Scale-out architecture for web-scale environments 📈
Because your containers don't wait for security scans ⏱️
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Because your containers don't wait for security scans ⏱️
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
October 31, 2026 at 4:56 PM
Scale-out architecture for web-scale environments 📈
Because your containers don't wait for security scans ⏱️
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Because your containers don't wait for security scans ⏱️
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
FedRAMP compliance in weeks, not months ⚡
Ready-to-deploy policy packs for instant compliance feedback 📋
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
Ready-to-deploy policy packs for instant compliance feedback 📋
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
October 31, 2026 at 4:30 PM
FedRAMP compliance in weeks, not months ⚡
Ready-to-deploy policy packs for instant compliance feedback 📋
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
Ready-to-deploy policy packs for instant compliance feedback 📋
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
Your software supply chain is built on trust. But trust without visibility is just an assumption.
Armornet connects third-party risk to the code you actually run.
Trust as a decision, not a default.
armornet.io
#TPRM #SoftwareSupplyChain #DevSecOps
Armornet connects third-party risk to the code you actually run.
Trust as a decision, not a default.
armornet.io
#TPRM #SoftwareSupplyChain #DevSecOps
October 29, 2026 at 2:47 PM
Your software supply chain is built on trust. But trust without visibility is just an assumption.
Armornet connects third-party risk to the code you actually run.
Trust as a decision, not a default.
armornet.io
#TPRM #SoftwareSupplyChain #DevSecOps
Armornet connects third-party risk to the code you actually run.
Trust as a decision, not a default.
armornet.io
#TPRM #SoftwareSupplyChain #DevSecOps
If you're looking for a practical solution to sign artifacts, you should take a look at asfaload.com. Signing artifacts prevents the spread of unofficial malicious versions.
#security #softwaresupplychain
#security #softwaresupplychain
Asfaload: Authenticated digital distribution — Asfaload
Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes.
asfaload.com
October 31, 2026 at 8:12 AM
If you're looking for a practical solution to sign artifacts, you should take a look at asfaload.com. Signing artifacts prevents the spread of unofficial malicious versions.
#security #softwaresupplychain
#security #softwaresupplychain
The malicious extension published on the cursor vsx marketplace show it once more: signing artifacts is the solution to some problems in the #softwaresupplychain #security. I think signing artifact is not used much due to it being cumbersome. I work on @asfaload.bsky.social to propose an easier way
If you're looking for a practical solution to sign artifacts, you should take a look at asfaload.com. Signing artifacts prevents the spread of unofficial malicious versions.
#security #softwaresupplychain
#security #softwaresupplychain
Asfaload: Authenticated digital distribution — Asfaload
Asfaload provides a generalized multisignature sign-off solution for authenticating digital artifacts and processes.
asfaload.com
October 31, 2026 at 8:28 AM
The malicious extension published on the cursor vsx marketplace show it once more: signing artifacts is the solution to some problems in the #softwaresupplychain #security. I think signing artifact is not used much due to it being cumbersome. I work on @asfaload.bsky.social to propose an easier way
False positives killing your team's productivity? 😵💫
Anchore Secure gives you signal, not noise 📡
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Anchore Secure gives you signal, not noise 📡
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
October 29, 2026 at 12:37 AM
False positives killing your team's productivity? 😵💫
Anchore Secure gives you signal, not noise 📡
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Anchore Secure gives you signal, not noise 📡
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Shift-left compliance checking ⬅️
Catch violations before deployment, not during audits 🛡️
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
Catch violations before deployment, not during audits 🛡️
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
October 28, 2026 at 3:38 PM
Shift-left compliance checking ⬅️
Catch violations before deployment, not during audits 🛡️
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
Catch violations before deployment, not during audits 🛡️
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
Anchore SBOM Score = CVSS + EPSS + KEV status 📊
Because not all vulnerabilities are created equal ⚠️
https://anchore.com/platform/sbom/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Because not all vulnerabilities are created equal ⚠️
https://anchore.com/platform/sbom/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
October 25, 2026 at 3:24 PM
Anchore SBOM Score = CVSS + EPSS + KEV status 📊
Because not all vulnerabilities are created equal ⚠️
https://anchore.com/platform/sbom/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Because not all vulnerabilities are created equal ⚠️
https://anchore.com/platform/sbom/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
A new blog post describing a small attack opportunity window that has been closed in the release registration process. It was impractical to use, but making it impossible further improves security. Read about it at www.asfaload.com/blog/2026102...
