Safeguard on social

106 malicious npm and PyPI packages were published between 26 and 28 October 2026, per GitHub's advisory database. 96 on npm, 10 on PyPI. The post lists what they did, gives you a script to check your lockfiles, and shows how an install-time block in front of npm and pip, like Safeguard's Package Firewall, refuses the next batch before it runs. https://na2.hubs.ly/H08K-7q0

Is Safeguard SOC 2 compliant, are you FedRAMP authorized, and do you need an SBOM for SOC 2? Mira asks the compliance questions security and procurement teams ask in a vendor review, and Cal answers from Safeguard's published pages and docs: Safeguard is SOC 2 Type I and Type II audited, with reports available on request, the architecture is designed for FedRAMP High, what a readiness score is and is not, how to automate SOC 2 evidence without the screenshot sprint, and what to ask any security vendor for. For compliance leads, CISOs, security engineers and procurement reviewers working through SOC 2, FedRAMP, SBOM and vendor risk questions. Topics: SOC 2, SOC 2 Type I, SOC 2 Type II, FedRAMP High, SBOM, compliance automation, evidence collection, readiness score, vendor risk, Trust Center, CMMC, software supply chain security, security podcast, cybersecurity podcast, AppSec podcast, DevSecOps podcast. Chapters: 00:00 Cold open 00:24 Intro 00:43 Question 1: Is Safeguard itself SOC 2 compliant? 01:31 Question 2: Are you FedRAMP authorized? 02:15 Question 3: Do I need an SBOM for SOC 2? 03:17 Question 4: How do I automate SOC 2 evidence? 04:18 Question 5: Can I show a readiness score to an examiner? 05:09 Question 6: Does the security vendor I buy need its own SOC 2 report? 05:54 Recap and call to action 06:13 Outro Links: Safeguard: https://safeguard.sh/?utm_source=podcast&utm_medium=video&utm_campaign=ask-safeguard&utm_content=ep04 More episodes: https://safeguard.sh/podcast?utm_source=podcast&utm_medium=video&utm_campaign=ask-safeguard&utm_content=ep04 Listen on Spotify: https://open.spotify.com/show/03400iIvo19RZbfRDfPECc?utm_source=podcast&utm_medium=video&utm_campaign=ask-safeguard&utm_content=ep04

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on 23 October: an unauthenticated command injection in the Nextcloud "Collabora Online - Built-in CODE Server" app (richdocumentscode). Web shells have been seen since at least 10 September. Fixed in richdocumentscode 26.4.303, and 26.4.402 is the current release. Standalone Collabora Online servers are not affected. It is a PHP component inside a Nextcloud deployment. Is it in your SBOM? How the bug works and how to check a server: link in bio (http://safeguard.sh/blog). #nextcloud #cisakev #sbom #appsec #supplychainsecurity

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on 23 October: an unauthenticated command injection in the Nextcloud "Collabora Online - Built-in CODE Server" app (richdocumentscode). Attackers have used it to drop web shells since at least 10 September. Fixed in richdocumentscode 26.4.303; 26.4.402 is the current release. Standalone Collabora Online servers are not affected, only the built-in app. If you run Nextcloud, check the installed apps, update, then look for web shells. How the bug works and how to check a server: https://na2.hubs.ly/H08CFpC0

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on 23 October. It is an unauthenticated OS command injection in the richdocumentscode proxy of the Nextcloud "Collabora Online - Built-in CODE Server" app. One crafted request runs shell commands as the web server user, and attackers have used it to drop web shells since at least 10 September. Fixed in richdocumentscode 26.4.303 (26.4.402 is the current release). Standalone Collabora Online servers are not affected, only the built-in app. The question for platform and AppSec teams: is that app in your SBOM? It is a PHP component inside a Nextcloud deployment, so an SBOM that lists only the server will not show it. If your SBOMs include installed Nextcloud apps, this is a lookup (Safeguard's SBOM lookup shows where a component and version sits across your estate). If not, that is the gap to close today. Then update, and check for web shells, because exploitation started before most people knew there was a bug. Our write-up of how the bug works and how to check a server: https://lnkd.in/gb5qMAfc Source: CISA KEV entry for CVE-2026-110447 (added 23 Oct 2026). #Nextcloud #CISAKEV #SBOM #AppSec

Before you add a dependency, look it up. Gold Open Source is free and needs no login. A package page shows the version Gold indexed, the known vulnerability count, a verification panel and an OpenSSF Scorecard grade. Then check the version against your pull request, read the license and look at the install scripts yourself. Full routine: link in bio, http://safeguard.sh/resources/blog #OpenSource #AppSec #DevSecOps #SupplyChainSecurity

Before you add a dependency, look it up. A package page on https://lnkd.in/enhwZh3J is free and needs no login. It shows the version Gold indexed, the known vulnerability count for that version, a verification panel with a note on each row, and an OpenSSF Scorecard health grade with the checks behind it. Then check what a page can't tell you: - Is the indexed version the one in your pull request? - What does the license say, at the registry and in the repository? - What do the install scripts do? A zero count means nothing is publicly known about that release. It does not mean the code is clean. The full routine: https://lnkd.in/eDj8UzDB #OpenSource #AppSec #SoftwareSupplyChain

