# software supply chain Published articles for software supply chain. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks DevFeed: [CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks]() Original publisher: [Read original article]() Author: Anne Aarness - Chris Prall Published: 2026-09-12T11:17:51.295154Z Content type: article Language: en Sources: [Blog]() Topics: [Endpoint Security & XDR](), [supply-chain-security](), [Security](), [Open Source](), [Software](), [Artificial Intelligence](), [Claude](), [codex]() Tags: [agentic](), [ai](), [codex](), [credential-theft](), [developer](), [developers](), [development](), [endpoint-security-xdr](), [malicious-packages](), [open-source](), [open-source-packages](), [persistence](), [security](), [software-supply-chain](), [supply-chain]() ### AI overview The article describes CrowdStrike's Real-Time Supply Chain Attack Protection, embedded in the Falcon sensor, which detects and blocks malicious open-source packages before their code executes on enterprise endpoints. It explains how AI-assisted and agentic applications have expanded software supply chain risk beyond developer workstations to endpoints across the organization. ### Source excerpt Real-Time Supply Chain Attack Protection, embedded into the Falcon sensor, blocks malicious open-source packages at download to protect the endpoint. ## LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program DevFeed: [LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program]() Original publisher: [Read original article]() Author: Harold Fritts Published: 2026-09-11T16:35:51Z Content type: news Language: en Sources: [StorageReview.com]() Topics: [ibm](), [open-source-security](), [supply-chain-security](), [Security](), [vulnerability](), [DevSecOps](), [Deployment](), [Open Source](), [Artificial Intelligence]() Tags: [ai](), [deployment](), [devsecops](), [enterprise](), [ibm](), [open-source](), [open-source-software](), [red-hat](), [security](), [software-supply-chain](), [testing](), [vulnerability]() ### AI overview LTM is developing a remediation services practice around IBM and Red Hat's Lightwell program, which provides AI-generated, vendor-validated fixes for open-source software vulnerabilities. The offering is intended to help customers plan, prioritize, test, validate, and deploy patches at scale. ### Source excerpt LTM, the Larsen & Toubro Group services company that was LTIMindtree until its February rebrand, is building a Lightwell remediation services practice around the $5 billion IBM and Red Hat program for securing open-source software with AI-generated, vendor-validated fixes. IBM's clearinghouse produces validated, production-ready patches for open-source dependencies; LTM's job is getting them into customer The post LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program appeared first on StorageReview.com. ## What it took to reach 1 billion build manifests DevFeed: [What it took to reach 1 billion build manifests]() Original publisher: [Read original article]() Published: 2026-09-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [container images](), [chainguard os](), [supply-chain-security](), [sigstore](), [Linux](), [NumPy]() Tags: [chainguard](), [chainguard-factory](), [chainguard-os](), [container-images](), [go](), [open-source](), [provenance](), [sbom](), [sigstore](), [software-supply-chain]() ### AI overview Chainguard describes how it doubled container build output from 500 million to more than 1 billion manifests in six months. The article explains how Chainguard Factory and Chainguard OS support continuous rebuilds, while using source builds, SLSA Level 3 provenance, Sigstore signatures, and full SBOMs. ### Source excerpt Chainguard doubled its container build output in six months. Learn how Factory 2.0 uses AI and reconciliation to rebuild secure software at scale. ## Solving Gradle metadata and Renovate integration DevFeed: [Solving Gradle metadata and Renovate integration]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-16T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Gradle](), [renovate](), [Kotlin](), [Groovy]() Tags: [ci](), [dependencies](), [dependency](), [development](), [gradle](), [renovate](), [software-supply-chain](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview The article describes setting up Renovate for a Gradle project and investigating why merges of updated dependency versions caused build failures. It also discusses dependency verification and software supply chain risks. ### Source excerpt My current company has settled on using Gradle. It doesn't make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc. This week, I worked on improvements to a new project and set up Renovate. ## Chainguard Libraries now available on AWS Security Hub