30
30
30
45
30
45
30
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
Unit 42 warns attackers increasingly target CI/CD pipelines and developer tools rather than application code, urging full SDLC supply chain visibility.
Palo Alto Networks Unit 42 research argues attackers are shifting focus from application code to overlooked corners of the software development lifecycle supply chain, including CI/CD pipelines and developer tooling. The write-up calls for total SDLC visibility and strict security controls to defend these developer-facing attack surfaces.
32
30
30
30
30
30
30
30
30
30
30
35
30
45
45
30
30
CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.
CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.
35
30
30
30
30
30
30
30
30
30
45
30
30
30
30
45