SBOM pioneer Allan Friedman joined the SecurityWeek Podcast to discuss why knowing what is inside software is only the beginning, how AI is complicating software supply chain visibility, and what organizations should be doing with SBOM data once they have it.

The post Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next appeared first on SecurityWeek.

Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials.

The post Over a Dozen Organizations Hit in Qubole Supply Chain Attack appeared first on SecurityWeek.

Using compromised credentials, the attackers accessed OpsShield’s update servers and poisoned multiple cPGuard versions.

The post Malicious cPGuard Updates Served in OpsShield Supply Chain Attack appeared first on SecurityWeek.

The extension performed host reconnaissance and attempted to create a reverse SSH tunnel.

The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.

The post Nobody Trusts the Security Questionnaire. We Rely on It Anyway. appeared first on SecurityWeek.

Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.

The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek.

Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework.

The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek.

Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.

The post Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek.

A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers.

The post $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant appeared first on SecurityWeek.

Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign.

The post Long-Running NPM Malware Campaign Accumulates 40,000 Downloads appeared first on SecurityWeek.