Extended DevFeed: [Chainguard Libraries now available on AWS Security Hub Extended]() Original publisher: [Read original article]() Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [AWS Security Hub](), [Security](), [software supply-chain attack](), [Malware](), [Open Source](), [Amazon Web Services]() Tags: [ai-coding](), [aws-security-hub](), [axios](), [chainguard-libraries](), [dependencies](), [java](), [javascript](), [litellm](), [malware](), [mini-shai-hulud](), [npm](), [open-source](), [python](), [redhat](), [redhat-cloud-services](), [security](), [shai-hulud](), [software-supply-chain](), [software-supply-chain-attack](), [telnyx]() ### AI overview Chainguard Libraries is now available through AWS Security Hub Extended's Supply Chain category. The article presents it as a malware-free catalog of Python, Java, and JavaScript dependencies intended to reduce reliance on public registries and help protect AWS workloads from software supply-chain attacks. ### Source excerpt Chainguard Libraries is now available in AWS Security Hub Extended, delivering malware-resistant open source dependencies for AWS workloads. ## Why AI-assisted attacks made software supply chain security its own category DevFeed: [Why AI-assisted attacks made software supply chain security its own category]() Original publisher: [Read original article]() Published: 2026-08-03T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Security](), [Artificial Intelligence](), [Open Source](), [Agent Skills](), [Application Security](), [CI/CD]() Tags: [agent-skills](), [ai](), [ai-assisted-attacks](), [ci-cd](), [containers](), [open-source](), [secure-by-default](), [security](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain-security]() ### AI overview The article argues that AI has changed the economics and speed of software supply chain attacks, making software supply chain security a distinct category requiring dedicated tooling, budgets, and strategy. It describes how AI benefits defenders and attackers, while agents accelerate dependency adoption and introduce risks through artifacts such as agent skills. ### Source excerpt Software supply chain security is now its own category. Discover why AI is driving a shift toward trusted, secure-by-default open source. ## Introducing AI-powered container standardization DevFeed: [Introducing AI-powered container standardization]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-27T15:04:11Z Content type: article Language: en Sources: [Capital One Tech]() Topics: [Containers](), [Vulnerabilities](), [Security](), [Artificial Intelligence](), [supply-chain-security](), [sdlc]() Tags: [ai](), [ai-security](), [cloud-native](), [containers](), [requirements](), [security](), [software-development](), [software-engineering](), [software-supply-chain](), [vulnerabilities]() ### AI overview The article presents AI-powered container standardization as an approach to automate vulnerability detection, prioritization, remediation, testing, and patch deployment. It recommends avoiding exposure through curated base images and vetted dependencies, then automating ongoing remediation within the software development life cycle. ### Source excerpt AI-powered container standardization enables hands-free security remediation without sacrificing development velocity. In today's cloud-native world, containers have become the foundation of modern software delivery. Managing container security at scale can present significant challenges, thousands of vulnerabilities to track, manual remediation processes, inconsistent base images across teams and compliance requirements that slow everything down. AI-powered container standardization is a comprehensive approach that leverages artificial intelligence (AI) to automate vulnerability detection, prioritization and remediation across your entire container ecosystem. This transformative solution significantly reduces the manual toil traditionally associated with keeping containers secure and compliant. Development teams can focus on building features while the system automatically identifies vulnerabilities, generates fixes, tests changes and deploys patches, minimizing human intervention for routine updates. This approach simplifies the coordination of vulnerability remediation across hundreds of teams while ensuring that security and compliance are embedded throughout the software life cycle. Organizations can empower their developers to focus on innovation rather than patching, resulting in faster releases, stronger security and more productive engineering teams. The strategic framework: avoid and automate Our strategy for managing vulnerabilities focuses on two core principles: avoiding exposure and automating remediation, with governance baked into the software development life