Vulnerability Analysis
ws WebSocket library header DoS (CVE-2021-32640)
CVE-2021-32640 lets attackers stall Node.js WebSocket servers via a crafted header in the widely-used ws npm package. Here's the fix.
Jan 5, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedNetwork Security
BGP Hijacking and Software Distribution Security
BGP hijacking lets attackers reroute internet traffic at the network level, silently intercepting software downloads and updates. This is one of the most powerful yet overlooked supply chain attack vectors.
Jan 5, 20267 min read
Software Supply Chain Security
Software supply chain security for core banking systems
How core banking system supply chain security failures happen, what they cost, and how SBOMs and vendor risk monitoring keep core banking platforms safe.
Jan 5, 20267 min read
Data Breach
Panasonic Data Breach: Four Months of Undetected Network Access
Panasonic disclosed a data breach in November 2021, revealing that attackers had maintained access to its network for over four months before detection — highlighting the persistent challenge of dwell time.
Jan 5, 20265 min read
Vulnerability Analysis
protobufjs prototype pollution (CVE-2022-25878)
CVE-2022-25878 is a critical prototype pollution flaw in protobufjs. Here's what's affected, the CVSS/EPSS context, and how to remediate it fast.
Jan 5, 20268 min read
Zero-Day Exploits
Zoho ManageEngine CVE-2021-44077: When IT Management Tools Get Owned
APT actors exploited CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus to breach critical infrastructure. An unauthenticated RCE in the software that manages your IT.
Jan 5, 20266 min read
SBOM & Compliance
SBOM requirements for financial services under DORA
DORA now requires EU financial entities to track every software component down to the dependency level. Here's what the SBOM requirements actually mean.
Jan 5, 20267 min read
Open Source
Open Source Risk Management: Beyond Vulnerability Scanning
Vulnerability scanning catches known CVEs. But open source risk goes deeper — license compliance, maintainer health, dependency freshness, and supply chain attacks.
Jan 5, 20263 min read
Vulnerability Analysis
Apache Struts CVE-2024-53677: The Path Traversal RCE
CVE-2024-53677 lets attackers abuse Struts file upload parameter pollution to plant webshells. Here is the chain, detection logic, and patch guidance.
Jan 5, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.