# sboms Published articles for sboms. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## What's in the SOSS? Podcast #77 - S3E29 Baking Security into the Toolchain: Accurate Swift SBOMs with Apple's Ev Cheng and Sam Khouri DevFeed: [What's in the SOSS? Podcast #77 - S3E29 Baking Security into the Toolchain: Accurate Swift SBOMs with Apple's Ev Cheng and Sam Khouri]() Original publisher: [Read original article]() Author: Jeff Diecks Published: 2026-11-03T14:49:26Z Content type: article Language: en Sources: [Open Source Security Foundation]() Topics: [software bill of materials](), [Swift](), [spdx](), [cyber resilience act](), [trust](), [openssf]() Tags: [apple](), [attestation](), [audit](), [bill-of-materials](), [build](), [compliance](), [graph](), [openssf](), [podcast](), [precision](), [sam](), [sbom](), [sboms](), [security](), [software](), [software-bill-of-materials](), [supply-chain-security](), [swift](), [toolchain]() ### AI overview Swift 6.4 adds SBOM generation to the Swift toolchain, using package and build dependency graphs to report what a build actually includes. The package graph captures package and product relationships and active traits; the build graph resolves platform and configuration conditions, avoiding the over- or under-reporting the guests attribute to manifest-scanning tools. Swift Build can emit CycloneDX and SPDX, together or separately; without a build, it produces a package-graph-only SBOM. Signing, component hashes, richer metadata, SDK support and more formats are described as open issues or future work, so cryptographic verification is not yet presented as available. The guests encourage trying the feature on real projects and contributing feedback through public Swift issues and forums. ### Source excerpt In this episode of What's in the SOSS, Apple engineers Ev Cheng and Sam Khouri discuss the evolution of Software Bill of Materials (SBOMs) and how native build-graph awareness in Swift ensures accurate, build-time precision. ## Zephyr RTOS 4.5 Now Available: Two New Architectures, Multimedia Pipelines, SBOMs for the CRA, and More DevFeed: [Zephyr RTOS 4.5 Now Available: Two New Architectures, Multimedia Pipelines, SBOMs for the CRA, and More]() Original publisher: [Read original article]() Author: Benjamin Cabé Published: 2026-10-28T22:46:51Z Content type: release Language: en Sources: [Zephyr Project]() Topics: [Zephyr RTOS](), [cyber resilience act](), [AI Integration Strategies](), [gateway](), [Data pipelines](), [Test automation](), [Cryptography](), [CI/CD](), [WebSocket]() Tags: [announcements](), [architectures](), [blog](), [cra](), [debugging](), [faster](), [hexagon](), [improvements](), [multimedia](), [network](), [network-stack](), [pipelines](), [release](), [rtos](), [sboms](), [testing](), [zephyr]() ### AI overview Zephyr 4.5 adds TriCore and Hexagon support, broader networking, multimedia pipelines, and security and diagnostic features. Its network stack gains up to 21% TCP and 12% UDP throughput in deterministic QEMU loopback benchmarks; it also adds QUIC, HTTP/3 serving, SSH, and IPv4 forwarding with NAT. The experimental mpipe subsystem links source, transform, and sink elements, passing buffers without copies; a leaky queue lets video continue at full rate while slower inference skips frames. SPDX 3.0 SBOM generation records source files and build details, though SPDX 2.3 remains the default. Other additions include per-file assertion levels, heap error detection, trace viewing and export, UDP coredumps, expanded host-backed native_sim peripherals, and multi-device Twister tests. The release also adds six driver classes, 178 boards, and 29 shields. Upgrading from 4.4 may require changes for the ring buffer API and CMake flash/debug targets; TriCore QEMU and the Hexagon toolchain require separate setup. ### Source excerpt Zephyr 4.5 brings two new architectures (TriCore and Hexagon), a faster and broader network stack, multimedia pipelines with mpipe, and a long list of debugging and testing improvements. ## Zephyr RTOS 4.5 Now Available: Two New Architectures, Multimedia Pipelines, SBOMs for the CRA, and More DevFeed: [Zephyr RTOS 4.5 Now Available: Two New Architectures, Multimedia Pipelines, SBOMs for the CRA, and More]() Original publisher: [Read original article]() Author: Benjamin Cabé Published: 2026-10-28T22:46:51Z Content type: release Language: en Sources: [Zephyr Project]() Topics: [Zephyr RTOS](), [cyber resilience act](), [Cryptography](), [Data pipelines]() Tags: [1-3](), [2](), [2026](), [announcements](), [architectures](), [blog](), [cra](), [debugging](), [faster](), [hexagon](), [improvements](), [list](), [multimedia](), [network](), [network-stack](), [pipelines](), [release](), [rtos](), [sboms](), [stack](), [testing](), [with](), [zephyr]() ### AI overview Zephyr 4.5 adds TriCore