cycle. Avoid: Secure the foundation to minimize risk entering your environment. The most effective vulnerability remediation happens prior to the vulnerability reaching your digital ecosystems. By controlling what enters the software supply chain through curated base images and vetted dependencies/packages, you dramatically reduce the attack surface before code ever runs in production. This inc ## Understanding platform engineering's role in staying compliant with the EU's CRA DevFeed: [Understanding platform engineering's role in staying compliant with the EU's CRA]() Original publisher: [Read original article]() Author: Nigel Douglas Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Security](), [vulnerability management](), [supply-chain-security](), [incident]() Tags: [compliance](), [cyber-resilience-act](), [engineering](), [eu](), [idp](), [incident](), [platform](), [platform-engineering](), [policy](), [regulatory](), [sboms](), [secure-by-default](), [secure-software](), [security](), [software-supply-chain](), [supply-chain](), [vulnerabilities](), [vulnerability-management]() ### AI overview The article explains how platform engineering can operationalize compliance with the EU's Cyber Resilience Act by embedding secure-by-default practices, automated SBOMs, and rapid incident reporting into an Internal Development Platform. It also outlines CRA compliance milestones and manufacturer responsibilities, including vulnerability management and security updates. ### Source excerpt The EU's Cyber Resilience Act (CRA) mandates secure software by design. Discover how platform engineering operationalizes compliance by embedding secure-by-default standards, automated SBOMs, and rapid incident reporting into your Internal Development Platform (IDP). This approach transforms compliance into a frictionless golden path ## Why repository-centric security still needs an artifact access control plane DevFeed: [Why repository-centric security still needs an artifact access control plane]() Original publisher: [Read original article]() Author: Adrian Herrera Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [supply-chain-security](), [CI/CD](), [Security](), [Authorization](), [iac-security]() Tags: [access-control](), [ci-cd](), [infrastructure-as-code](), [security](), [security-policies](), [software-supply-chain](), [vulnerability](), [vulnerability-scanning]() ### AI overview The article explains that repository-centric security controls can leave gaps because dependency access is distributed across CI runners, ephemeral build agents, public registries, developer tooling, and automation. It argues for an artifact access control plane, including Virtual Registries, to enforce security policies inline across CI/CD execution paths, complementing repository-based vulnerability scanning, license analysis, dependency governance, and remediation. ### Source excerpt Repository security gaps: Distributed dependency access bypasses centralized analysis. Virtual Registries offer the critical inline control plane to enforce artifact security policies across your CI/CD pipeline. ## Announcing the State of Platform Engineering Report Vol 4 DevFeed: [Announcing the State of Platform Engineering Report Vol 4]() Original publisher: [Read original article]() Author: Sam Barlien Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Artificial Intelligence](), [AI Development](), [GPU](), [supply-chain-security](), [MLOps](), [finops]() Tags: [2026](), [ai](), [ai-ml](), [cloud-native](), [engineering](), [infrastructure](), [mlops](), [platform](), [platform-engineering](), [platforms](), [report](), [scale](), [software-supply-chain](), [speed]() ### AI overview The State of Platform Engineering Report Volume 4 presents platform engineering as a foundational discipline for modern enterprises. Based on insights from 518 engineers, it describes a shift from the cloud-native era to an AI-native era, emphasizing "shifting down," AI-powered platforms, platforms for AI, specialized GPU infrastructure, governance, and MLOps requirements. ### Source excerpt Insights from over 500 engineers. Explore the shift to 'AI-native,' the 'dual mandate,' 'shifting down,' and key trends for 2026. ## Responding to the Five Eyes guidance on AI and cyber risk DevFeed: [Responding to the Five Eyes guidance on AI and cyber risk]() Original publisher: [Read original article]() Published: 2026-07-15T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [Artificial Intelligence](), [Frontier AI](), [Resilience](), [vulnerability](), [chainguard]() Tags: [ai](), [chainguard](), [deployment](), [five-eyes-security](), [government-of-canada](), [identity-and-access-management](), [mythos](), [resilience](), [security](), [software-supply-chain](), [software-supply-chain-security](), [vulnerability]() ### AI