# supply-chain-security Published articles for supply-chain-security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## SymfonyCon Warsaw 2026: The Attack Reached PHP: Composer and Packagist, One Year On DevFeed: [SymfonyCon Warsaw 2026: The Attack Reached PHP: Composer and Packagist, One Year On]() Original publisher: [Read original article]() Author: Eloïse Charrier Published: 2026-09-16T12:30:00Z Content type: article Language: en Sources: [Symfony Blog]() Topics: [Symfony](), [Composer](), [PHP](), [supply-chain-security](), [Security]() Tags: [2026](), [composer](), [conference](), [github](), [php](), [supply-chain-security](), [symfony]() ### AI overview SymfonyCon Warsaw 2026 will take place in Poland on November 26-27, with talks across three parallel tracks and related community events. The announcement highlights a talk about PHP supply-chain security changes made after attacks involving Composer and Packagist, including malware detection, transparency logging, dependency policies, immutable releases, release-age settings, maintainer MFA status, and ownership controls. ### Source excerpt Get ready to connect with the global Symfony community! SymfonyCon Warsaw 2026 is landing in Poland, on November 26-27. We are bringing you two days of inspiring talks across 3 parallel tracks, alongside plenty of networking opportunities and vibrant... ## The AI Hurricane Is Here DevFeed: [The AI Hurricane Is Here]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-09-15T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Artificial Intelligence](), [AI Development](), [Security](), [Vulnerabilities](), [Architecture & Design](), [audit trail]() Tags: [agentic-development](), [agents](), [ai](), [application-security](), [audit-trail](), [awareness](), [blog](), [code-security](), [developer](), [executive](), [security](), [security-labs](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [tech](), [validation](), [vulnerabilities](), [vulnerability-insights]() ### AI overview The article argues that AI is accelerating software creation and cyberattacks, widening the gap between machine-speed development and slower validation. It calls for securing agentic development, enforcing runtime controls, maintaining inventories and audit trails for production AI applications, and using independent validation. ### Source excerpt AI is accelerating software creation and cyberattacks alike. Leaders must secure agents and code at inception, enforce controls at runtime, and validate defenses independently. ## Prepare for the Cyber Resilience Act's 24-hour reporting deadline DevFeed: [Prepare for the Cyber Resilience Act's 24-hour reporting deadline]() Original publisher: [Read original article]() Author: Amit Shalem Published: 2026-09-10T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [Vulnerabilities](), [open-source-security](), [Incident response]() Tags: [compliance](), [cybersecurity](), [europe](), [features](), [sbom](), [security](), [supply-chain](), [supply-chain-security](), [vulnerabilities]() ### AI overview The article explains the Cyber Resilience Act requirement for manufacturers to report actively exploited product vulnerabilities within 24 hours of becoming aware of them. It presents continuous software supply-chain detection, dependency scanning, SBOM monitoring, KEV status, EPSS scores, and container scanning as ways GitLab can help organizations identify and prioritize reportable risks. ### Source excerpt Starting on September 11, 2026, many businesses that place software on the European Union (EU) market will have 24 hours to file a report once they learn that a vulnerability in one of their products is being actively exploited. This is a new requirement under the Cyber Resilience Act (CRA), the EU law that sets cybersecurity requirements for products with digital elements sold in Europe, put in place to ensure those products are secure by design and supported against new threats. The most stringent requirements under the CRA apply to the manufacturers that make those products, from large software vendors to companies shipping connected hardware. The challenge a business faces to stay compliant is not the filing itself. It is finding out fast enough that a vulnerability in something you shipped is being actively exploited in your software supply chain. The 24-hour clock starts the moment you become aware, this is why detection is so important. Continuous detection is an engineering solution rather than a one-off compliance one. GitLab's software supply chain security capabilities are built to help you find active exploitation in what you shipped, automatically and continuously. This article walks through four questions you should ask yourself about your own pipeline's continuous detection solution today. Reporting requirement starts in September 2026 Beginning September 11, 2026, manufacturers have to report an actively exploited vulnerability within 24 hours of becoming aware of it. The reporting runs in three stages each submitted simultaneously to the European Union Agency for Cybersecurity (ENISA) and