.avif)
Software Supply Chain Security News
Stay up to date with the latest software supply chain security incidents, including malicious packages, dependency attacks, and real-world breaches. We break down what happened, why it matters, and what developers should fix to stay ahead.
.jpg)
Critical Apache HTTP Server vulnerability can allow remote code execution (CVE-2026-119618)
CVE-2026-119618 is a critical mod_http2 RCE in Apache HTTP Server 2.4.55 to 2.4.70. See who is affected, how to fix it, and how to disable HTTP/2.
Critical Apache HTTP Server vulnerability can allow remote code execution (CVE-2026-119618)
CVE-2026-119618 is a critical mod_http2 RCE in Apache HTTP Server 2.4.55 to 2.4.70. See who is affected, how to fix it, and how to disable HTTP/2.
wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories
A wave of compromised accounts are pushing a CI secret stealer. See if you’re affected, what it steals, and what to rotate.
Even gem list can run someone else's code
Ruby gems can run code on install and on every gem command, even gem list. Check for four data-exfiltrating gems and turn off install-time execution.
Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432)
CVE-2026-98432 is a critical Linux kernel TCP flaw rated 9.8 that can allow remote code execution. See who is affected, how to patch and what to do now.
Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTP.
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix.
eMudhra CA compromise: eight private keys, and one of them is 4 - CVE-2026-111943
Eight eMudhra CA keys could be guessed in at most 256 tries, and one is just the number 4. Who is affected, why curl lagged browsers, and how to fix it.
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
LiteLLM 1.107.0 contains an infostealer and RAT, and PyPI has quarantined the package. See if you’re affected, what it steals, and what to rotate.
PHP2Shell: Critical PHP vulnerabilities, affected versions and fixes | CVE-2026-109618 and CVE-2026-109619
A critical PHP vulnerability lets attackers run code remotely on unpatched servers. See affected versions, patches, mitigations and how to check your exposure. Two PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) are being exploited now. Here’s which versions to update to and what to do if you can’t patch today.
tensorlake NPM package compromised with Shai Hulud worm
malicious code detected in tensorlake 0.5.144
Get secure now
Secure your code, cloud, and runtime in one central system.
Find and fix vulnerabilities fast automatically.