overview The article interprets joint Five Eyes guidance warning that frontier AI may increase the speed, scale, and sophistication of cyberattacks. It argues that organizations should strengthen software supply chain security, accelerate vulnerability remediation, reduce unnecessary dependencies, address legacy systems, improve identity and access management, and build cyber resilience into business and development practices. ### Source excerpt The Five Eyes AI guidance urges organizations to strengthen software supply chain security. Learn how Chainguard helps teams stay ahead. ## The Mastra AI Ecosystem Was Poisoned At The Registry Level DevFeed: [The Mastra AI Ecosystem Was Poisoned At The Registry Level]() Original publisher: [Read original article]() Author: Roshan Piyush Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [software supply-chain attack](), [npm packages](), [Malware](), [Artificial Intelligence](), [CI/CD](), [TypeScript](), [Cloud]() Tags: [ai](), [ci-cd](), [malicious-packages](), [malware](), [mastra](), [npm](), [npm-packages](), [software-supply-chain](), [software-supply-chain-attack](), [typescript]() ### AI overview The article examines a June 17, 2026 software supply-chain attack targeting the Mastra AI TypeScript ecosystem. It reports that a compromised contributor account was used to publish 144 malicious packages under the official @mastra npm scope, with registry-level changes introducing the easy-day-js transitive dependency. Installations during the compromise window could expose developer workstations, CI/CD runners, and cloud environments to an information stealer. ### Source excerpt Learn how the Mastra AI supply chain attack poisoned npm packages, impacted AI pipelines, and how Harness SCS helps detect, block, and remediate compromised dep | Blog ## Optimizing OPA performance: From arrays to objects DevFeed: [Optimizing OPA performance: From arrays to objects]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-07T14:25:30Z Content type: tutorial Language: en Sources: [Capital One Tech]() Topics: [opa](), [Open Policy Agent](), [rego](), [Data structures](), [Optimization](), [Algorithms, Complexity]() Tags: [algorithms](), [cloud-native](), [data-structures](), [kubernetes](), [opa](), [open-policy-agent](), [optimization](), [performance-tuning](), [rego](), [software-development](), [software-engineering](), [software-supply-chain]() ### AI overview This article explains how to improve Open Policy Agent performance by choosing appropriate data structures for Rego policies. It focuses on replacing nested arrays with keyed objects to avoid inefficient array traversal when evaluating large datasets. ### Source excerpt Achieve 99% faster Rego policy execution through optimization. Note: This post focuses on one aspect of performance tuning Rego policies and datasets evaluated by OPA-arrays vs. objects. The Rego Style Guide and Regal Rego linter are very helpful resources for learning Rego best practices and avoiding code smells in Rego policies. There is also the OPA performance tuning documentation. In 2018, I started using open policy agent (OPA) as a solution for controlling and preventing unwanted behaviors in our Kubernetes Clusters. OPA, along with Kubernetes Dynamic Admission Control, provided a means to build preventive controls. Since then, I have worked with several PaC solutions. I have always stayed close to the OPA tool set because of how well it supports multiple use cases. OPA is domain agnostic and can be used with virtually any use case, as long as you supply the correct data and policies. To that end, OPA use cases have expanded throughout several technical disciplines, such as cloud-native computing and software supply chain management. OPA performance engineering OPA enables us to unify PaC solutions across multiple use cases and systems, using the same languages and tools. However, there is always room for improvement and performance engineering policies and the execution thereof. In addition, optimizing data that policies evaluate and mutate should be part of our focus when we deliver OPA-based solutions. Recently I was asked to help with OPA performance issues. I made several recommendations, but I overlooked one simple and glaring issue: the poor performing policy was processing a large data set using nested-arrays, instead of the best practice of using keyed-objects. Later, something was bothering me about my interaction and I realized that while I gave decent architectural level advice, I completely missed the best engineering advice. Rego policies and data should be optimized just like other algorithms and relative data, and part of that optimization is ## The State of Trusted Open Source: June 2026 DevFeed: [The State of Trusted Open Source: June 2026]() Original publisher: [Read original article]() Published: 2026-06-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [supply-chain-security](), [vulnerability](), [Artificial Intelligence](), [Security]() Tags: [2026](), [ai](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [cve](), [cve-data](), [cves](), [data](), [dependency](), [java](), [javascript](), [nginx](), [node](), [open-source](), [python](), [report](), [security](), [software](), [software-supply-chain](), [software-supply-chain-security](), [state-of-trusted-open-source](), [trends](), [vulnerability]() ### AI overview Chainguard's June 2026 report analyzes vulnerability data from more than 2,400 container image projects and 18,016 vulnerability instances observed from March through May 2026. It reports 886 distinct CVEs, with 63.1% of observed instances classified as high severity, and examines how AI-assisted development and security research are affecting software supply-chain risk. ### Source excerpt AI is accelerating vulnerability discovery. Explore the latest trusted open source trends, dependency risks, and CVE insights from Chainguard's report. ## Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java DevFeed: [Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java]() Original publisher: [Read original article]() Published: 2026-06-25T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard libraries](), [chainguard libraries for python](), [Java](), [supply-chain-security](), [Security]() Tags: [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-java](), [chainguard-libraries-for-python](), [cves](), [dependencies](), [java](), [provenance](), [python](), [security](), [software-supply-chain](), [supply-chain](), [wiz](), [wiz-chainguard-libraries](), [wiz-chainguard-scanner]() ### AI overview Wiz now scans Chainguard Libraries for Python and Java. The partnership combines source-built dependencies and backported fixes with Wiz's risk context and visibility, helping organizations assess vulnerabilities, prioritize remediation, and verify artifact provenance. ### Source excerpt Wiz now scans Chainguard Libraries for Python and Java, combining trusted, source-built dependencies with risk-based visibility and remediation. ## Everything we announced during AI Readiness Innovation Week DevFeed: [Everything we announced during AI Readiness Innovation Week]() Original publisher: [Read original article]() Published: 2026-06-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [ai-coding](), [supply-chain-security](), [chainguard](), [open-source-security](), [Vulnerabilities](), [Security](), [chainguard libraries](), [chainguard containers](), [CI/CD](), [Frontier AI](), [GitHub]() Tags: [ai](), [ai-readiness](), [athena](), [aws-kiro](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [ci-cd](), [containers](), [cursor](), [frontier-ai-models](), [gartner-magic-quadrant](), [github](), [innovation](), [open-source](), [security](), [software-supply-chain](), [software-supply-chain-security](), [speed](), [vulnerabilities]() ### AI overview Chainguard summarizes announcements from AI Readiness Innovation Week, covering supply-chain security advances for containers, libraries, CI/CD pipelines, AI agent skills, IDE integrations, partnerships, and an industry coalition. The article highlights Athena, a coalition designed to coordinate defense against vulnerabilities discovered by frontier AI models. ### Source excerpt Read about everything Chainguard announced during AI Readiness Innovation Week, including new features for Chainguard Libraries and Chainguard Containers. ## Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-18T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [Security](), [Open Source]() Tags: [2026](), [chainguard](), [chainguard-gartner](), [chainguard-gartner-magic-quadrant](), [cyber-resilience-act](), [fedramp](), [gartner](), [gartner-mq-software-supply-chain](), [nis2](), [provenance](), [sboms](), [secure-by-default](), [security](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [software-supply-chain-security-gartner]() ### AI overview Chainguard announces that it has been recognized as a Leader in the 2026 Gartner Magic Quadrant for Software Supply Chain Security. The article highlights Chainguard's secure-by-default approach, hardened open source artifacts, cryptographic signatures, signed SBOMs, and SLSA-aligned provenance, along with support for regulatory requirements. ### Source excerpt Chainguard named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security, recognized for vision and secure-by-default innovation. ## Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026 DevFeed: [Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-06-02T02:34:08Z Content type: news Language: en Sources: [T.J. Maher]() Topics: [open-source-security](), [supply-chain-security](), [Malware](), [npm](), [PyPI](), [GitHub](), [software composition analysis](), [Security]() Tags: [github](), [malware](), [npm](), [open-source](), [pypi](), [sca](), [security](), [software-supply-chain](), [sqgne](), [supply-chain](), [supply-chain-attacks]() ### AI overview The Software Quality Group of New England will host a June 17, 2026 meeting featuring Bryan Whyte of Sonatype on open-source malware and software supply chain defense. The session will cover threats targeting npm, PyPI, GitHub, and development pipelines; differences between open-source malware and traditional malware or vulnerabilities; and common tactics used in software supply chain attacks. ### Source excerpt "Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats" will be the topic of the next Software Quality Group of New England (sqgne.org) meeting. Speaker: Bryan Whyte, CISSP Director, Solutions Engineering @Sonatype Date: June 17, 2026 @ 6:00 pm Join us on Zoom or in person at Burlington, MA ( Register Here ) "Bryan Whyte breaks down the latest wave of open source malware, explains how these threats diverge from traditional vulnerabilities, and shares actionable steps for organizations to defend mission-critical software. "As organizations deepen their reliance on open-source software, evolving security threats are reshaping the landscape at an unprecedented pace. "Threat actors are now increasingly targeting development pipelines and trusted ecosystems like npm to orchestrate supply chain attacks with significant downstream impact. Incidents such as the 2025 Shai-Hulud npm campaign, the XZ Utils backdoor, and the widespread compromise of over 23,000 GitHub repositories illustrate how open-source malware has quickly become a critical, top-tier threat built to evade legacy scanning and exploit trust woven into modern delivery pipelines. "--The shifting tactics of threat actors targeting npm, PyPi, GitHub, and development pipelines "--Key differences between open-source malware and traditional malware or vulnerabilities "--The most prevalent malware types and tactics driving today's software supply chain attacks "After spending 20 years in software development, Bryan started his journey into Application Security in 2015 with the AppScan tool suite for Static, Dynamic and Mobile Application Security Testing. In 2018, he expanded his Cybersecurity proficiency, earning the Certified Information Systems Security Professional (CISSP). In 2019, he was excited to join Sonatype due to the explosive growth of open-source software, which has made Software Composition Analysis (SCA) a critical aspect of Application Security". See you there! Happy Testing ## Building for the AI era: Chainguard partners with Endor Labs DevFeed: [Building for the AI era: Chainguard partners with Endor Labs]() Original publisher: [Read original article]() Published: 2026-05-19T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Application Security](), [Artificial Intelligence](), [AI-assisted coding](), [chainguard containers](), [Containers](), [Library](), [Agent Skill](), [CI/CD]() Tags: [agent](), [ai](), [ai-coding-agents](), [application-security](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [containers](), [cves](), [endor](), [endor-labs](), [observability](), [provenance](), [sboms](), [software-supply-chain](), [vulnerabilities]() ### AI overview Chainguard partners with Endor Labs to help teams building with AI coding agents secure the software supply chain. Chainguard provides source-built artifacts, daily rebuilds, signed SBOMs, and SLSA Level 3 provenance, while Endor Labs analyzes application context to identify vulnerabilities that are genuinely reachable and exploitable. ### Source excerpt Chainguard and Endor Labs help teams build securely at AI speed with source-built artifacts, exploitability analysis, and fewer vulnerabilities to triage. ## How does Chainguard prevent malware in Chainguard Libraries? DevFeed: [How does Chainguard prevent malware in Chainguard Libraries?]() Original publisher: [Read original article]() Published: 2026-05-01T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [Malware](), [supply-chain-security](), [chainguard](), [Open Source](), [Artificial Intelligence]() Tags: [ai](), [chainguard](), [chainguard-libraries](), [malware](), [open-source](), [software-supply-chain](), [supply-chain]() ### AI overview Chainguard explains how Chainguard Libraries protects customers from malware in open source dependencies by building packages from source in a controlled environment. The article describes binary artifacts without corresponding source code as a common supply-chain attack vector and highlights Chainguard's AI-powered Factory for reproducing packages at