to the Computer Security Incident Response Team (CSIRT) designated as coordinator. Early warning, within 24 hours of becoming aware of the actively exploited vulnerability. A short first alert that exploitation is happening. You are not expected to know the full scope of impact or the fix yet. Notification, within 72 hours. A fuller account, covering what is affect ## How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act DevFeed: [How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act]() Original publisher: [Read original article]() Author: andrewb@proximabiz.com (The Linux Foundation) Published: 2026-09-09T19:11:24Z Content type: article Language: en Sources: [Linux Foundation - Blog]() Topics: [cyber resilience act](), [Security](), [Vulnerabilities](), [open-source-security](), [supply-chain-security]() Tags: [2026](), [cyber-resilience-act](), [eu](), [linux-foundation](), [open-source](), [openssf](), [regulatory](), [security](), [supply-chain-security](), [vulnerabilities]() ### AI overview This Linux Foundation post explains how Open Source Program Offices can help organizations prepare for the EU Cyber Resilience Act, including identifying affected products and dependencies, coordinating legal, security, engineering and procurement teams, and responding to vulnerability and incident reporting obligations. ### Source excerpt For organizations offering products with digital elements in the EU, the next major Cyber Resilience Act (CRA) deadline arrives on 11 September 2026. From that date, organizations covered by the reporting obligations must be ready to assess actively exploited vulnerabilities and severe security incidents, coordinate an internal response and submit notifications within the required timelines. ## Security Hub Extended adds Supply Chain Security as its tenth category DevFeed: [Security Hub Extended adds Supply Chain Security as its tenth category]() Original publisher: [Read original article]() Author: Michael Fuller Published: 2026-08-18T17:04:28Z Content type: news Language: en Sources: [AWS Security Blog]() Topics: [supply-chain-security](), [Security](), [Amazon Web Services]() Tags: [amazon-web-services-aws](), [announcements](), [aws](), [aws-security-hub](), [black-hat](), [engineering](), [enterprise](), [foundational-100](), [leadership](), [open-source](), [partners](), [payment](), [pricing](), [security](), [security-blog](), [security-identity-compliance](), [software](), [streaming](), [supply-chain](), [supply-chain-security](), [uncategorized](), [vulnerability]() ### AI overview AWS Security Hub Extended adds Supply Chain Security as its tenth category, with Chainguard and Socket as curated partners. The article frames software supply-chain risk as an enterprise security concern and describes pay-as-you-go and private-offer procurement options. ### Source excerpt Since February, we've grown AWS Security Hub Extended from 14 curated partners across 9 categories to 23 partners across 10. At Black Hat this month, 14 of those partners were at the Amazon Web Services (AWS) booth demoing live. Four of those partners delivered theater talks and ten were featured on SecurityLive streaming. We hosted [...] ## Solving Gradle metadata and Renovate integration DevFeed: [Solving Gradle metadata and Renovate integration]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-16T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Gradle](), [renovate](), [Kotlin](), [Groovy]() Tags: [ci](), [dependencies](), [dependency](), [development](), [gradle](), [renovate](), [software-supply-chain](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview The article describes setting up Renovate for a Gradle project and investigating why merges of updated dependency versions caused build failures. It also discusses dependency verification and software supply chain risks. ### Source excerpt My current company has settled on using Gradle. It doesn't make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc. This week, I worked on improvements to a new project and set up Renovate. ## What Is a Container Registry and How to Use One DevFeed: [What Is a Container Registry and How to Use One]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-08-10T17:48:35Z Content type: tutorial Language: en Sources: [Kubernetes - KodeKloud Blog | DevOps, Cloud, Kubernetes, AI Tutorials & More]() Topics: [container images](), [content addressed store](), [Docker Hub](), [Dockerfile](), [supply-chain-security]() Tags: [base-images](), [cache](), [ci-cd](), [cloud](), [container-images](), [container-registry](), [containers](), [content-addressed-store](), [cryptographic](), [devops](), [docker](), [docker-hub](), [docker-login](), [docker-pull-rate-limits](), [docker-registry](), [harbor](), [image-manifest](), [image-retention-policy](), [image-scanning](), [image-tags-vs-digests](), [kubernetes](), [private-registry](), [pull-through-cache](), [reproducible-builds](), [security](), [supply-chain-security]() ### AI overview This guide explains how container registries store and distribute container images, emphasizing