#security #softwaresupplychain
#security #softwaresupplychain
Feature update: security improvement — Asfaload
www.asfaload.com
October 26, 2026 at 7:36 AM
A new blog post describing a small attack opportunity window that has been closed in the release registration process. It was impractical to use, but making it impossible further improves security. Read about it at www.asfaload.com/blog/2026102...
#security #softwaresupplychain
#security #softwaresupplychain
Asfaload's talk proposal has been accepted by @cfgmgmtcamp.bsky.social! 2 years ago it was an in ignite talk of 5 minutes, now a 25 minutes intro to Asfaload. See you there!
If you don't know it, cfgmgmtcamp takes place right after @fosdem.org
#talk #security #softwaresupplychain
If you don't know it, cfgmgmtcamp takes place right after @fosdem.org
#talk #security #softwaresupplychain
October 24, 2026 at 8:32 AM
Asfaload's talk proposal has been accepted by @cfgmgmtcamp.bsky.social! 2 years ago it was an in ignite talk of 5 minutes, now a 25 minutes intro to Asfaload. See you there!
If you don't know it, cfgmgmtcamp takes place right after @fosdem.org
#talk #security #softwaresupplychain
If you don't know it, cfgmgmtcamp takes place right after @fosdem.org
#talk #security #softwaresupplychain
Due diligence under Europe's Cyber Resilience Act ends with a person signing off. I think the hard part is deciding which scanner's answer wins.
https://openssf.org/blog/2026/10/22/who-checked-it-attestations-gemara-and-cra-due-diligence
#SoftwareSupplyChain #Compliance
https://openssf.org/blog/2026/10/22/who-checked-it-attestations-gemara-and-cra-due-diligence
#SoftwareSupplyChain #Compliance
OpenSSF Gemara: Demystifying Attestations & CRA Due Diligence
Learn how the OpenSSF Gemara project simplifies security attestations and helps organizations meet EU Cyber Resilience Act (CRA) due diligence requirements.
openssf.org
October 23, 2026 at 1:17 PM
Due diligence under Europe's Cyber Resilience Act ends with a person signing off. I think the hard part is deciding which scanner's answer wins.
https://openssf.org/blog/2026/10/22/who-checked-it-attestations-gemara-and-cra-due-diligence
#SoftwareSupplyChain #Compliance
https://openssf.org/blog/2026/10/22/who-checked-it-attestations-gemara-and-cra-due-diligence
#SoftwareSupplyChain #Compliance
SBOM-first isn't just a buzzword—it's the architecture that makes continuous security actually possible 🔄
Feel the difference ⚡
https://anchore.com/platform/
#SBOM #CRA #SoftwareSupplyChain #Compliance
Feel the difference ⚡
https://anchore.com/platform/
#SBOM #CRA #SoftwareSupplyChain #Compliance
October 21, 2026 at 7:46 PM
SBOM-first isn't just a buzzword—it's the architecture that makes continuous security actually possible 🔄
Feel the difference ⚡
https://anchore.com/platform/
#SBOM #CRA #SoftwareSupplyChain #Compliance
Feel the difference ⚡
https://anchore.com/platform/
#SBOM #CRA #SoftwareSupplyChain #Compliance
GitHub announced its package firewall preview on 20 October 2026. Our take: include dependency installation in the security boundary; check coverage and exceptions.
#DeveloperSecurity #SoftwareSupplyChain
https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview
#DeveloperSecurity #SoftwareSupplyChain
https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview
October 21, 2026 at 12:16 AM
GitHub announced its package firewall preview on 20 October 2026. Our take: include dependency installation in the security boundary; check coverage and exceptions.
#DeveloperSecurity #SoftwareSupplyChain
https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview
#DeveloperSecurity #SoftwareSupplyChain
https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview
Supply chain attacks ↗️ 742% in 2023
Your traditional security stack wasn't built for this fight.