and Hexagon support, with QEMU targets; TriCore's QEMU and the Hexagon toolchain are not yet included in the Zephyr SDK. Networking updates include benchmark gains of up to 21% for TCP and 12% for UDP, QUIC and HTTP/3 support, SSH, and IPv4 forwarding/NAT plus IPv6 routing features. Experimental mpipe offers GStreamer-style media pipelines with shared buffers and threaded branches. Security additions include SPDX 3.0 build-provenance SBOMs (SPDX 2.3 remains the default), configurable hardening checks that can fail CI, and FIDO2 authentication. The release also improves debugging, host-backed native_sim testing, multi-device Twister tests, kernel performance, and hardware support. Upgrading from 4.4 may require replacing ring-buffer claim/finish calls and CMake flash/debug targets with their listed alternatives. ### Source excerpt Zephyr 4.5 brings two new architectures (TriCore and Hexagon), a faster and broader network stack, multimedia pipelines with mpipe, and a long list of debugging and testing improvements. ## PHP2Shell: Your SBOMs Already Know Which PHP Builds You're Running DevFeed: [PHP2Shell: Your SBOMs Already Know Which PHP Builds You're Running]() Original publisher: [Read original article]() Author: Aaron Stewart Published: 2026-10-26T15:26:56Z Content type: article Language: en Sources: [Anchore]() Topics: [PHP](), [Memory Safety](), [software dark matter](), [content-addressed tagging](), [Composer]() Tags: [anchore](), [anchore-enterprise](), [apache](), [api](), [aws](), [base](), [blog](), [cli](), [code-execution](), [compile](), [composer](), [container](), [container-images](), [critical](), [cve](), [engine](), [interpreter](), [php](), [php2shell](), [sboms](), [version]() ### AI overview PHP2Shell affects the PHP interpreter, so identifying exposed builds requires checking interpreter binaries, versions, and live workloads--not only Composer manifests or image tags. Anchore Enterprise's PHP cataloger reads compiled version strings and records php-cli, php-fpm, libphp, and detected C extensions; distro-installed PHP is assessed against its distribution's advisories. Because analyzed image SBOMs are already stored, teams can query fleet vulnerability findings once feeds are current without rescanning. Anchore's Kubernetes inventory tracks workloads by image digest, helping identify pods still running vulnerable builds after a tag moves to a fixed image. The post says PHP's only safe mitigation is updating, recommends blocking images matching the CVEs, and notes AWS reports branches 5.4-8.1 receive no upstream fix, with CVE-2026-109618 unfixable on those branches. ### Source excerpt The post PHP2Shell: Your SBOMs Already Know Which PHP Builds You're Running appeared first on Anchore.When a critical CVE lands in a library, the first hours of a response go into working out which applications pull it in. PHP2Shell skips that step. Both flaws sit in the PHP engine, so the only facts that matter are which interpreter builds you run, how each one serves traffic, and whether its version [...] ## No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild DevFeed: [No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild]() Original publisher: [Read original article]() Author: Artur Zi\\k{e}ba-Kozarzewski Published: 2026-10-23T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Software Engineering]() Topics: [Graphs](), [Graph Mining](), [alert triage](), [known exploitable vulnerabilities](), [container images]() Tags: [abstract](), [alert](), [all](), [analysis](), [arxiv](), [block](), [but](), [characterization](), [component](), [components](), [conclusion](), [consumer](), [container](), [cs-cr](), [cs-se](), [dependency](), [graphs](), [large](), [sboms](), [scale](), [study](), [wild]() ### AI overview Across 78,612 real-world SBOMs (77,092 parseable), 52.9% declared no dependency edges, 8.8% had edges but left most components isolated, and 38.3% formed well-connected graphs. Excluding files marked with a single generation harness reduced the no-edge share to 42.3%. Edge emission varied by generator (0-100% no-edge rates across tools), while only 0.10% of CycloneDX documents used compositions to declare graph incompleteness. The authors warn that treating "no path" as "unreachable" can yield unsound vulnerability triage when graphs are incomplete. In one production prioritization system, a degeneracy detector and explicit "unknown" level raised KEV recall from 0.600 to 0.950 in controlled rescoring and 0.957 in a live run, without alert flooding. ### Source excerpt arXiv:2607.22140v3 Announce Type: replace-cross Abstract: Software Bills of Materials (SBOMs) are consumed not only as component inventories but as dependency graphs: vulnerability triage, reachability filtering, and impact analysis all traverse the edges an SBOM declares. We present the