the distinction between mutable tags and immutable content digests. It also covers pushing, pulling, authentication, Docker Hub rate limits, caching, scanning, and retention. ### Source excerpt A tag is a bookmark somebody else can move. A digest is the image itself. Once that distinction lands, reproducible builds, supply chain security, and every it worked yesterday mystery make sense. ## A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense DevFeed: [A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-08-04T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [agent](), [agentic](), [ai](), [ai-agents](), [ai-security](), [application-security](), [aspm](), [autonomous](), [blog](), [cli](), [code-security](), [developer](), [devops](), [interest](), [javascript](), [node-js](), [open-source-security](), [pull-request](), [python](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-insights]() ### AI overview Snyk introduces Evo Agentic AppSec capabilities for automatically remediating vulnerabilities and blocking malicious packages before they reach code. The Remediation Agent triages issues, creates and checks fixes, and opens pull requests for review. ### Source excerpt Explore Snyk's first Agentic AppSec capabilities: an autonomous Remediation Agent that fixes vulnerabilities and Malicious Code Defense that blocks risky packages before they ship. ## Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks DevFeed: [Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks]() Original publisher: [Read original article]() Author: Liran Tal; Lion Kontorer Published: 2026-08-04T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [releases]() Tags: [awareness](), [blog](), [ci](), [ci-cd](), [code](), [developer](), [devops](), [embedded](), [enablement](), [ide](), [incident](), [javascript](), [malware](), [manifest](), [node-js](), [npm-packages](), [open-source-security](), [payload](), [persistence](), [releases](), [research](), [scm](), [secrets](), [security](), [security-labs](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [software](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Snyk reports an active supply-chain incident in which keyv 6.0.0 and ten related npm releases contained install-time malware. The article describes the malicious preinstall hook, its second-stage payload, affected-release investigation, and remediation guidance. ### Source excerpt keyv 6.0.0 and ten related npm releases shipped install-time malware. See affected versions, hashes, detection steps, and safe remediation order. ## Why AI-assisted attacks made software supply chain security its own category DevFeed: [Why AI-assisted attacks made software supply chain security its own category]() Original publisher: [Read original article]() Published: 2026-08-03T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Security](), [Artificial Intelligence](), [Open Source](), [Agent Skills](), [Application Security](), [CI/CD]() Tags: [agent-skills](), [ai](), [ai-assisted-attacks](), [ci-cd](), [containers](), [open-source](), [secure-by-default](), [security](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain-security]() ### AI overview The article argues that AI has changed the economics and speed of software supply chain attacks, making software supply chain security a distinct category requiring dedicated tooling, budgets, and strategy. It describes how AI benefits defenders and attackers, while agents accelerate dependency adoption and introduce risks through artifacts such as agent skills. ### Source excerpt Software supply chain security is now its own category. Discover why AI is driving a shift toward trusted, secure-by-default open source. ## Introducing Deputy: Better signal and control for software supply chains DevFeed: [Introducing Deputy: Better signal and control for software supply chains]() Original publisher: [Read original article]() Author: Kent Gruber Published: 2026-08-03T00:00:00Z Content type: release Language: en Sources: [Temporal Blog]() Topics: [supply-chain-security](), [Application Security](), [Command-line interface](), [Open Source]() Tags: [application-security](), [cli](), [open-source](), [software](), [supply-chain](), [supply-chain-security](), [temporal-voices]() ### AI overview Temporal introduces Deputy, an open-source, CLI-first security toolchain for inventorying, scanning, triaging, and controlling dependencies across repositories, container images, VM disk images, SBOMs, and other targets. It provides a customizable policy layer for local use, CI, and download-time controls. ### Source excerpt Meet Deputy, Temporal's open-source, CLI-first toolchain for inventorying, scanning, triaging, and controlling dependencies across your supply chain. ## Secure at Inception: Announcing the Snyk Studio Integration for Snowflake Cortex Code DevFeed: [Secure at Inception: Announcing the Snyk Studio Integration for Snowflake Cortex