platform to automate the build and deployment of software projects through configurable workflows. As the platform's popularity grows, it also becomes

Oracle October 2026 Critical Patch Update Addresses 1209 CVEs

Oracle addresses 1209 CVEs in its final quarterly update of 2026 with 1295 patches, including 112 critical updates. Key Takeaways The October 2026 Critical Patch Update (CPU) contains fixes for 1209 unique CVEs in 1295 security update

Supply Chain Zero Days: Closing the Gap Between Publication and Detection

When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz's supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply

Bring Your Own Vulnerable Driver: What Detection Teams Should Actually Hunt

Bring your own vulnerable driver (BYOVD) is having a moment in endpoint security. Some of the buzz is earned. Some of it is overblown. This series unpacks both and shows the evidence for each. This piece turns the noise into specific behavi

Can SOLARBURST go silicon? A systematic analysis on software supply chain attacks for VLSI design flows

arXiv:2610.22580v1 Announce Type: new Abstract: An attacker targeting the software supply chain (SWSC) of VLSI tools can fully subvert the VLSI design pipeline through purely software level compromises. However, cur- rent literature on both

Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP

Last month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity's discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google Chrome and Microsoft Windows in cam

The Good, the Bad and the Ugly in Cybersecurity - Week 42 (2026)

The Good | Authorities Arrest Cyber Exec for Extortion & Dismantle DPRK Laptop Farms The FBI arrested Edward Dubrovsky, a Canadian former cybersecurity executive at incident response and ransomware negotiation firm CYPFER , on charges of co

Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown

At JFrog's swampUP 2026 conference in New York, security leaders gathered to tackle the rapidly evolving landscape of software supply chain security and AI-driven development. In this exclusive sit-down interview from the event, former Sola

Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Overview On October 12, 2026, GitLab released 19.4.2 , 19.3.5 , and 19.2.8 to fix CVE-2026-97229 , an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar . GitLab assigned it a CVSS

CVE-2026-97229

GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement

arXiv:2505.11016v2 Announce Type: replace Abstract: Modern software supply chain attacks consist of introducing new, malicious capabilities into trusted third-party software components, in order to propagate to a victim through a package de

Autonomous OSS Threat Detection via Taxonomy-Aligned LLMs

arXiv:2610.01263v2 Announce Type: replace Abstract: Open-source software (OSS) ecosystems face escalating supply chain threats, including typosquatting, dependency confusion, Trojan Source obfuscation, malicious build injection, and CI/CD p

Pricing the Unprovable: Ambiguity, Turnstile Runs, and the Verifiability Discount in Crypto Protocols

arXiv:2610.21540v1 Announce Type: cross Abstract: Privacy-preserving protocols can repair a vulnerability without establishing whether it was exploited beforehand, even when no theft is reported and aggregate supply is protected. We call th

Declared but Unaccountable: Measuring the Seller-Identity Gap in Advertising Supply-Chain Transparency

arXiv:2610.14661v2 Announce Type: replace-cross Abstract: Public advertising transparency relies on a minimum accountability condition: an account authorized by a publisher in ads$.$txt or app-ads$.$txt should appear in the applicable selle

JFrog Business Value Center: Celebrate the ROI of Your Software Supply Chain

You already know the effectiveness of the JFrog Platform - blocking risky packages, speeding up builds, securing the supply chain, providing end-to-end governance and so much more. But when it comes time to renew the license, a new VP may a

What You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply Chains

arXiv:2610.19498v1 Announce Type: new Abstract: Model signing authenticates the full-precision weights W an LLM is released with, yet users run a quantized artifact Q whose producing transformation is not uniquely determined under current d

Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry

Bring your own vulnerable driver (BYOVD) is having a moment in endpoint security. Some of the buzz is earned. Some of it is overblown. This series unpacks both and shows the evidence for each. This piece traces how the technique scaled into

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Overview On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229 , an integer overflow or wraparound ( CWE-190 ) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Editi

CVE-2026-97229

Governing the Agentic SDLC Through Continuous Policy Enforcement

The way software gets built has changed faster than the standards that govern it. AI agents now create pull requests, select dependencies, refactor codebases, interpret test failures, and execute infrastructure changes across the entire Sof

Post-quantum authentication: Why organizations should start testing certificate ecosystems now

In this article Why post-quantum authentication presents a different challenge Why organizations should begin preparing now Microsoft's perspective on readiness Testing the future certificate ecosystem Expanding end-to-end testing What orga

Mend.io upgrades 184 open source organizations to the Renovate Community (OSS) plan

Mend.io has proactively upgraded 184 open source organizations and GitHub users to the Mend Renovate Community (OSS) plan, with no request required. The upgrade covers about 3,000 repositories with roughly 4 million combined GitHub stars. M

Inside the Exchange Inspector: How Tenable uses OpenAI GPT cyber models to review open-source AI agents

Community-built AI agents, skills, and MCP servers are landing in SOC workflows fast. Here's what the Exchange Inspector tests before a listing earns its vetted tag on the CyberAgents Exchange.  Three tools have already passed. Ke

Evolution of Web3 in Cloud Supply Chain Attacks

Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42 .