first large-scale characterization of the declared dependency graph across 78,612 real-world SBOM files from the Wild SBOMs dataset (77,092 parseable). We find that the population splits into three regimes: 52.9% of SBOMs declare no edges at all (failing the NTIA minimum-elements requirement of dependency relationships; 42.3% once the 46.5% of files carrying the tool entry of a single generation harness are set aside), 8.8% declare a dependency block yet leave the majority of components isolated (degenerate regime; among such SBOMs with at least 50 components the median orphan share is 93%, and our 11 Syft-generated container-image SBOMs fall in this regime at 91.4-98.0% orphans), and 38.3% form well-connected graphs. Edge emission is predicted by the generator rather than by the format (0%-100% no-edge rates across tools), and the specification-level mechanism for declaring graph incompleteness (CycloneDX compositions) is used by 0.10% of CycloneDX documents. We argue that in the first two regimes, the common consumer inference "no path implies unreachable" is an unsound closed-world conclusion drawn from a demonstrably incomplete artifact; in a production vulnerability-prioritization system, replacing the resulting veto with an explicit "unknown" level guarded by a degeneracy detector recovered KEV recall from 0.600 to 0.950 (controlled re-scoring; 0.957 in a live end-to-end run) without alert flooding. The streaming scanner and the full per-SBOM topology dataset are archived on Zenodo. ## Inspecting Multi-Platform Docker Images, SBOMs, and SLSA Provenance With Buildx DevFeed: [Inspecting Multi-Platform Docker Images, SBOMs, and SLSA Provenance With Buildx]() Original publisher: [Read original article]() Author: Sangharsh Agarwal Published: 2026-10-09T08:27:05Z Content type: tutorial Language: en Sources: [HackerNoon]() Topics: [Docker](), [grype](), [software artifact signing](), [slsa levels](), [CI/CD](), [Docker Hub]() Tags: [container-security](), [docker-bake](), [docker-buildx](), [github-actions](), [go](), [oci-image-index](), [provenance](), [sbom](), [sboms](), [slsa](), [slsa-provenance](), [software-supply-chain](), [software-supply-chain-security]() ### AI overview A hands-on example uses Docker Buildx to publish amd64 and arm64 images with SBOMs and provenance, then inspects the registry artifacts. The two platform SBOMs list the same 19 package names and versions, while the provenance records resolved dependencies for amd64. The article cautions that these observations do not verify the builder's identity, establish a SLSA level, or prove the images are safe. ### Source excerpt Build and inspect multi-platform Docker images with Buildx, SBOMs, and SLSA provenance. See what published attestations reveal and what they don't prove. ## Top Trivy alternatives for container and cloud scanning in 2026 DevFeed: [Top Trivy alternatives for container and cloud scanning in 2026]() Original publisher: [Read original article]() Author: Nicholas Thomson Published: 2026-09-04T14:23:00Z Content type: comparison Language: en Sources: [Aikido Security's Blog]() Topics: [trivy](), [Security](), [container](), [Infrastructure as code](), [Vulnerabilities](), [software supply-chain attack](), [CI/CD](), [grype](), [snyk]() Tags: [ci-cd](), [cloud](), [comparisons](), [container-images](), [cve](), [dependency](), [iac](), [sast](), [sboms](), [sca](), [tools](), [trivy]() ### AI overview A comparison of six alternatives to Trivy for container scanning, infrastructure-as-code security, SAST, vulnerability prioritization, and remediation. It describes Trivy's capabilities and limitations, including noisy findings, lack of code analysis, and reported supply-chain compromises, then explains where alternatives such as Aikido Security, Checkov, Grype, Snyk, Wiz, and Sysdig Secure fit. ### Source excerpt Six Trivy alternatives compared for 2026 on container scanning, IaC, SAST, prioritization, and fixes, with where each one actually fits. Category: DevSec Tools & Comparisons ## The Apache® Software Foundation Advances Open Source Infrastructure and Celebrates Community Growth in FY26 DevFeed: [The Apache® Software Foundation Advances Open Source Infrastructure and Celebrates Community Growth in FY26]() Original publisher: [Read original article]() Author: The ASF Published: 2026-09-01T13:00:00Z Content type: news Language: en Sources: [The ASF Blog]() Topics: [Open Source](), [open source communities](), [releases](), [supply-chain-security](), [Developer Tools](), [Responsibility & Safety]() Tags: [anthropic](), [foundation](), [infrastructure](), [open-source](), [open-source-software](), [responsible-ai](), [sboms](), [security](), [tooling]() ### AI overview The Apache Software Foundation's FY2026 annual report describes investments in open-source infrastructure, tooling, standards, and