scale. ### Source excerpt With Chainguard Libraries, customers rely on a single controlled, auditable system. ## Chainguard EKS add-ons are now available in the AWS Marketplace DevFeed: [Chainguard EKS add-ons are now available in the AWS Marketplace]() Original publisher: [Read original article]() Published: 2026-04-30T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [Amazon EKS](), [aws-marketplace](), [chainguard](), [Security](), [supply-chain-security](), [Image](), [Containers]() Tags: [aws-eks-add-ons](), [aws-marketplace](), [chainguard](), [chainguard-aws](), [chainguard-containers](), [chainguard-eks-add-ons](), [compliance](), [eks-add-ons](), [fips](), [fips-140-3](), [kubernetes](), [security](), [software-supply-chain]() ### AI overview Chainguard announces that its EKS add-ons are available in AWS Marketplace. The five add-ons provide networking, DNS, storage, and traffic-management components, with zero-known-CVE images and FIPS 140-3 validation for organizations that need greater control over security and compliance. ### Source excerpt Chainguard delivers zero-CVE, FIPS 140-3 EKS add-ons on AWS Marketplace, simplifying secure Kubernetes for regulated environments with full control. ## AI is finding vulnerabilities faster than anyone can patch them. Now what? DevFeed: [AI is finding vulnerabilities faster than anyone can patch them. Now what?]() Original publisher: [Read original article]() Published: 2026-04-10T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [Artificial Intelligence](), [supply-chain-security](), [Claude](), [anthropic](), [Maintainers](), [Open Source](), [Exploit](), [Operating system](), [browser]() Tags: [ai](), [anthropic](), [attacks](), [chainguard-for-ai](), [claude](), [claude-mythos-preview](), [cves](), [exploit](), [maintainers](), [open-source](), [project-glasswing](), [security](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain-attacks](), [vulnerabilities]() ### AI overview The article argues that AI systems such as Claude Mythos Preview are discovering zero-day vulnerabilities faster than organizations and open-source maintainers can patch them. It describes the resulting risks for software supply chains, including faster exploitation, uneven vendor response, and increased pressure on maintainers, while presenting verifiable-source, secure-by-default artifacts as a defensive approach. ### Source excerpt Project Glasswing and Claude Mythos Preview reveal a surge in zero-days. Learn why reactive patching fails and how secure-by-default supply chains keep you safe. ## Ship and patch doesn't cut it in the AI era DevFeed: [Ship and patch doesn't cut it in the AI era]() Original publisher: [Read original article]() Published: 2026-04-08T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [AI-assisted coding](), [supply-chain-security](), [Security](), [prompt injection](), [GitHub Actions](), [litellm](), [trivy]() Tags: [ai](), [ai-code-security](), [ai-coding](), [ai-security](), [chainguard-containers-for-ai](), [chainguard-libraries-for-ai](), [github-actions](), [litellm](), [prompt-injection](), [security](), [software-supply-chain](), [software-supply-chain-security](), [trivy]() ### AI overview This opinion article argues that AI-generated code and dependencies are entering software environments faster than traditional security review processes can handle, while AI also accelerates vulnerability discovery and attacks. It concludes that reactive scanning and patching alone are insufficient and emphasizes trusted inputs for software supply-chain security. ### Source excerpt AI is accelerating code and attacks. Learn why patching alone can't keep up, and why securing the software supply chain starts with trusted inputs. ## Attacks rewritten: Where malware enters the build DevFeed: [Attacks rewritten: Where malware enters the build]() Original publisher: [Read original article]() Published: 2026-04-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Malware](), [CI/CD](), [Maintainers](), [Vulnerabilities]() Tags: [attacks](), [chainguard-libraries](), [ci-cd](), [maintainers](), [malware](), [package-malware](), [security](), [sha1-hulud](), [software-supply-chain](), [solarwinds](), [supply-chain](), [supply-chain-attacks](), [teampcp]() ### AI overview This article explains how modern software supply chain attacks can affect production deployments, CI/CD clusters, developer workstations, and other systems. It describes the shift from exploiting known production vulnerabilities to injecting malicious code upstream through compromised maintainer accounts, package managers, and binary dependencies. ### Source excerpt Modern supply chain attacks target CI, dev machines, and dependencies. Learn how building from source helps prevent malware and reduce risk. [Next page]()