Discussions, questions and news about Software Supply Chain Security from cybersecurity professionals on Cyberr.
0 members · 22 posts
samuel watua Soita — Full Stack Software Engineer
One malicious package can turn a developer tool into a credential-harvesting machine. That's exactly why software supply-chain security deserves much more attention. Microsoft recently analyzed the LiteLLM 1.107.0 supply-chain compromise, where attackers used stolen developer to…
· 0 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
Your AI model may be secure. Your AI supply chain might not be. Think about everything surrounding a modern AI application. Open-source packages. Models. Plugins. MCP servers. APIs. Vector databases. Cloud services. Third-party tools. Container images. CI/CD pipelines. Every con…
· 3 reactions · 0 comments
samuel watua Soita — Full Stack Software Engineer
You may have written 99% of your application code—and still be trusting thousands of lines you didn't write. That's the uncomfortable reality of modern software development. A typical application depends on: → npm packages → Python packages → Docker images → GitHub Actions → Clo…
· 1 reactions · 0 comments
Jason Murray — Strategic Information Security Leader Championing Quantified Risk Analysis and Security Process Improvement.
This ProjectDiscovery research is reminiscent of Ken Thompson's "Reflections on Trusting Trust". Not much new under the sun. A backdoored 7B open model passes every eval, then exfiltrates .env files through a coding agent when a trigger phrase appears. The leak is there but you…
· 3 reactions · 0 comments
usama rasheed — Cybersecurity | Web Application Penetration Tester | Vulnerability Assessment | OWASP Top 10 | Burp Suite Professional
📰 AI Scramble Drives Cybersecurity M&A Boom https://www.darkreading.com/cybersecurity-analytics/ai-scramble-cybersecurity-ma-boom via Dark Reading · 🛡️ Powered by Cyberr Threat Intelligence — platform.cyberr.ai/news
· 3 reactions · 0 comments
Zsolt Fabian — Managing Director
People are socially and naturally motivated to seek opportunities for joint action. Similarly companies and organizations seek economically motivated partnerships, joint ventures or other M&A activities to form strategic alliances. These are indispensable for accessing specializ…
· 3 reactions · 0 comments
Schomer — Principal Security Solutions Architect & Founder
📦 The software supply chain surface just expanded again. For the first time, threat actors are actively using the centralized HashiCorp Registry to distribute malicious Go-based payloads disguised as legitimate Terraform providers. This highlights a massive systemic risk: engin…
· 3 reactions · 0 comments
George Botnaru — Senior Software Engineer
What if an AI backdoor wasn’t triggered by a secret phrase, but by a date? Researchers at Morgin.ai trained a 2B coding model to behave normally until 1 September 2026. When that date appeared in its system prompt, the model reportedly stopped answering and produced an attacker-…
· 4 reactions · 0 comments
Samantha Swift — Product, Go-to-Market & Marketing Leadership
Loving seeing the coverage of the Heelr launch in the last 24 hours! Here's a nice article from Security Brief UK featuring Laurent Halimi https://securitybrief.co.uk/story/heelr-launches-verified-cybersecurity-marketplace-for-firms
· 3 reactions · 0 comments
Haydn Kuti — Lead Community Operator
BSides Maine: Community, Malware, and Identity Residue Spent an awesome day volunteering and connecting at the inaugural BSides Maine. Taking part as an auditorium logistics volunteer was a fantastic experience, and the event brought together an incredible mix of technical depth…
· 2 reactions · 4 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
Why the US government shut down Anthropic’s latest Claude AI model On June 12, artificial intelligence (AI) lab Anthropic suspended access to its latest Claude models, Fable 5 and Mythos 5, which had been released three days earlier. The move came in response to an “export contr…
· 5 reactions · 1 comments
usama rasheed — Cybersecurity | Web Application Penetration Tester | Vulnerability Assessment | OWASP Top 10 | Burp Suite Professional
📰 Hackers abuse npm mirrors to host phishing redirect pages https://www.bleepingcomputer.com/news/security/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages/ via BleepingComputer · 🛡️ Powered by Cyberr Threat Intelligence — platform.cyberr.ai/news
· 1 reactions · 0 comments
Christopher Neitzert — Sr. Operator & Advisor
To every engineer over 45 who can't get a callback: Stop applying. Start shipping. Every closed product you're locked out of working on is a feature list, and agents have collapsed the cost of building one to nearly nothing. What agents can't supply is thirty years of knowing wh…
· 1 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
Kubernetes Container Escape Audit v4.7.3: catching a Docker daemon bypass your policy engine can't see Most of what container_escape_audit.sh checks lives inside the container looking out — capabilities, mounts, kernel exposure, runtime binaries reachable through a host path. v4…
· 3 reactions · 0 comments
Biswadeb Mukherjee — Security Engineer & Independent Researcher
The SolarWinds attack wasn't a break-in. It was a Trojan horse, signed and delivered by the vendor itself. Attackers didn't hack thousands of companies — they hacked SolarWinds' build process, planting malicious code inside a routine Orion update. That update got signed with Sol…
· 1 reactions · 1 comments
Liam Romanis — Freelance Penetration Tester
There is a question that nobody in the technology industry seems particularly eager to answer right now. Several of the world's largest companies have spent the past few months publicly warning that a piece of software called OpenClaw represents a serious security risk, threaten…
· 4 reactions · 0 comments
James Macgregor Watson — Decision Intelligence Executive
One of the lessons Cyber Threat Intelligence has reinforced for me over the years is that efficiency and resilience are rarely the same thing. For decades, globalization rewarded organizations that centralized manufacturing, concentrated suppliers, optimized logistics, and pursu…
· 1 reactions · 0 comments
Liam Romanis — Freelance Penetration Tester
K8s Container Escape Audit has just released version 4.4. This read-only bash script is designed to be run inside a pod to identify escape vectors to the node, specifically aimed at penetration testers and security teams conducting authorized assessments. What's new in this rele…
· 2 reactions · 0 comments
Maudrux Adrian — Directeur Général France | Le futur du recrutement | Cyberr.ai
Bonjour, pour cette nouvelle Newsletter, nous avons décidé de parler sécurité et conformité des Pipelines CI/CD. D'abord, parce que l'ANSSI vient de sortir une étude sur le sujet, ensuite parce que c'est l'un de nos chevaux de bataille depuis deux ans. 1. L'étude de L'ANSSI Le p…
· 4 reactions · 0 comments
Laurent Halimi — CEO & Founder CYBERR & HEELR
We've had SolarWinds. We've had Log4j. We've had MOVEit. The threat landscape keeps shifting and the next one that shakes the world is already being planned somewhere. The question is where it comes from.
· 1 reactions · 0 comments
Innocent O. Akpareva — Cybersecurity Analyst
CI/CD pipelines are a prime attack surface. One misconfigured permission can mean the difference between a secure release and a supply chain breach. Which setup actually enforces segregation of duties? Drop your answer below 👇
· 0 reactions · 0 comments