# software supply chain security Published articles for software supply chain security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How financial services companies can modernize their software supply chain DevFeed: [How financial services companies can modernize their software supply chain]() Original publisher: [Read original article]() Published: 2026-09-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [open-source-security](), [Security](), [Vulnerabilities](), [Business Security]() Tags: [cve](), [dependency](), [financial-services](), [legacy](), [security](), [software-supply-chain-security](), [vulnerabilities]() ### AI overview This article argues that financial services organizations should modernize software supply chain security while preserving business-critical systems. It explains that legacy infrastructure, regulatory obligations, and downtime concerns have encouraged deferred vulnerability remediation, but AI-assisted exploitation is making that risk increasingly dangerous. ### Source excerpt Modernize your financial software supply chain without disrupting critical systems. See how trusted open source reduces risk without major migrations. ## Proven, not promised: Chainguard Containers achieves SLSA Build Level 3 DevFeed: [Proven, not promised: Chainguard Containers achieves SLSA Build Level 3]() Original publisher: [Read original article]() Published: 2026-08-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [supply-chain-security](), [software bill of materials](), [Security]() Tags: [chainguard](), [chainguard-containers](), [provenance](), [sbom](), [security](), [signing](), [slsa](), [software-supply-chain-security](), [supply-chain]() ### AI overview Chainguard says Coalfire independently assessed the Chainguard Containers build and release system as meeting SLSA Build Level 3 requirements. The article describes hardened, isolated builds, separately managed signing, provenance generation, and signed SBOMs for releases. ### Source excerpt Coalfire independently assessed Chainguard Containers at SLSA Build Level 3, validating hardened builds, provenance, and supply chain integrity. ## ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough DevFeed: [ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough]() Original publisher: [Read original article]() Author: Harness Team Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [ChainDrop](), [npm](), [supply-chain-security](), [Malware](), [npm packages](), [GitHub Actions](), [GitHub]() Tags: [chaindrop](), [ci](), [ci-cd](), [github](), [github-actions](), [integrity](), [least-privilege](), [malware](), [npm](), [npm-worm](), [openid-connect](), [provenance](), [security](), [slsa](), [software-supply-chain-security](), [worm]() ### AI overview The ChainDrop npm worm compromised hundreds of packages while retaining valid SLSA provenance, demonstrating that build attestations do not guarantee source integrity. The article explains the worm's propagation, credential theft, persistence mechanisms, and recommended defenses, including source governance, dependency controls, least-privilege identities, policy gates, and runtime evidence. ### Source excerpt ChainDrop poisoned hundreds of npm packages while retaining valid provenance. Learn why signed builds need source governance, policy gates, and runtime evidence | Blog ## Why AI-assisted attacks made software supply chain security its own category DevFeed: [Why AI-assisted attacks made software supply chain security its own category]() Original publisher: [Read original article]() Published: 2026-08-03T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Security](), [Artificial Intelligence](), [Open Source](), [Agent Skills](), [Application Security](), [CI/CD]() Tags: [agent-skills](), [ai](), [ai-assisted-attacks](), [ci-cd](), [containers](), [open-source](), [secure-by-default](), [security](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain-security]() ### AI overview The article argues that AI has changed the economics and speed of software supply chain attacks, making software supply chain security a distinct category requiring dedicated tooling, budgets, and strategy. It describes how AI benefits defenders and attackers, while agents accelerate dependency adoption and introduce risks through artifacts such as agent skills. ### Source excerpt Software supply chain security is now its own category. Discover why AI is driving a shift toward trusted, secure-by-default open source. ## Mitigating WordPress attacks with containers DevFeed: [Mitigating WordPress attacks with containers]() Original publisher: [Read original article]() Published: 