.avif)
Software Supply Chain Security News
Stay up to date with the latest software supply chain security incidents, including malicious packages, dependency attacks, and real-world breaches. We break down what happened, why it matters, and what developers should fix to stay ahead.
eMudhra CA compromise: eight private keys, and one of them is 4
Eight eMudhra CA keys could be guessed in at most 256 tries, and one is just the number 4. Who is affected, why curl lagged browsers, and how to fix it.
PHP2Shell: Critical PHP vulnerabilities, affected versions and fixes
A critical PHP vulnerability lets attackers run code remotely on unpatched servers. See affected versions, patches, mitigations and how to check your exposure. Two PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) are being exploited now. Here’s which versions to update to and what to do if you can’t patch today.
Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects Python apps with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix.
eMudhra CA compromise: eight private keys, and one of them is 4
Eight eMudhra CA keys could be guessed in at most 256 tries, and one is just the number 4. Who is affected, why curl lagged browsers, and how to fix it.
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
LiteLLM 1.107.0 contains an infostealer and RAT, and PyPI has quarantined the package. See if you’re affected, what it steals, and what to rotate.
PHP2Shell: Critical PHP vulnerabilities, affected versions and fixes
A critical PHP vulnerability lets attackers run code remotely on unpatched servers. See affected versions, patches, mitigations and how to check your exposure. Two PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) are being exploited now. Here’s which versions to update to and what to do if you can’t patch today.
tensorlake NPM package compromised with Shai Hulud worm
malicious code detected in tensorlake 0.5.144
Novel supplychain.local Go worm appears
"supplychain.local": malicious code found in MemTensor's npm plugin (0.1.21, 0.1.23) and PyPI's MemoryOS (2.0.34).
Graphalgo campaign spreads to Terraform providers and Go Modules
Aikido found Graphalgo-linked Go malware in Terraform providers and Go Modules, using targeted triggers, Slack, and blockchain C2.
Compromised Flutter package on pub.dev contains XCSSET malware
We detected XCSSET malware inside a compromised Flutter package on pub.dev. Here is a full breakdown of the infection chain, propagation modules, and stealer logic we found inside.
Shai-Hulud Rises From the Dead after 111 days
A known Shai-Hulud worm payload sat dormant for 111 days, then republished to npm, right past the malware scanning meant to catch it.
Get secure now
Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.