community growth. It highlights 10,225 committers across 302 projects, advances in trusted release infrastructure and software supply-chain transparency, and the launch of a $10 million Responsible AI Initiative. ### Source excerpt Annual report highlights investments in people, infrastructure and standards to meet the growing demands on open source software Wilmington, DE - September 1, 2026 - The Apache Software Foundation (The ASF), the global home of open source software the world relies on, today released its annual report for the 2026 fiscal year that ended April [...] The post The Apache® Software Foundation Advances Open Source Infrastructure and Celebrates Community Growth in FY26 appeared first on The ASF Blog. ## Operationalizing SBOMs to Boost Incident Response Velocity with Anchore Enterprise v6.1 DevFeed: [Operationalizing SBOMs to Boost Incident Response Velocity with Anchore Enterprise v6.1]() Original publisher: [Read original article]() Author: Alex Rybak Published: 2026-08-20T12:00:00Z Content type: release Language: en Sources: [Anchore]() Topics: [anchore](), [vulnerability management](), [Vulnerabilities](), [Security](), [virtual machines]() Tags: [anchore](), [anchore-enterprise](), [blog](), [cra](), [incident](), [incident-response](), [sbom](), [sboms](), [virtual-machines]() ### AI overview Anchore Enterprise v6.1 introduces SBOM-powered vulnerability search for rapid zero-day blast-radius analysis, adds virtual machine scan coverage, and expands its asset model for compliance requirements including the EU CRA. ### Source excerpt The post Operationalizing SBOMs to Boost Incident Response Velocity with Anchore Enterprise v6.1 appeared first on Anchore.We are excited to announce the release of Anchore Enterprise v6.1, built specifically to operationalize your SBOM data for instant blast radius analysis when a zero-day hits. We also added scan coverage for virtual machines and expanded the unified asset model to address global compliance regulations such as EU CRA. A critical zero-day drops. The [...] ## Red Hat and Bitsea Discuss Preparing for the EU Cyber Resilience Act and Open-Source Vulnerability Compliance DevFeed: [Red Hat and Bitsea Discuss Preparing for the EU Cyber Resilience Act and Open-Source Vulnerability Compliance]() Original publisher: [Read original article]() Author: Cezzaine Zaher Published: 2026-08-04T12:00:00Z Content type: article Language: en Sources: [Anchore]() Topics: [cyber resilience act](), [open-source-security](), [Vulnerabilities](), [Security](), [Open Source]() Tags: [anchore](), [bitsea](), [blog](), [eu-cyber-resilience-act](), [open-source-maintainer](), [open-source-security](), [sboms](), [vulnerability]() ### AI overview Anchore recaps a webinar with Red Hat and Bitsea about preparing for the EU Cyber Resilience Act. The discussion covers abandoned open-source maintainers, vulnerability handling, SBOMs, compliance workstreams, regulatory deadlines, and organizational progress toward compliance. ### Source excerpt The post "You Own the Problem": Red Hat and Bitsea on Getting Ready for the EU CRA appeared first on Anchore.What Happens When Your Open Source Maintainer Disappears (EU CRA Edition) You find a vulnerability in an open source package. You check for a fix. There isn't one, because the maintainer walked away from the project two years ago. Under the EU Cyber Resilience Act (CRA), what happens next isn't ambiguous. That was the question [...] ## Understanding platform engineering's role in staying compliant with the EU's CRA DevFeed: [Understanding platform engineering's role in staying compliant with the EU's CRA]() Original publisher: [Read original article]() Author: Nigel Douglas Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Security](), [vulnerability management](), [supply-chain-security](), [incident]() Tags: [compliance](), [cyber-resilience-act](), [engineering](), [eu](), [idp](), [incident](), [platform](), [platform-engineering](), [policy](), [regulatory](), [sboms](), [secure-by-default](), [secure-software](), [security](), [software-supply-chain](), [supply-chain](), [vulnerabilities](), [vulnerability-management]() ### AI overview The article explains how platform engineering can operationalize compliance with the EU's Cyber Resilience Act by embedding secure-by-default practices, automated SBOMs, and rapid incident reporting into an Internal Development Platform. It also outlines CRA compliance milestones and manufacturer responsibilities, including vulnerability management and security updates. ### Source excerpt The EU's Cyber Resilience Act (CRA) mandates secure software by design. Discover how platform engineering operationalizes compliance by embedding secure-by-default standards, automated SBOMs, and rapid incident reporting into your Internal Development Platform (IDP). This approach transforms compliance into a frictionless golden path ## CTRL-OS 26.05 Released! DevFeed: [CTRL-OS 26.05 Released!]