Code]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-07-30T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [ai](), [ai-agent](), [application-security](), [article](), [cloud-security](), [code](), [code-security](), [containers](), [developer](), [devops](), [devsecops](), [enablement](), [finserv](), [health-care](), [integration](), [python](), [security](), [snyk-code](), [snyk-container](), [snyk-open-source](), [snyk-platform](), [supply-chain-security](), [vulnerabilities]() ### AI overview Snyk Studio is integrated with Snowflake Cortex Code to scan AI-generated application code, dependencies, and container images for vulnerabilities during development. ### Source excerpt Snyk Studio integrates with Snowflake Cortex Code to scan AI-generated code, dependencies, and containers for vulnerabilities during development. ## The Attacker Never Sleeps, Neither Can Your Testing DevFeed: [The Attacker Never Sleeps, Neither Can Your Testing]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-07-30T00:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI-assisted coding](), [Developer Tools]() Tags: [agents](), [ai](), [application-security](), [awareness](), [blog](), [code](), [code-security](), [devops](), [devsecops](), [executive](), [finserv](), [interest](), [open-source-security](), [security](), [snyk-apprisk](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [software](), [supply-chain-security](), [tech](), [testing](), [vulnerability-insights]() ### AI overview AI-driven code generation is expanding software attack surfaces while giving attackers machine-speed reasoning capabilities. The article argues that security teams need continuous testing, agent governance, and independent validation of findings. ### Source excerpt AI is accelerating software development and giving attackers machine-speed capabilities. Security teams must continuously test AI-built code, govern agents, and independently validate every finding. ## Tame Dependabot: Group your updates, slow the cadence, keep security fast DevFeed: [Tame Dependabot: Group your updates, slow the cadence, keep security fast]() Original publisher: [Read original article]() Author: Bruno Borges Published: 2026-07-29T16:00:00Z Content type: tutorial Language: en Sources: [GitHub]() Topics: [GitHub](), [pull-requests](), [configuration](), [Open Source]() Tags: [batch](), [build](), [ci](), [configuration](), [dependabot](), [dependencies](), [dependency](), [ecosystem](), [engineering](), [github](), [github-actions](), [logs](), [maintenance](), [open-source](), [pull-request](), [pull-requests](), [review](), [security](), [supply-chain-security]() ### AI overview This tutorial explains how to reduce Dependabot pull request noise by grouping dependency updates into a monthly batch while keeping security updates fast. It uses Microsoft's open source GCToolkit project as an example and describes the relevant configuration changes. ### Source excerpt Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog. ## How to protect an npm package from supply chain attacks DevFeed: [How to protect an npm package from supply chain attacks]() Original publisher: [Read original article]() Author: Travis Turner (richardturner@evilmartians.com) Published: 2026-07-28T00:00:00Z Content type: tutorial Language: en Sources: [Evil Martians]() Topics: [npm](), [supply-chain-security](), [Security](), [ci](), [GitHub](), [Open Source]() Tags: [2026](), [ci](), [developer-community](), [dx](), [github](), [how-to](), [javascript](), [monorepo](), [npm](), [npm-packages](), [open-source](), [performance-scale](), [security](), [supply-chain](), [supply-chain-security]() ### AI overview This tutorial explains how to protect npm packages from supply chain attacks. It covers Trusted Publishers, publishing restrictions, organization-wide 2FA, GitHub tag controls, pinned CI actions, CI security linting, cooldowns for new versions, and staged-release approval. ### Source excerpt How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings ## Best GitHub Actions Alternatives in 2026 DevFeed: [Best GitHub Actions Alternatives in 2026]() Original publisher: [Read original article]() Author: Pete Miloravac Published: 2026-07-23T12:51:23Z Content type: article Language: en Sources: [Semaphore Engineering]() Topics: [GitHub Actions](), [CI/CD](), [supply-chain-security](), [Vulnerabilities](), [Security]() Tags: [2026](), [alternatives](), [ci-cd](), [compare](), [github](), [github-actions](), [guide](), [outage](), [security](), [supply-chain-security](), [vulnerabilities]() ### AI overview A 2026 guide compares alternatives to GitHub Actions and discusses why some teams are reconsidering it, citing a major outage, a supply-chain attack affecting thousands of repositories, pricing and runner-management concerns, and log usability issues. ### Source excerpt GitHub Actions became the default CI/CD choice for millions of repositories simply because it's built into GitHub. But "default" and "best" are not the same thing -- and in 2026, the gap between the two has gotten harder to ignore. A ten-hour outage in July, a supply-chain attack that backdoored over 5,500 repositories in May, [...] The post Best GitHub Actions Alternatives in 2026 