Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Keys stolen from TeamUpdraft were used to push backdoor plugins to WordPress sites. Update UpdraftPlus, delete its keys, then check admins and plugins.
GMO found malicious programs on Onamae Desktop Cloud on 20 Oct 2026; up to 26,739 servers may be affected. Rotate stored passwords from a clean device.
CISA and partners say SafePay ransomware hit at least 600 victims since August 2024 via stolen logins, VPNs and old edge flaws. What to check and fix now.
Malicious mbt 1.2.48 and @cap-js releases ran a credential stealer at install on 29 April 2026. Check lockfiles and CI logs, rotate secrets, harden CI.
Attackers used ConnectWise Cloud Backup app identities to reach Microsoft 365 tenants. The timeline, why MSP apps are a supply chain risk, Entra checks.
F5 said a nation-state actor stole BIG-IP source code and unpatched flaw data. What was taken, what F5 and CISA told customers to do, and what still holds.
Zeabur says an attacker read 3.2 million environment variable records, and it shuts down by 31 Dec. Rotate every secret, back up data and migrate now.
MCUs that trust one root likely escaped eMudhra. Devices with full Mozilla bundles, Linux gateways and frozen firmware still need checks and updates.
FoxIO found QPACK header amplification flaws in HTTP/3 stacks like quic-go, quiche and lsquic. See who is affected, fixed versions and how to check.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