() Original publisher: [Read original article]() Author: blitz Published: 2026-07-10T12:35:43Z Content type: release Language: en Sources: [Announcements - NixOS Discourse]() Topics: [Nix](), [Linux](), [maintenance](), [Security](), [cyber resilience act]() Tags: [announcements](), [cyber-resilience-act](), [infrastructure](), [linux](), [maintenance](), [release](), [sboms](), [security]() ### AI overview CTRL-OS 26.05, a downstream distribution of NixOS, has been released. The release provides a five-year lifecycle model, beginning with co-maintenance while NixOS has community support and moving to stability maintenance afterward. CTRL-OS monitors and backports security fixes for a core package set, with commercial subscriptions supporting SLAs and custom package sets. The project also describes its role in helping embedded Linux products address long-term vulnerability patching and EU Cyber Resilience Act requirements. ### Source excerpt Welcome to the latest CTRL-OS update! Find the last update from April here. If you don't know yet, CTRL-OS is a downstream distribution of NixOS designed to extend the release lifecycle to 5 years. It gives you a stable foundation with commercial support so you can build your products without having to maintain the packages you depend on. CTRL-OS 26.05 Released! The CTRL-OS 26.05 release is finally out. You can find the release blog post on our website. Or head over to our technical documentation and try it out. As long as NixOS 26.05 has community support, CTRL-OS 26.05 will be in the co-maintenance phase. In this phase, we will monitor our supported package set and contribute any security fixes back to NixOS. After community support ends, we enter the stability phase, and maintenance shifts completely to us. We've detailed this model on our blog. As of now, we support a small but useful package set. We'll share more details here soon, but our goal is to cover the usual packages you deploy on a server or embedded system, i.e., that dusty plastic box in the corner that quietly does its job for years. We actively monitor and backport CVEs for a core set of packages. To fund this work, commercial subscriptions provide SLA guarantees and cover custom package sets. While we aim to stay very close to NixOS 26.05, we will pull in important security fixes quickly to keep our SLAs. This creates a divergence that will automatically resolve itself once the security fixes make it to the NixOS release branch as well. Finally, to avoid a maintenance burden for the community, our CTRL-OS 26.05 release is lightly branded. By making it easy to identify a CTRL-OS system via nix-env -m, we ensure that bug reports originating from CTRL-OS users don't accidentally get filed against upstream NixOS, respecting the time and effort of upstream maintainers. No Cyber Resilience Act (CRA) Worries With the EU's CRA requirements taking effect this September, shipping embedded Linux products is ## From the Field: How to Automate CMMC compliance for containers & SBOMs with Anchore Enterprise DevFeed: [From the Field: How to Automate CMMC compliance for containers & SBOMs with Anchore Enterprise]() Original publisher: [Read original article]() Author: Chadd Owen Published: 2026-07-09T12:00:00Z Content type: tutorial Language: en Sources: [Anchore]() Topics: [Cybersecurity](), [container](), [CI/CD](), [container images](), [software-development]() Tags: [blog](), [ci-cd](), [cmmc-2-0](), [compliance](), [containers](), [cybersecurity](), [sboms]() ### AI overview This post explains how defense contractors can automate parts of CMMC 2.0 compliance for container images and SBOMs through CI/CD policy checks. It describes Anchore Enterprise's CMMC Policy Pack and its mapping of checks to CMMC and NIST SP 800-171 controls. ### Source excerpt The post From the Field: How to Automate CMMC compliance for containers & SBOMs with Anchore Enterprise appeared first on Anchore.As a Solution Architect here at Anchore, I spend a lot of time talking with defense contractors and organizations responsible for managing Controlled Unclassified Information (CUI). Lately, almost every conversation eventually turns to one looming topic: the reality of CMMC (Cybersecurity Maturity Model Certification) audits and compliance requirements.. The DoD's CMMC 2.0 final rule officially [...] ## Adopt hardened containers without changing your pipelines, tooling, or environment DevFeed: [Adopt hardened containers without changing your pipelines, tooling, or environment]() Original publisher: [Read original article]() Published: 2026-06-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [container](), [chainguard images](), [Security](), [Deployment](), [Developer