SBOM-first architecture changes everything ⚡
https://anchore.com/platform/
#SoftwareSupplyChain #SBOM #CyberSecurity
Your traditional security stack wasn't built for this fight.
SBOM-first architecture changes everything ⚡
https://anchore.com/platform/
#SoftwareSupplyChain #SBOM #CyberSecurity
October 18, 2026 at 11:30 PM
Supply chain attacks ↗️ 742% in 2023
Your traditional security stack wasn't built for this fight.
SBOM-first architecture changes everything ⚡
https://anchore.com/platform/
#SoftwareSupplyChain #SBOM #CyberSecurity
Your traditional security stack wasn't built for this fight.
SBOM-first architecture changes everything ⚡
https://anchore.com/platform/
#SoftwareSupplyChain #SBOM #CyberSecurity
A malicious software tool disguised as a simple image decoder was found online. If you are a developer or use …
Source: The Hacker News
Read: https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
#Cyzo #CyberSecurity #SoftwareSupplyChain #DeveloperSafety #TechAlert
Source: The Hacker News
Read: https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
#Cyzo #CyberSecurity #SoftwareSupplyChain #DeveloperSafety #TechAlert
October 17, 2026 at 2:20 PM
A malicious software tool disguised as a simple image decoder was found online. If you are a developer or use …
Source: The Hacker News
Read: https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
#Cyzo #CyberSecurity #SoftwareSupplyChain #DeveloperSafety #TechAlert
Source: The Hacker News
Read: https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
#Cyzo #CyberSecurity #SoftwareSupplyChain #DeveloperSafety #TechAlert
Software relies on libraries, build tools and update systems you rarely see. Those dependencies need care too.
Ask suppliers how they track components, fix vulnerabilities and protect updates.
coreblueprint.io/blog/softwar...
#SoftwareSupplyChain
Ask suppliers how they track components, fix vulnerabilities and protect updates.
coreblueprint.io/blog/softwar...
#SoftwareSupplyChain
October 17, 2026 at 11:26 AM
Software relies on libraries, build tools and update systems you rarely see. Those dependencies need care too.
Ask suppliers how they track components, fix vulnerabilities and protect updates.
coreblueprint.io/blog/softwar...
#SoftwareSupplyChain
Ask suppliers how they track components, fix vulnerabilities and protect updates.
coreblueprint.io/blog/softwar...
#SoftwareSupplyChain
"Bring Your Own SBOM" sounds simple...
Until you try to manage thousands of them 📊
Scale is everything 📈
https://anchore.com/platform/sbom/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Until you try to manage thousands of them 📊
Scale is everything 📈
https://anchore.com/platform/sbom/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
October 15, 2026 at 9:54 PM
"Bring Your Own SBOM" sounds simple...
Until you try to manage thousands of them 📊
Scale is everything 📈
https://anchore.com/platform/sbom/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Until you try to manage thousands of them 📊
Scale is everything 📈
https://anchore.com/platform/sbom/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Scale-out architecture for web-scale environments 📈
Because your containers don't wait for security scans ⏱️
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Because your containers don't wait for security scans ⏱️
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
October 14, 2026 at 7:47 PM
Scale-out architecture for web-scale environments 📈
Because your containers don't wait for security scans ⏱️
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Because your containers don't wait for security scans ⏱️
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
DruBOM beta2 expands Drupal dependency mapping, helping teams trace components and relationships across a site’s software supply chain with greater detail.
www.thedroptimes.com/72816/drubom...
#Drupal #SoftwareSupplyChain #OpenSource
www.thedroptimes.com/72816/drubom...
#Drupal #SoftwareSupplyChain #OpenSource
October 14, 2026 at 3:30 PM
DruBOM beta2 expands Drupal dependency mapping, helping teams trace components and relationships across a site’s software supply chain with greater detail.
www.thedroptimes.com/72816/drubom...
#Drupal #SoftwareSupplyChain #OpenSource
www.thedroptimes.com/72816/drubom...
