#software-supply-chain

Researchers discovered that two-thirds of top private AI companies have leaked sensitive credentials on GitHub, revealing major gaps in how fast-growing AI firms secure their development pipelines.

Source: Wiz

Actively exploited flaws in Cisco Unified Communications and VMware vCenter drove emergency response across enterprises, as supply-chain compromises spread through developer tools and app ecosystems. AI-enabled threats, browser-based credential theft, and state-aligned infrastructure targeting reinforced a rapidly expanding attack surface.

Flaws in an official AI Git integration allowed attackers to manipulate prompts to read, delete, or execute files without direct system access.

Source: Cyata

The new OWASP Top 10 report warns that software supply chain flaws and misconfigurations are now among the biggest dangers to modern web applications worldwide.

Source: OWASP Foundation

A stealthy malware wave is quietly hijacking VS Code extensions and GitHub repositories, spreading via invisible code and blockchain commands while targeting real organisations across several continents.

Source: Koi Security

A low-level Node.js bug turned everyday observability features into a denial-of-service trigger, crashing popular frameworks and production services without warning.

Source: Node.js Project

Ensure compliance and security across your software supply chain. HCL AppScan identifies vulnerabilities and strengthens your DevSecOps pipeline.

Software supply chain security- Kritis

In our previous posts we saw what binary authorization is and then ran a sample pipleline using cloud build. In this post, we will look at extending that pipeline with few additional checks using opensource admission controller knows as ‘kritis’. Kritis Kritis is an admission controller that when you’re deploying to Kubernetes specifically, it will run the policy checks that your cluster admin…