Tools]() Tags: [chainguard](), [chainguard-containers](), [chainguard-redhat-rpm](), [cmvp](), [compliance](), [containers](), [cyclonedx](), [dependabot](), [deployment](), [fips](), [hardened-containers](), [provenance](), [rhel](), [rhel-10](), [rhel-9](), [rpm-10](), [rpm-9](), [sboms](), [secure-by-default](), [security](), [vulnerabilities]() ### AI overview Chainguard announces updates to Chainguard Containers that support enterprise adoption of hardened images without changing existing pipelines, tooling, or environments. The updates include RPM support for RHEL 9 and RHEL 10, compatible image tags, a CMVP-validated Go Geomys FIPS image, Dependabot support for private registries, and flattened CycloneDX SBOMs for compliance tools. ### Source excerpt Chainguard expands Containers with RPM support, FIPS enhancements, and easier migrations, bringing secure-by-default software to enterprise workflows. ## Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up DevFeed: [Chainguard Libraries for Java is now GA; CVE remediation beta available for sign up]() Original publisher: [Read original article]() Published: 2026-06-23T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [Java](), [Spring Boot](), [Security](), [Back end]() Tags: [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-java](), [cve](), [cve-remediation](), [dependencies](), [java](), [java-packages](), [java-spring](), [open-source](), [provenance](), [sboms](), [scanner](), [security](), [zero-cve-packages]() ### AI overview Chainguard Libraries for Java is generally available, and its CVE remediation capability is available in beta. The article describes backported fixes for critical and high-severity CVEs across the Spring Boot ecosystem, helping teams manage risks in pinned or legacy Java dependencies while planning upgrades. ### Source excerpt Chainguard Libraries for Java is now GA, delivering CVE-remediated dependencies with SBOMs, provenance, and scanner-recognized fixes. ## Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard images](), [container images](), [Security](), [container](), [chainguard libraries]() Tags: [chainguard](), [chainguard-containers](), [chainguard-gartner](), [chainguard-gartner-mq](), [chainguard-libraries](), [container-images](), [gartner](), [gartner-magic-quadrant](), [sboms](), [secure-by-default](), [security](), [software-supply-chain-security](), [software-supply-chain-security-gartner](), [software-supply-chain-security-mq](), [zero-cves]() ### AI overview Chainguard's article discusses its recognition as a Leader in Gartner's inaugural Magic Quadrant for Software Supply Chain Security. It argues that accelerating vulnerability exploitation and AI-assisted development require prevention-oriented, secure-by-default supply chain security. The article highlights Chainguard Containers, which provides minimal container images rebuilt daily from source, with zero CVEs, SBOMs, and verifiable signatures, and briefly introduces Chainguard Libraries. ### Source excerpt Gartner names Chainguard a Leader in Software Supply Chain Security, highlighting its secure-by-default approach and market vision. ## Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-18T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [Security](), [Open Source]() Tags: [2026](), [chainguard](), [chainguard-gartner](), [chainguard-gartner-magic-quadrant](), [cyber-resilience-act](), [fedramp](), [gartner](), [gartner-mq-software-supply-chain](), [nis2](), [provenance](), [sboms](), [secure-by-default](), [security](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [software-supply-chain-security-gartner]() ### AI overview Chainguard announces that it has been recognized as a Leader in the 2026 Gartner Magic Quadrant for Software Supply Chain Security. The article highlights Chainguard's secure-by-default approach, hardened open source artifacts, cryptographic signatures, signed SBOMs, and SLSA-aligned provenance, along with support for regulatory requirements. ### Source excerpt Chainguard named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security, recognized for vision and secure-by-default innovation. ## SBOM adoption is widespread, but organizations struggle to use SBOMs for security DevFeed: [SBOM adoption is widespread, but organizations struggle to use SBOMs for security]() Original publisher: [Read original article]() Author: Jens Gellynck Published: 2026-06-10T13:53:00Z Content type: news Language: en Sources: [Aikido Security's Blog]() Topics: [supply-chain-security](), [cyber resilience act](), [Vulnerabilities](), [Security](), [Data Quality]() Tags: [2026](), [cyber-resilience-act](), [data-quality](), [enisa](), [report](), [sbom](), [sboms](), [security]() ### AI overview ENISA's 2026 survey of 334 organizations finds that SBOM adoption is growing, largely due to the Cyber