#Drupal #SoftwareSupplyChain #OpenSource
FedRAMP compliance in weeks, not months ⚡
Ready-to-deploy policy packs for instant compliance feedback 📋
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
Ready-to-deploy policy packs for instant compliance feedback 📋
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
October 10, 2026 at 8:16 PM
FedRAMP compliance in weeks, not months ⚡
Ready-to-deploy policy packs for instant compliance feedback 📋
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
Ready-to-deploy policy packs for instant compliance feedback 📋
https://anchore.com/platform/enforce/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance
False positives killing your team's productivity? 😵💫
Anchore Secure gives you signal, not noise 📡
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Anchore Secure gives you signal, not noise 📡
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
October 10, 2026 at 6:03 PM
False positives killing your team's productivity? 😵💫
Anchore Secure gives you signal, not noise 📡
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
Anchore Secure gives you signal, not noise 📡
https://anchore.com/platform/secure/
#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps
A malicious Tensorlake release runs on installation, before a developer uses it.
Aikido says it seeks credentials and can spread to other projects.…
https://en.hacks.gr/kakovoyli-ekdosi-toy-tensorlake-sto-npm-prospathei-na-klepsei-stoicheia-prosvasis/
#Tensorlake #ShaiHulud #SoftwareSupplyChain
Aikido says it seeks credentials and can spread to other projects.…
https://en.hacks.gr/kakovoyli-ekdosi-toy-tensorlake-sto-npm-prospathei-na-klepsei-stoicheia-prosvasis/
#Tensorlake #ShaiHulud #SoftwareSupplyChain
October 8, 2026 at 9:02 PM
A malicious Tensorlake release runs on installation, before a developer uses it.
Aikido says it seeks credentials and can spread to other projects.…
https://en.hacks.gr/kakovoyli-ekdosi-toy-tensorlake-sto-npm-prospathei-na-klepsei-stoicheia-prosvasis/
#Tensorlake #ShaiHulud #SoftwareSupplyChain
Aikido says it seeks credentials and can spread to other projects.…
https://en.hacks.gr/kakovoyli-ekdosi-toy-tensorlake-sto-npm-prospathei-na-klepsei-stoicheia-prosvasis/
#Tensorlake #ShaiHulud #SoftwareSupplyChain
Tensorlake version 0.5.144 contained Shai-Hulud, designed to steal access credentials and spread through packages a user could publish.
The releas…
https://en.hacks.gr/i-ekdosi-0-5-144-toy-tensorlake-sto-npm-ekryve-programma-klopis-stoicheion-prosvasis/
#Tensorlake #ShaiHulud #SoftwareSupplyChain
The releas…
https://en.hacks.gr/i-ekdosi-0-5-144-toy-tensorlake-sto-npm-ekryve-programma-klopis-stoicheion-prosvasis/
#Tensorlake #ShaiHulud #SoftwareSupplyChain
October 8, 2026 at 7:01 AM
Tensorlake version 0.5.144 contained Shai-Hulud, designed to steal access credentials and spread through packages a user could publish.
The releas…
https://en.hacks.gr/i-ekdosi-0-5-144-toy-tensorlake-sto-npm-ekryve-programma-klopis-stoicheion-prosvasis/
#Tensorlake #ShaiHulud #SoftwareSupplyChain
The releas…
https://en.hacks.gr/i-ekdosi-0-5-144-toy-tensorlake-sto-npm-ekryve-programma-klopis-stoicheion-prosvasis/
#Tensorlake #ShaiHulud #SoftwareSupplyChain
Security is an important shift in how we think about CI/CD pipelines. Hardening the pipeline is critical, but security cannot stop when the deployment finishes, because vulnerabilities are found every day. This is the Gap that Ortelius fills. #SDLC #softwaresupplychain https://cstu.io/a749b8
Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure | Google Cloud Blog
Establishing a foundational blueprint for securing the Software Development Lifecycle.
cstu.io
October 5, 2026 at 3:04 PM
Security is an important shift in how we think about CI/CD pipelines. Hardening the pipeline is critical, but security cannot stop when the deployment finishes, because vulnerabilities are found every day. This is the Gap that Ortelius fills. #SDLC #softwaresupplychain https://cstu.io/a749b8