2026-07-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [WordPress](), [Containers](), [Exploit](), [Vulnerabilities]() Tags: [chainguard-containers](), [containers](), [database](), [distroless](), [files](), [hardened-containers](), [remote-code-execution](), [software-supply-chain-security](), [vulnerabilities](), [wordpress](), [wordpress-cves]() ### AI overview This article examines the wp2shell attack, in which two WordPress vulnerabilities can be chained to achieve remote code execution. It explains that hardened, distroless containers and read-only filesystems can limit an attacker's capabilities and simplify recovery, while emphasizing the need to update WordPress immediately. ### Source excerpt The wp2shell WordPress exploit enables remote code execution. Learn how hardened containers help reduce the blast radius of compromise. ## Growing up the hard way DevFeed: [Growing up the hard way]() Original publisher: [Read original article]() Published: 2026-07-22T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [open-source-security](), [ai regulation](), [Artificial Intelligence](), [Security]() Tags: [chainguard-software-supply-chain-security](), [open-source](), [open-source-security](), [open-source-software](), [oss](), [security](), [shai-hulud](), [software-supply-chain-security](), [solarwinds](), [supply-chain](), [teampcp]() ### AI overview This opinion argues that open source is entering a difficult transition after supply-chain incidents, regulatory pressure, and the industrialization of malware. It forecasts that the Open Source definition will remain intact while enterprise and regulatory requirements change which open source software organizations are willing or permitted to consume, with AI-driven vulnerability discovery and poisoned distribution channels creating pressure on both fronts. ### Source excerpt Open source is growing up. Explore why AI, regulation, and enterprise security are reshaping how organizations consume open source software. ## Responding to the Five Eyes guidance on AI and cyber risk DevFeed: [Responding to the Five Eyes guidance on AI and cyber risk]() Original publisher: [Read original article]() Published: 2026-07-15T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [Artificial Intelligence](), [Frontier AI](), [Resilience](), [vulnerability](), [chainguard]() Tags: [ai](), [chainguard](), [deployment](), [five-eyes-security](), [government-of-canada](), [identity-and-access-management](), [mythos](), [resilience](), [security](), [software-supply-chain](), [software-supply-chain-security](), [vulnerability]() ### AI overview The article interprets joint Five Eyes guidance warning that frontier AI may increase the speed, scale, and sophistication of cyberattacks. It argues that organizations should strengthen software supply chain security, accelerate vulnerability remediation, reduce unnecessary dependencies, address legacy systems, improve identity and access management, and build cyber resilience into business and development practices. ### Source excerpt The Five Eyes AI guidance urges organizations to strengthen software supply chain security. Learn how Chainguard helps teams stay ahead. ## Athena's free vulnerability intelligence model and the economics of security clearinghouses DevFeed: [Athena's free vulnerability intelligence model and the economics of security clearinghouses]() Original publisher: [Read original article]() Published: 2026-07-15T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [Open Source](), [Critical Infrastructure](), [Network]() Tags: [akrites](), [chainguard-athena](), [critical-infrastructure](), [fable](), [infrastructure](), [money](), [mythos](), [network](), [open-source](), [security](), [software-supply-chain-security](), [trust](), [vulnerability-clearninghouse]() ### AI overview The article explains why Athena provides pre-disclosure vulnerability findings to infrastructure and network partners for free. It argues that allowing partners to commercialize services built on advance security information can align incentives, trust, and broader defensive value, while distinguishing government programs from commercial clearinghouses. ### Source excerpt Why give away the most valuable data in security? Learn how Athena's business model aligns trust, incentives, and open source defense. ## The State of Trusted Open Source: June 2026 DevFeed: [The State of Trusted Open Source: June 2026]() Original publisher: [Read original article]() Published: 2026-06-30T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [supply-chain-security](), [vulnerability](), [Artificial Intelligence](), [Security]() Tags: [2026](), [ai](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [cve](), [cve-data](), [cves](), [data](), [dependency](), [java](), [javascript](), [nginx](), [node](), [open-source](), [python](), [report](), [security](), [software](), [software-supply-chain](), [software-supply-chain-security](), [state-of-trusted-open-source](), [trends](), [vulnerability]() ### AI overview Chainguard's June 2026 report analyzes vulnerability data from more than 2,400 container image projects and 18,016 vulnerability instances observed from March through May 2026. It reports 886 distinct CVEs, with 63.1% of observed instances classified as high severity, and examines how AI-assisted development and security research are affecting software supply-chain risk. ### Source excerpt AI is accelerating vulnerability discovery. Explore the latest trusted open source trends, dependency risks, and CVE insights from Chainguard's report. ## Everything we announced during AI Readiness Innovation Week DevFeed: [Everything we announced during AI Readiness Innovation Week]() Original publisher: [Read original article]() Published: 2026-06-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [ai-coding](), [supply-chain-security](), [chainguard](), [open-source-security](), [Vulnerabilities](), [Security](), [chainguard libraries](), [chainguard containers](), [CI/CD](), [Frontier AI](), [GitHub]() Tags: [ai](), [ai-readiness](), [athena](), [aws-kiro](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [ci-cd](), [containers](), [cursor](), [frontier-ai-models](), [gartner-magic-quadrant](), [github](), [innovation](), [open-source](), [security](), [software-supply-chain](), [software-supply-chain-security](), [speed](), [vulnerabilities]() ### AI overview Chainguard summarizes announcements from AI Readiness Innovation Week, covering supply-chain security advances for containers, libraries, CI/CD pipelines, AI agent skills, IDE integrations, partnerships, and an industry coalition. The article highlights Athena, a coalition designed to coordinate defense against vulnerabilities discovered by frontier AI models. ### Source excerpt Read about everything Chainguard announced during AI Readiness Innovation Week, including new features for Chainguard Libraries and Chainguard Containers. ## Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard containers](), [container images](), [Security](), [Containers](), [chainguard libraries]() Tags: [chainguard](), [chainguard-containers](), [chainguard-gartner](), [chainguard-gartner-mq](), [chainguard-libraries](), [container-images](), [gartner](), [gartner-magic-quadrant](), [sboms](), [secure-by-default](), [security](), [software-supply-chain-security](), [software-supply-chain-security-gartner](), [software-supply-chain-security-mq](), [zero-cves]() ### AI overview Chainguard's article discusses its recognition as a Leader in Gartner's inaugural Magic Quadrant for Software Supply Chain Security. It argues that accelerating vulnerability exploitation and AI-assisted development require prevention-oriented, secure-by-default supply chain security. The article highlights Chainguard Containers, which provides minimal container images rebuilt daily from source, with zero CVEs, SBOMs, and verifiable signatures, and briefly introduces Chainguard Libraries. ### Source excerpt Gartner names Chainguard a Leader in Software Supply Chain Security, highlighting its secure-by-default approach and market vision. ## Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Chainguard is named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-18T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [Security](), [Open Source]() Tags: [2026](), [chainguard](), [chainguard-gartner](), [chainguard-gartner-magic-quadrant](), [cyber-resilience-act](), [fedramp](), [gartner](), [gartner-mq-software-supply-chain](), [nis2](), [provenance](), [sboms](), [secure-by-default](), [security](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [software-supply-chain-security-gartner]() ### AI overview Chainguard announces that it has been recognized as a Leader in the 2026 Gartner Magic Quadrant for Software Supply Chain Security. The article highlights Chainguard's secure-by-default approach, hardened open source artifacts, cryptographic signatures, signed SBOMs, and SLSA-aligned provenance, along with support for regulatory requirements. ### Source excerpt Chainguard named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security, recognized for vision and secure-by-default innovation. ## Luck isn't a security control: What happened with mini Shai-Hulud and what you need to do DevFeed: [Luck isn't a security control: What happened with mini Shai-Hulud and what you need to do]() Original publisher: [Read original article]() Published: 