appeared first on Semaphore. ## Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL DevFeed: [Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL]() Original publisher: [Read original article]() Author: Koray Oksay Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Kubernetes](), [Platform Engineering](), [Security](), [developer velocity](), [Containers](), [supply-chain-security](), [YAML](), [opa](), [rego]() Tags: [common-expression-language](), [compliance](), [container-images](), [containers](), [cosign](), [deployment](), [developer-velocity](), [governance](), [hipaa](), [integration](), [kubernetes](), [kyverno](), [pci-dss](), [platform](), [policy](), [security](), [security-policies](), [sigstore](), [soc-2](), [supply-chain-security]() ### AI overview A guide to using Kyverno and its Common Expression Language support for Kubernetes governance. It explains how platform engineering teams can enforce policies, automate resource changes, generate resources, verify image signatures, and maintain security and compliance while preserving developer velocity. ### Source excerpt Kyverno with CEL support provides Policy-as-Code for Kubernetes governance. Enforce security, automate guardrails, and boost developer velocity for platform engineering teams. ## Securing the Agent DLC: A Practical Guide DevFeed: [Securing the Agent DLC: A Practical Guide]() Original publisher: [Read original article]() Author: Rahul Sood Published: 2026-07-21T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Development](), [Artificial Intelligence](), [supply-chain-security](), [Testing](), [observability](), [Firewall](), [Model Context Protocol]() Tags: [ai](), [ai-agents](), [firewall](), [mcp](), [observability](), [supply-chain-security](), [testing]() ### AI overview Harness presents an Agent Development Lifecycle security approach for AI agents, covering design-time scanning, AI bills of materials, testing, discovery, firewall controls, and runtime observability. The article argues that agents require security practices adapted to their dynamic tool, model, and API connections. ### Source excerpt Harness secures AI agents from development to runtime with AIBOM, AI testing, discovery, firewall, and observability across the Agent DLC. | Blog ## NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence DevFeed: [NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence]() Original publisher: [Read original article]() Author: Michelle Ginzburg; Noa Yaffe-Ermoza Published: 2026-06-25T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [open-source-security](), [Security](), [data]() Tags: [ai](), [article](), [awareness](), [developer](), [devops](), [interest](), [open-source](), [open-source-security](), [security](), [snyk-open-source](), [snyk-security-intel](), [software](), [supply-chain-security](), [technology](), [vulnerability](), [vulnerability-insights]() ### AI overview The article explains why vulnerability intelligence is moving beyond reliance on the National Vulnerability Database. It describes NIST's shift toward prioritized triage and presents Snyk's multi-source approach, combining vulnerability advisories, analyst validation, internal enrichment, open-source context, and multiple risk assessments to help teams prioritize remediation. ### Source excerpt NIST's shift to risk-based enrichment makes one thing clear: modern security teams need more than a single public source. In the AI era, trusted vulnerability intelligence depends on multiple signals, human validation, and clear context. ## What nearly 10,000 developer environments reveal about agentic development risk DevFeed: [What nearly 10,000 developer environments reveal about agentic development risk]() Original publisher: [Read original article]() Author: Ricardo Miguel Silva Published: 2026-06-23T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI-assisted coding](), [supply-chain-security](), [Application Security](), [Model Context Protocol](), [Agent Skills](), [prompt injection](), [Security](), [software-development](), [Tooling]() Tags: [agentic](), [agents](), [ai](), [ai-coding](), [application-security](), [article](), [awareness](), [claude](), [code](), [cursor](), [developer](), [developers](), [development](), [devops](), [devsecops](), [enablement](), [interest](), [prompt-injection](), [secrets](), [security](), [security-labs](), [skills](), [snyk-code](), [snyk-platform](), [snyk-security-intel](), [software-development](), [supply-chain](), [supply-chain-security](), [systems](), [tool](), [tooling](), [tools](), [vs-code]() ### AI overview Snyk analyzed nearly 10,000 developer environments and found that agentic development is introducing a new software supply chain layer. The article reports widespread use of multiple AI coding environments, MCP servers, and agent skills, along with confirmed prompt injection findings and security exposure that AppSec teams need to govern. ### Source excerpt AI coding agents are adding a new layer to the software supply chain. Learn what Snyk found in nearly 10,000 developer environments and how