Resilience Act, but many organizations still struggle to use SBOMs for vulnerability and licensing management. Supplier participation and SBOM data quality remain significant gaps. ### Source excerpt ENISA's 2026 SBOM adoption report covers 334 organizations and surfaces a consistent gap between generating SBOMs and actually using them. Here is what stood out. Category: News ## Quarkus 3.36 - Quarkus Signals, embedded SBOMs, OIDC SPIFFE authentication, and more DevFeed: [Quarkus 3.36 - Quarkus Signals, embedded SBOMs, OIDC SPIFFE authentication, and more]() Original publisher: [Read original article]() Author: Guillaume Smet (https://twitter.com/gsmet\_) Published: 2026-05-27T00:00:00Z Content type: release Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [software bill of materials](), [OpenID connect (OIDC)](), [SPIFFE](), [GraphQL](), [JSON]() Tags: [graphql](), [json](), [oidc](), [quarkus](), [sboms](), [spiffe]() ### AI overview Quarkus 3.36 introduces the experimental Quarkus Signals extension, embedded dependency SBOMs and an SBOM endpoint, OIDC client authentication with SPIFFE JWT tokens, expanded keystore and truststore support, dynamic JSON logging fields, a GraphQL client, and TLS reload updates. ### Source excerpt We're pleased to announce the release of Quarkus 3.36. This release brings several notable features: #53788 - Quarkus Signals experimental extension #53552 - Embedded dependency SBOMs and SBOM endpoint #53923 - Embed SBOM in native images #53773 - OIDC SPIFFE client authentication #53491 - Arbitrary keystore/truststore types #53415 - Dynamic JSON field additions for logging #53856 - GraphQL client TLS reload Update To update to Quarkus 3.36, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.36. For more information about the adjustments you need to make to your applications, please refer to the Quarkus 3.36 migration guide. What's new? Quarkus Signals Quarkus Signals is a new experimental extension that enables application components to interact in a loosely coupled fashion through emitting and receiving signals. What it offers: Type-safe resolution inspired by CDI events - signals are matched to receivers based on type and qualifiers. Three emission modes inspired by the Vert.x EventBus: publish (multicast to all receivers), send (unicast with round-robin selection), and request-reply (unicast with a typed response). A convenient blocking API is provided for each mode, with an optional reactive API returning Uni. Flexible execution model - receivers run asynchronously and support blocking, non-blocking, and virtual thread execution, following standard Quarkus conventions (@Blocking, @NonBlocking, @RunOnVirtualThread, etc.). Programmatic receivers - register and unregister receivers at runtime via a fluent builder API. Signal metadata - attach arbitrary key-value pairs to emissions, accessible by receivers through SignalContext. SPI for integrators - extend behavior with SignalMetadataEnricher and ReceiverInterceptor. As mentioned, the extension is experimental, and feedback is highly welcome! Embedded dependency SBOMs Q ## Building for the AI era: Chainguard partners with Endor Labs DevFeed: [Building for the AI era: Chainguard partners with Endor Labs]() Original publisher: [Read original article]() Published: 2026-05-19T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Application Security](), [Artificial Intelligence](), [AI-assisted coding](), [chainguard images](), [container](), [Library](), [Agent Skills](), [CI/CD]() Tags: [agent](), [ai](), [ai-coding-agents](), [application-security](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [containers](), [cves](), [endor](), [endor-labs](), [observability](), [provenance](), [sboms](), [software-supply-chain](), [vulnerabilities]() ### AI overview Chainguard partners with Endor Labs to help teams building with AI coding agents secure the software supply chain. Chainguard provides source-built artifacts, daily rebuilds, signed SBOMs, and SLSA Level 3 provenance, while Endor Labs analyzes application context to identify vulnerabilities that are genuinely reachable and exploitable. ### Source excerpt Chainguard and Endor Labs help teams build securely at AI speed with source-built artifacts, exploitability analysis, and fewer vulnerabilities to triage. ## CMMC Phase 2, explained: Requirements, deadlines, and who's affected DevFeed: [CMMC Phase 2, explained: Requirements, deadlines, and who's affected]() Original publisher: [Read original article]() Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [Security & Privacy](), [Cryptography](), [vulnerability management](), [vulnerability scanning](), [Encryption](), [MFA]() Tags: [certificates](), [cmmc](), [cmmc-container-images](), [cmmc-phase-2](), [cmvp](), [compliance](), [cve](), [cybersecurity-maturity-model-certification](), [fips](), [nist](), [sboms](), [stig](), [stigs](), [supply-chain](), [u-s-dod](), [vulnerability-management](), [vulnerability-scanning]() ### AI