Frameworks, analysis, and guidance across TPRM, supply chain risk, and vendor governance.
Software Supply Chain SecurityWhen GitHub re-enabled two compromised Actions on September 16 without cleaning their malicious payloads, workflows resumed executing Mini Shai-Hulud code for nine days. This incident exposed roughly
Software Supply Chain SecurityA recent Checkmarx report uncovered a new npm malware campaign using blockchain for command-and-control (C2) operations. This campaign affected nine packages, with one reaching over 1.9 million downlo
Incident ManagementWhat Happened In September 2025, a ransomware attack forced Jaguar Land Rover to shut down its UK plants, halting production of about 1,000 luxury vehicles per day. This disruption affected over 5,000
Monitoring & PerformanceThe Visibility Gap Your team can see disruptions. Real-time dashboards flag capacity constraints, border closures, and rate spikes. But between identifying the problem and solving it, there s a gap. Y
Get weekly security insights and compliance updates delivered to your inbox.
Incident ManagementThe Problem Your vendor operates a crucial F5 BIG-IP APM device. It s patched and monitored under your standard security controls. Then a rootkit exploits CVE-2025-53521, injecting a fileless web shel
Software Supply Chain SecurityThe Conventional Wisdom Your team likely sees AI coding assistants as pure productivity boosters. Developers ship code faster, pull in dependencies quicker, and your velocity metrics improve. The assu
Software Supply Chain SecurityThe Challenge On August 28, JFrog patched CVE-2026-82329, a critical flaw in Artifactory that let attackers forge administrative access tokens without authentication. Researchers at watchTowr found at
Supply Chain MappingThe Question at Hand Your cargo security budget just got reviewed, and your CFO wants to know if real-time visibility tools, like GPS trackers and IoT-enabled containers, should be standard on every s
Software Supply Chain SecurityIntroduction Cuprate, an alternative implementation of Monero s node software, faced a significant supply chain risk as it approached its beta release without reproducible builds. This meant users dow
Incident ManagementWhen ZBT routers, sold globally as white-label products, were found to contain manufacturer-implanted backdoors, it exposed a critical gap in hardware procurement controls. These routers reached organ
Software Supply Chain SecurityYour GitHub Actions workflows look clean. Dependencies are listed. Secrets are stored in the vault. So why are supply chain attacks still slipping through? Most teams secure the obvious attack vectors
Incident ManagementWhen Ceva Logistics confirmed a breach affecting eight European warehouses between July 29 and August 1, it exposed more than customer data. It revealed a widespread misunderstanding of logistics prov
Incident ManagementThe Conventional Wisdom When ransomware attacks surge, the industry response is predictable: patch faster, monitor harder, train users better. Black Kite s report showing a 55.1% year-over-year increa
Software Supply Chain SecurityYour CI/CD pipeline relies on trust. Each time a workflow runs, it pulls actions by tags like v1.29.5 , v5 , or latest . These tags point to code that might change between runs. A compromised maintain
Software Supply Chain SecurityYou vet dependencies, scan containers, and review vendor source code access controls. But when a vendor hands you a repository or package, do you check the config files for shell commands? Most TPRM w
Software Supply Chain SecurityAn autonomous agent executed 17,000 actions over several days inside Hugging Face s production infrastructure. Another operation deployed 600 distinct payloads in a short timeframe, adapting when step