NIST SSDF: 4 core practices for secure software development

What is the NIST Secure Software Development Framework (SSDF)? The NIST Secure Software Development Framework (SSDF) is a set of fundamental, outcome-based practices that integrate security throughout the software development lifecycle (SDL

The Good, the Bad and the Ugly in Cybersecurity - Week 39 (2026)

The Good | U.S. Court Sentences Initial Access Specialist Tied to Ryuk Ransomware A court has sentenced Armenian citizen Karen Serobovich Vardanyan to two years in federal prison and three years of supervised release for his role in launchi

What Is AI Governance? A Practical Framework for Security Teams

The speed of AI integration is rapidly outpacing corporate governance capabilities. Generative AI is now embedded in development workflows and business applications, while agentic AI can make decisions and take actions with limited human in

Insights from the 2026 Microsoft Digital Defense Report

Every year, the Microsoft Digital Defense Report gives us an opportunity to step back from individual threats and look broadly at what Microsoft's security and threat intelligence teams are seeing. Today, we released the 2026 Report , which

Preparing governments for an era of interconnected cyber risk

According to this year's Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. Governments are also the most

Preparing governments for an era of interconnected cyber risk

According to this year's Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. Governments are also the most

Insights from the 2026 Microsoft Digital Defense Report

Every year, the Microsoft Digital Defense Report gives us an opportunity to step back from individual threats and look broadly at what Microsoft's security and threat intelligence teams are seeing. Today, we released the 2026 Report , which

Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts

Secure your Kubernetes supply chain with WizOS Helm Charts. Eliminate hidden CI/CD risks and unmaintained dependencies with hardened, signed, and CVE-scanned charts for seamless Kubernetes deployment.

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred t

The New Rules of Patching: When a Fix Becomes a Blueprint for Attackers

TL;DR: Frontier AI has collapsed the vulnerability exploit window from weeks to mere hours. Attackers now use advanced AI models to reverse-engineer published fixes and generate working exploits faster than human security teams can deploy u

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

In this article Observed operators and targeting Malware packaging and distribution NeedyMantis architecture and capabilities Mitigation and protection guidance Hunting queries Indicators of compromise Microsoft Threat Intelligence has iden

Why are SBOMs failing to stop supply chain attacks?

A software bill of materials (SBOM) could prevent most supply chain attacks. Let's analyze what's holding back their broader adoption.

Oracle September 2026 Critical Security Patch Update addresses 672 CVEs

Oracle addresses 672 CVEs in its September 2026 Critical Security Patch Update with 673 patches, including 104 critical updates. Key Takeaways The September 2026 Critical Security Patch Update (CSPU) contains fixes for 672 unique CVEs

Extending the Single Source of Truth to the Agentic Software Supply Chain

Every developer on your team now runs multiple agents. None of them are waiting for human sign-off to act. That's exactly the gap we discussed and closed at swampUP 2026 . JFrog unveiled new capabilities that extend the JFrog Platform as no

Live From the Show Floor: swampUP 2026

Live updates from this event have concluded. swampUP 2026 is officially LIVE in New York City! Three days, one stage, one mission: rebuild trust for a software supply chain that increasingly ships itself. Keynote updates land here as they h

DevGovOps: How the AI Era Dictates That Governance Lives Inside the Pipeline

For decades, proving compliance meant having a person behind every decision - an engineer who remembered the approval, an auditor who could call someone and get an answer. That model worked because humans wrote, reviewed, and shipped every

Every New Compliance Framework Restarts the Same Fire Drill. It Doesn’t Have To.

Every compliance audit starts the same way: Someone flags a deadline, the team scrambles to pull evidence, map controls, and prove that the policies running in production actually match what the framework requires. They make it through. The

The Good, the Bad and the Ugly in Cybersecurity - Week 35 (2026)

The Good | Authorities Launch New Operations Against Cybercrime Networks & Supply Chain Attackers Operation Jackal IV, coordinated by INTERPOL across 22 nations, has led to the arrest of 58 individuals and the identification of over 200 sus

OpenClaw went viral. Meet the maintainers building and securing it.

What began as a personal experiment quickly became a global open source project with extraordinary momentum. OpenClaw is a personal AI assistant that runs on users' devices and connects with the messaging channels they already use. Started