2026-05-13T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [Malware](), [Open Source](), [GitHub Actions](), [npm](), [CI/CD](), [GitHub](), [AI-assisted coding](), [vulnerability]() Tags: [ai-coding-agents](), [chainguard-containers](), [chainguard-libraries](), [ci-cd](), [dependencies](), [github](), [github-actions](), [mini-shai-hulud](), [npm](), [packages](), [provenance](), [python](), [security](), [shai-hulud](), [software-supply-chain-security](), [supply-chain](), [worm]() ### AI overview This article examines the mini Shai-Hulud supply chain worm, which affected more than 400 packages. It argues that malicious code can enter during package build and distribution without a CVE, and that teams should strengthen preventive security across registries, GitHub Actions, CI/CD pipelines, dependencies, AI coding agents, and configuration files. ### Source excerpt A new supply chain worm hit 400+ packages. Learn why preventive security, not reactive patching, is the only way to stop the next attack. ## Cyber resiliency in practice: Lessons from recent supply chain attacks DevFeed: [Cyber resiliency in practice: Lessons from recent supply chain attacks]() Original publisher: [Read original article]() Published: 2026-05-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [resiliency](), [supply chain attacks](), [supply-chain-security](), [axios](), [GitHub Actions](), [litellm](), [trivy](), [npm](), [PyPI](), [Python](), [Large Language Model]() Tags: [axios](), [chainguard-libraries](), [cyber-resiliency](), [cybersecurity](), [github-actions](), [litellm](), [malware](), [npm](), [pypi](), [python](), [security](), [security-attacks](), [social-engineering](), [software-supply-chain-security](), [supply-chain-attacks](), [trivy](), [worm]() ### AI overview The article defines cyber resiliency as an integrated ability to anticipate, withstand, recover from, and adapt to attacks across the full Protect, Detect, Respond, and Recover lifecycle. It examines recent supply chain attacks involving Trivy, Axios, and LiteLLM, highlighting risks such as GitHub Actions misconfiguration, long-lived tokens, incomplete credential rotation, mutable Git tags, maintainer-account compromise, and malicious package releases. ### Source excerpt Learn how modern cyber resiliency helps organizations prevent, detect, and recover from supply chain attacks like Trivy, Axios, and LiteLLM. ## Building the business case for a secure open source supply chain DevFeed: [Building the business case for a secure open source supply chain]() Original publisher: [Read original article]() Published: 2026-05-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [open-source-security](), [vulnerability management](), [cloud-infrastructure](), [CI/CD](), [distributed-systems](), [container images](), [engineering-culture]() Tags: [chainguard-assemble](), [chainguard-containers](), [chainguard-customers](), [cloud-infrastructure](), [cloud-native](), [compliance](), [container-images](), [continuous-delivery](), [cves](), [dependencies](), [distributed-systems](), [kyndryl](), [kyndryl-open-source](), [open-source](), [productivity](), [resilience](), [secure-open-source](), [software-supply-chain-security](), [supply-chain](), [vulnerabilities]() ### AI overview The article explains how organizations can build a business case for a secure open source supply chain. It describes a shift from framing open source security solely around CVEs, scanner results, and patching toward presenting trusted open source as a driver of productivity, resilience, and delivery speed. It also explains why traditional vulnerability management struggles with continuous delivery, distributed systems, frequently rebuilt container images, changing dependencies, and global cloud infrastructure. ### Source excerpt Learn how Kyndryl reframed open source security as a business driver -- reducing risk, lowering costs, and accelerating developer productivity. ## AI is finding vulnerabilities faster than anyone can patch them. Now what? DevFeed: [AI is finding vulnerabilities faster than anyone can patch them. Now what?]