to secure the tools, instructions, and permissions behind agentic development. ## Announcing Agentic Development Security (ADS) DevFeed: [Announcing Agentic Development Security (ADS)]() Original publisher: [Read original article]() Author: Daniel Berman Published: 2026-06-23T04:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Securing AI](), [Application Security](), [AI Agent](), [AI Development](), [Model Context Protocol (MCP)](), [MCP Server](), [ai-coding]() Tags: [agentic](), [ai](), [ai-agent](), [ai-coding](), [application-security](), [awareness](), [blog](), [developer](), [devops](), [enablement](), [executive](), [interest](), [mcp](), [mcp-server](), [securing-ai](), [security](), [snyk-platform](), [software-development](), [supply-chain-security](), [tech]() ### AI overview Snyk announces Agentic Development Security (ADS), an Evo solution for securing AI-driven software development. It embeds visibility, governance, and control into workflows where AI agents use tools, execute actions across systems, and generate production-ready code. ### Source excerpt Announcing Snyk Agentic Development Security, a new Evo solution that helps organizations securely adopt AI-driven development with visibility, governance, and control. ## When a vendor's breach becomes yours: lessons from the Klue incident DevFeed: [When a vendor's breach becomes yours: lessons from the Klue incident]() Original publisher: [Read original article]() Author: Anthony Larkin Published: 2026-06-23T03:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [Software as a service](), [Security](), [OAuth](), [data](), [Back end]() Tags: [backend](), [blog](), [breach](), [crm](), [customer](), [data](), [executive](), [incident](), [oauth](), [pmm](), [saas](), [salesforce](), [secrets](), [security](), [supply-chain-security](), [tech](), [tokens](), [vulnerability-insights]() ### AI overview The article examines how a forgotten Klue credential enabled attackers to compromise the vendor's backend, harvest OAuth tokens, access connected customer Salesforce environments, and exfiltrate CRM data. It presents the incident as an example of how a SaaS breach can cascade across downstream customers. ### Source excerpt A forgotten credential at vendor Klue let attackers reach customers' Salesforce data. How modern SaaS breaches cascade, and the keys you should audit. ## The full Snyk AI Security Platform, free for open source maintainers DevFeed: [The full Snyk AI Security Platform, free for open source maintainers]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-06-18T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Maintainers](), [Open Source](), [Security](), [vulnerability](), [open-source-security](), [Artificial Intelligence](), [Frontier Model](), [Remote Access Trojan](), [AI Infrastructure]() Tags: [agent](), [ai](), [ai-infrastructure](), [ai-security](), [article](), [awareness](), [bugs](), [developer](), [enablement](), [engineering](), [frontier-model](), [interest](), [maintainers](), [open-source](), [open-source-security](), [remote-access-trojan](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-team](), [software](), [supply-chain-security](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk's Secure Developer Program gives qualifying open source projects free access to the Snyk AI Security Platform. It is designed to help maintainers prioritize real vulnerability reports and produce validated, merge-ready fixes through the Snyk Remediation Agent. ### Source excerpt Open source maintainers are drowning in real vulnerability reports and need help prioritizing, fixing, and shipping remediation faster. Snyk's Secure Developer Program gives qualifying projects free access to the Snyk AI Security Platform. ## A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope DevFeed: [A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope]() Original publisher: [Read original article]() Author: Liran Tal; Marian Corneci Published: 2026-06-16T21:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [awareness](), [blog](), [ci-cd](), [cross-platform](), [cryptocurrency](), [developer](), [devops](), [devrel](), [devsecops](), [incident](), [javascript](), [node-js](), [open-source-security](), [payload](), [persistence](), [remote-access-trojan](), [sbom](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [tls](), [vulnerability-insights]() ### AI overview A dormant former-contributor npm account was compromised and used to republish the Mastra package scope with a malicious dependency that installs cryptocurrency-stealing malware and a persistent remote-access trojan. The article describes the stale access control that enabled the supply-chain incident and advises treating affected installations as credential and wallet exposure events. ### Source excerpt A dormant contributor account was used to republish the entire @mastra npm scope, each injected with a single dependency, easy-day-js, that drops a cross-platform cryptocurrency stealer. Here is how the attack worked, how to check exposure, and how to remediate. [Next page]()