Friedman says SBOMs matter for response, not static inventories
He argues accurate supplier SBOMs speed Log4j-style response, while VEX separates vulnerable components from exploitable ones.
Stories per day · 30 days
2 RSS
Relatedsbom2vex2ai-bom1attestations1code-security1cyclonedx1devsecops1owasp1php1pypi1python1secrets1slsa1spdx1syft1trusted-publishing1vibe-coding1vulnerability-management1
18 stories, newest first · one card per story
Stories tagged #software-supply-chain
PyPI project pages now show provenance and security warnings
The security tab shows per-file attestations and flags incomplete, inconsistent, changed, or lost provenance before install.
Datadog primer explains code security for new and vibe coders
The post contrasts first-party fixes with third-party upgrades and warns agents often pull outdated dependencies.
12 Best SBOM Tools Compared (2026): Features & Pricing
A 2026 roundup ranks 12 SBOM tools, naming Anchore Syft the best free generator and FOSSA and Cybeats top managers.
6
Insignary Launches Clarity AIR to Detect Undeclared Open-Source and AI-Written Code
Insignary released Clarity AIR to find undeclared open-source snippets and AI-written code missing from SBOMs.
2
Git 3.0's upcoming SHA-256 default will be a costly mistake
A GitButler post argues Git 3.0's SHA-1 to SHA-256 default will be costly with little security gain.
How Financial Services Companies Can Modernize Their Software Supply Chain
Chainguard argues banks should harden images and libraries instead of full application rewrites.
1
Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains
Researchers propose a blockchain-anchored agentic AI framework that attests SDLC security checks before release.
Fifty Years of Open Source Software Supply Chain Security
An ACM Queue essay surveys fifty years of open source software supply chain security.
Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems
Researchers link a May campaign that uploaded 2,000+ malicious RubyGems packages to OpenAI agents, which OpenAI calls benign training activity.
Measuring the Security of the Evolving Software Supply Chain: a Research Agenda
Researchers propose a unified cross-ecosystem measurement agenda for software supply chain security, targeting dependency modeling and AI-generated dependency patterns.
VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities
Introduces VEX-Bench, 75 expert-labeled real-world cases testing whether LLM agents can assess supply chain vulnerability exploitability; frontier models reach about 80% F1.
Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain
Pre-registered audit finds AI coding assistants verified provenance signals in only 9 of 1,920 trials before installing research software packages.
Propagation Model for SSC attacks: Why SBOM (tools) don't tell the whole truth
Study shows open-source SBOM tools only cover structural exposure and vulnerability presence, missing code reachability and taint-path analysis stages.
Most of the bugs Claude Mythos found have never been checked by a human
Echo's analysis found only 1,900 of 23,019 Claude Mythos-found vulnerabilities were externally reviewed, 90.8% held up, but the model overstated most severities.
The Regulators Already Assume You Have an AI Inventory. Do You?
Checkmarx argues regulators now expect organizations to maintain an AI inventory as AI-generated code and outputs enter security workflows.
Enterprise Applications Carry 4.31x More Critical and High Vulnerabilities
Sonatype reports enterprise applications contain 4.31x more critical and high-severity vulnerabilities as accelerated software creation drives rising vulnerability levels.
Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain
Wiz highlights personal developer repositories as a supply chain blind spot leaking corporate secrets, offering correlation-based risk validation and remediation.