() Original publisher: [Read original article]() Published: 2026-04-10T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [Artificial Intelligence](), [supply-chain-security](), [Claude](), [anthropic](), [Maintainers](), [Open Source](), [Exploit](), [Operating system](), [browser]() Tags: [ai](), [anthropic](), [attacks](), [chainguard-for-ai](), [claude](), [claude-mythos-preview](), [cves](), [exploit](), [maintainers](), [open-source](), [project-glasswing](), [security](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain-attacks](), [vulnerabilities]() ### AI overview The article argues that AI systems such as Claude Mythos Preview are discovering zero-day vulnerabilities faster than organizations and open-source maintainers can patch them. It describes the resulting risks for software supply chains, including faster exploitation, uneven vendor response, and increased pressure on maintainers, while presenting verifiable-source, secure-by-default artifacts as a defensive approach. ### Source excerpt Project Glasswing and Claude Mythos Preview reveal a surge in zero-days. Learn why reactive patching fails and how secure-by-default supply chains keep you safe. ## Chainguard Libraries is now free until June 30, 2026 -- no commitment required DevFeed: [Chainguard Libraries is now free until June 30, 2026 -- no commitment required]() Original publisher: [Read original article]() Published: 2026-04-09T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [open-source-security](), [Security](), [Malware](), [Java](), [JavaScript](), [Python]() Tags: [2026](), [article](), [attacks](), [axios](), [chainguard-console](), [chainguard-libraries](), [chainguard-repository](), [code](), [dependency](), [free](), [install](), [java](), [javascript](), [libraries](), [library](), [litellm](), [malicious-packages](), [malware](), [open-source](), [open-source-packages](), [open-source-security](), [packages](), [rebuilds](), [software-supply-chain-security](), [telnyx](), [trivy-attack]() ### AI overview Chainguard Libraries is free for Chainguard console users until June 30, 2026, with no paid commitment required. It rebuilds Python, Java, and JavaScript packages from verified source in isolated environments and excludes libraries that use install-time scripts, helping reduce malware and software supply-chain risk. ### Source excerpt Open source attacks are rising. Chainguard Libraries rebuilds packages from verified source to block malware--now free until June 30, 2026. ## Supply chain attacks expose weaknesses in open-source software trust DevFeed: [Supply chain attacks expose weaknesses in open-source software trust]() Original publisher: [Read original article]() Published: 2026-04-09T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [vulnerability](), [Exploit](), [npm]() Tags: [ai-coding](), [attacks](), [chainguard](), [code](), [dependency](), [hardening](), [npm](), [open-source](), [open-source-security](), [oss](), [pypi](), [scanner](), [secrets](), [software-supply-chain-security](), [solarwinds](), [supply-chain](), [supply-chain-attacks](), [trust](), [vibe-coding](), [vulnerability](), [vulnerability-scanner]() ### AI overview This opinion article argues that a series of open-source supply chain attacks exposed a broken trust model. It discusses attacks involving npm and PyPI packages, stolen credentials, malicious contributors, and the limits of vulnerability scanning and hardening. ### Source excerpt Five supply chain attacks in 12 days exposed a broken trust model. Learn why scanning and hardening fail, and why trusting the source is the only fix. ## Ship and patch doesn't cut it in the AI era DevFeed: [Ship and patch doesn't cut it in the AI era]() Original publisher: [Read original article]() Published: 2026-04-08T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Artificial Intelligence](), [AI-assisted coding](), [supply-chain-security](), [Security](), [prompt injection](), [GitHub Actions](), [litellm](), [trivy]() Tags: [ai](), [ai-code-security](), [ai-coding](), [ai-security](), [chainguard-containers-for-ai](), [chainguard-libraries-for-ai](), [github-actions](), [litellm](), [prompt-injection](), [security](), [software-supply-chain](), [software-supply-chain-security](), [trivy]() ### AI overview This opinion article argues that AI-generated code and dependencies are entering software environments faster than traditional security review processes can handle, while AI also accelerates vulnerability discovery and attacks. It concludes that reactive scanning and patching alone are insufficient and emphasizes trusted inputs for software supply-chain security. ### Source excerpt AI is accelerating code and attacks. Learn why patching alone can't keep up, and why securing the software supply chain starts with trusted inputs. ## Super SBOMs: See exactly what's inside DevFeed: [Super SBOMs: See exactly what's inside]() Original publisher: [Read original article]() Published: 2026-01-29T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [Containers](), [chainguard](), [Security](), [spdx]() Tags: [chainguard-containers](), [chainguard-sboms](), [containers](), [cyclonedx](), [fedramp](), [sbom](), [sboms](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vulnerability]() ### AI overview Chainguard Containers now provide richer SBOMs with binary-level details about embedded libraries and dependencies, along with CycloneDX support in addition to SPDX. The added visibility helps teams trace vulnerabilities and assess license compliance. ### Source excerpt Chainguard Containers ship richer SBOMs with binary-level library details plus new CycloneDX support, making CVE impact and compliance tracing fast and clear. ## Running Renovate as a GitHub Action (and NO PAT!) DevFeed: [Running Renovate as a GitHub Action (and NO PAT!)]