overview This article explains the requirements, deadlines, and scope of CMMC Phase 2. It describes the CMMC Level 2 certification requirements for organizations handling Controlled Unclassified Information or supporting Department of Defense and certain civilian agency contracts, including MFA, encryption, vulnerability scanning, supported systems, independent assessments, and compliance documentation. ### Source excerpt CMMC Phase 2 and NIST 800-171 are here. Learn how Chainguard helps teams meet compliance with FIPS, STIGs, and zero-CVE containers. ## Dependabot-based dependency graphs for Python DevFeed: [Dependabot-based dependency graphs for Python]() Original publisher: [Read original article]() Author: Allison Published: 2026-04-23T17:45:58Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [Dependabot](), [Dependency management](), [Python](), [pip](), [Poetry]() Tags: [dependabot](), [dependency-graph](), [pip](), [poetry](), [python](), [sboms](), [uv]() ### AI overview Dependabot now provides more complete Python dependency graphs and SBOMs, including transitive dependencies. A new Dependabot job builds a dependency snapshot and uploads it through the Dependency Submission API. Like dependency autosubmission, it submits dependency data, but the source says it does not use charged Actions minutes and can access organization-wide Dependabot configurations for private registries. Supported package managers are pip, uv, and Poetry versions 1 and 2. ### Source excerpt Python projects will now see more complete and accurate transitive dependency trees in their dependency graphs and Software Bills of Materials (SBOMs). This feature is based on a new type... ## Anchore Enterprise 5.25: Unified Scanning Engine and First-Class Imported SBOMs DevFeed: [Anchore Enterprise 5.25: Unified Scanning Engine and First-Class Imported SBOMs]() Original publisher: [Read original article]() Author: Jono Bergquist Published: 2026-03-18T12:43:32Z Content type: release Language: en Sources: [Anchore]() Topics: [anchore](), [supply-chain-security](), [vulnerability scanning](), [DevSecOps](), [grype](), [Security](), [Vulnerabilities](), [Open Source](), [Software]() Tags: [anchore](), [anchore-enterprise](), [blog](), [cli](), [container-images](), [devsecops](), [grype](), [infrastructure](), [sbom](), [sboms](), [security](), [software-supply-chain](), [software-supply-chain-security](), [storage](), [vulnerability]() ### AI overview Anchore Enterprise 5.25 introduces a rewritten scanning engine aligned with Syft and Grype, improved imported SBOM management, vulnerability filtering, and automated artifact lifecycle policies. The release aims to provide consistent results across developer and production workflows while improving performance and reducing storage use. ### Source excerpt The post Anchore Enterprise 5.25: Unified Scanning Engine and First-Class Imported SBOMs appeared first on Anchore.Anchore Enterprise 5.25 introduces a completely rewritten scanning engine and comprehensive upgrades to imported SBOM management. This release is designed to streamline your software supply chain security by delivering consistent analysis across developer and production workflows, advanced EPSS and CISA KEV vulnerability filtering, and automated artifact lifecycle policies. As organizations scale their supply chain security, [...] ## Introducing Chainguard OS Packages: Secure ingredients for custom container builds DevFeed: [Introducing Chainguard OS Packages: Secure ingredients for custom container builds]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard os](), [container images](), [Docker Hardened Images](), [Vulnerabilities](), [Linux](), [Automation](), [Dockerfile](), [Open Source](), [bazel](), [chainguard sboms](), [APK]() Tags: [apk](), [apko](), [automation](), [base-images](), [bazel](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [chainguard-os](), [chainguard-os-packages](), [chainguard-packages](), [chainguard-sboms](), [container](), [container-images](), [cve](), [dockerfiles](), [open-source](), [sboms](), [secure-software-packages](), [software-packages](), [vulnerabilities](), [zero-cve-packages]() ### AI overview Chainguard introduces Chainguard OS Packages, a service providing continuously maintained, enterprise-grade packages and base images for teams that build custom container images. Customers retain control over image composition and build tooling while Chainguard handles package sourcing, rebuilding, vulnerability remediation, and SBOM generation. ### Source excerpt Chainguard OS Packages are enterprise-grade, zero-CVE packages and base images built and continuously maintained in the Chainguard Factory. [Next page]()