Supply Chain Security
In-depth guides and analysis on supply chain security from the Safeguard engineering team.
100 articles
Linux Kernel CVE-2026-46300 Is on KEV: the ESP Flaw Chained With PHP to Get Root, and What to Patch
Linux kernel CVE-2026-46300 (Fragnesia), an IPsec ESP shared-fragment flaw disclosed in May 2026, was newly added to CISA KEV on 28 October 2026 with a 31 October due date and says it can be chained with PHP CVE-2026-109618 and CVE-2026-109619 to run commands as root. Fixed kernel versions per distro, how to check exposure, mitigations and forensic triage.
CA Compromise Response: Inventory, Revoke, Reissue Runbook
A certificate authority compromise response runbook for PKI owners and security operations leads: what to do in the first hour, the first 24 hours and the first week after a CA compromise, covering certificate inventory, revocation with CRLs and OCSP, trust store removal, reissuance and verification, grounded in RFC 5280, RFC 6960, the CA/Browser Forum Baseline Requirements and NIST SP 1800-16.
Adobe Commerce and Magento CVE-2026-48356 Is on KEV: What to Patch and Check
CISA added Adobe Commerce and Magento CVE-2026-48356, an unrestricted file upload flaw, to KEV on 27 October 2026. Here is what is affected, what to patch and what to check.
Lagoon CVE-2026-113788: Authenticated RCE in the SSH Service
CVE-2026-113788 lets any Lagoon user run code through the core ssh service. Every version before 2.33.2 is affected. Here is what to patch and check.
Envoy Proxy Release History: Lyft to CNCF, xDS v3 and Support Windows
Envoy ships a major release every quarter and patches each one for 12 months. Its Lyft origins, CNCF dates, xDS v2 to v3 and how security fixes ship.
How a 5G Base Station Is Made: Radios, Baseband, Fronthaul and Timing
A 5G base station is antennas, radio units, baseband split into CU and DU, eCPRI fronthaul, microsecond timing and a big software stack. How it is built.
IANA Time Zone Database Explained: How DST Rules Reach Your Code
The IANA tz database turns government clock changes into tzdata releases that ship through OS, runtime and app updates. How it works and how to check yours.
How a Firewall Appliance Is Made: Fast Path, Hardened OS, Signed Firmware
A firewall appliance pairs a general CPU with fast path silicon, a hardened Linux or BSD build, signed images and a management plane kept off the internet.
How a Webcam Is Made: Sensors, UVC Controllers, Firmware and LEDs
A webcam is a lens, a CMOS sensor and a firmware driven bridge chip, plus an LED and maybe a shutter. How it is built, talks to the OS and stays private.
I2P Explained: Garlic Routing, Tunnels, netDb and How It Differs From Tor
I2P sends traffic through one-way tunnels, bundles messages as garlic and finds peers in a floodfill netDb. How it works and how it differs from Tor.
WirelessHART and ISA100.11a Explained: Mesh, Join Keys and Security
WirelessHART (IEC 62591) and ISA100.11a (IEC 62734) are industrial 802.15.4 meshes. How managers, join keys and AES-128 work, and why gateways are weak.
Bluetooth Mesh Explained: Flooding, Provisioning, Keys and Mesh 1.1
Bluetooth Mesh relays messages by managed flooding over BLE advertising. How provisioning, network and app keys, friend nodes and Mesh 1.1 work.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.