() Original publisher: [Read original article]() Published: 2026-01-19T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [renovate](), [GitHub Actions](), [octo sts](), [github personal access token](), [Security](), [maintenance]() Tags: [chainguard-containers](), [chainguard-images](), [dependabot](), [dependencies](), [github](), [github-action](), [github-pat-alternative](), [guide](), [maintenance](), [octo-sts](), [personal-access-token](), [renovate](), [run](), [security](), [software-supply-chain-security]() ### AI overview This tutorial explains how to run Renovate as a scheduled GitHub Action to update repository dependencies without using a long-lived GitHub Personal Access Token. It presents Octo STS as the replacement for the PAT and outlines the workflow setup. ### Source excerpt Discover how you can run Renovate as a GitHub Action without needing a GitHub Personal Access Token by using Octo STS. ## Why Trusted Software Supply Chains Matter More Than Zero-CVE Container Claims DevFeed: [Why Trusted Software Supply Chains Matter More Than Zero-CVE Container Claims]() Original publisher: [Read original article]() Published: 2026-01-15T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [container-security](), [container images](), [Docker Hub](), [Containers](), [Docker](), [Software]() Tags: [ceo](), [chainguard](), [chainguard-containers](), [chainguard-images](), [chainguard-libraries](), [container-images](), [docker](), [docker-hub](), [docker-images](), [echo-security](), [hardened-images](), [hardening](), [minimus](), [rapidfort](), [secure-by-default](), [security](), [software-supply-chain-security](), [wiz-images](), [zero-cves]() ### AI overview Chainguard CEO Dan Lorenc argues that container security depends on trusting the origins and build processes of software, rather than relying primarily on post-hoc image hardening or zero-CVE claims. ### Source excerpt Chainguard CEO Dan Lorenc explains why real security comes from trusted, from-source software supply chains, not post-hoc hardening or zero-CVE promises. ## Zed Moves Toward Secure-by-Default: Introducing Worktree Trust DevFeed: [Zed Moves Toward Secure-by-Default: Introducing Worktree Trust]() Original publisher: [Read original article]() Author: John Swanson, Kirill Bulatov Published: 2025-12-17T00:00:00Z Content type: release Language: en Sources: [Zed Industries - Blog]() Topics: [supply-chain-security](), [Security](), [MCP Server](), [vulnerability]() Tags: [configuration](), [mcp-server](), [release](), [secure-by-default](), [security](), [software-supply-chain-security](), [vulnerability]() ### AI overview Zed introduces a preview worktree trust mechanism to support secure-by-default behavior. Project settings will no longer automatically download or execute language servers or MCP servers without giving users an opportunity to review and trust the worktree. ### Source excerpt We're introducing a new worktree trust mechanism while maintaining options for a low-friction experience you expect from Zed. ## Meeting the Zero-CVE Mandate: How Chainguard Helps Businesses Ship Secure Software That Customers Trust DevFeed: [Meeting the Zero-CVE Mandate: How Chainguard Helps Businesses Ship Secure Software That Customers Trust]() Original publisher: [Read original article]() Published: 2025-10-06T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [Containers](), [software bill of materials](), [Security]() Tags: [chainguard](), [chainguard-containers](), [chainguard-custom-assembly](), [chainguard-images](), [containers](), [cves](), [provenance](), [sboms](), [secure-software](), [security](), [software-supply-chain-security](), [zero-cves]() ### AI overview The article explains how Chainguard helps businesses meet stricter software security requirements for self-hosted, cloud, packaged-agent, and embedded software. It focuses on zero known CVEs at delivery, verifiable SBOMs, provenance attestations, compatibility with security tooling, and the challenges of open source dependencies and container images. ### Source excerpt Chainguard's zero-CVE containers come with broad compatibility, custom assembly, verifiable provenance and SBOMs, and more to help you ship secure software. [Next page]()