Before you add a dependency, look it up. Gold Open Source (https://na2.hubs.ly/H08CDG70) is free and needs no login: a package page shows the version Gold indexed, the known vulnerability count, a verification panel and an OpenSSF Scorecard grade. Then check the version against your pull request, read the license and look at the install scripts yourself. Full routine: https://na2.hubs.ly/H08CDH10 Stock footage: Mixkit (Mixkit Stock Video Free License). Page recordings: https://na2.hubs.ly/H08CDG70, public pages. #OpenSource #AppSec #Shorts

Before you add a dependency, look it up. Gold Open Source (https://na2.hubs.ly/H08CDG-0) is free and needs no login. A package page shows the version Gold indexed, the known vulnerability count, a verification panel and an OpenSSF Scorecard grade. Then check the version against your pull request, read the license, and look at the install scripts yourself. https://na2.hubs.ly/H08CDH00

Your board does not want 4,000 findings. It wants to know if the program is getting better or worse. A CISO needs one page to watch every week and one short pack to send every month. In Safeguard the page is the Program Overview dashboard, and two tiles carry the most weight: known exploited vulnerabilities (KEV) open in production, which the docs say should read zero, and time to remediate. Read time to remediate by severity and environment, next to the exceptions list, so a quiet backlog does not pass for a fast one. Scheduled reports do the delivery: a daily digest, a Monday executive summary and a monthly board pack, each as a PDF with charts plus a JSON payload. Exports respect role based access, time travel shows posture on the day of an incident, and metrics can flow to your own stack over OpenTelemetry. What to watch weekly versus what to show the board, plus a 30 day setup plan: https://lnkd.in/ecWQVa5S #CISO #AppSec #SupplyChainSecurity #BoardReporting

A CISO needs one page to watch every week and one short pack to send the board every month. In Safeguard that page is the Program Overview dashboard. The two tiles that matter most: KEV listed findings in production (the docs say it should read zero) and time to remediate. Scheduled reports send a daily digest, a Monday executive summary and a monthly board pack as PDF plus JSON. What to watch weekly and what to show the board: https://na2.hubs.ly/H08JgQ10

A CISO needs one page to watch every week and one short pack for the board every month. In Safeguard that page is the Program Overview dashboard. Two tiles carry the most weight: known exploited vulnerabilities open in production, which the docs say should read zero, and time to remediate. Scheduled reports send a daily digest, a Monday executive summary and a monthly board pack as PDF plus JSON. Link in bio: http://safeguard.sh/resources/blog #CISO #AppSec #SupplyChainSecurity #BoardReporting

Your coding agents already emit telemetry. Do you know what they did last night? OpenAI Codex and Claude Code can both export OpenTelemetry. Safeguard now receives it, so you can see what the agents actually did and work it as detections your SOC can act on. What lands in Safeguard: sessions, tool decisions and their results, model calls, tokens and cost, and sub-agent links. Detections show up in Detection & Response and in Security Operations events. Setup is short. In Integrations, open the OpenTelemetry (OTLP) card, issue an ingest token, and paste it into the [otel] block of ~/.codex/http://config.toml. Claude Code environment variables and any OpenTelemetry Collector work too. Counts start ticking up within a minute. The questions security teams ask first: - Does it keep our prompts? Not by default. If you turn content on, it is redacted and cut to 2,048 characters, and never searchable. - What about secrets? Credentials are redacted on arrival, always. - What can the token do? Send only. It cannot read anything back. - Do you need our OpenAI or Anthropic keys? No. It is OTLP over HTTP (http/protobuf or http/json), not gRPC. For the OpenAI API itself, connect your organization with an Admin key. Safeguard only sends read requests with it. New API keys, Owner grants, new service accounts, usage days well above baseline and bursts of failed sign-ins become detections too. OTLP setup guide: https://lnkd.in/gKtg8a2V OpenAI API connector: https://lnkd.in/gRsDMh8t #AISecurity #AppSec #DevSecOps

Your coding agents already emit telemetry. Send it to Safeguard. OpenAI Codex and Claude Code export OpenTelemetry. Safeguard shows sessions, tool decisions and results, model calls, tokens and cost, and raises AI detections in Detection & Response that your SOC can act on. The ingest token is send-only, prompt content is off by default, credentials are redacted on arrival. Setup guide: link in bio (http://docs.safeguard.sh/docs/integrations/otlp) #AISecurity #AppSec #DevSecOps #OpenTelemetry #ClaudeCode #Codex

Your coding agents already emit telemetry. OpenAI Codex and Claude Code export OpenTelemetry, and Safeguard receives it: sessions, tool decisions and results, model calls, tokens and cost, with AI detections in Detection & Response that your SOC can act on. The ingest token is send-only, prompt content is off by default and credentials are redacted on arrival. OTLP setup guide: https://na2.hubs.ly/H08FpBx0 OpenAI API connector (new API keys, Owner grants, new service accounts, usage well above baseline and failed sign-in bursts become detections): https://na2.hubs.ly/H08Fpz-0 #AISecurity #OpenTelemetry #Shorts

Revocation alone does not fix a CA compromise. A stolen CA key can sign its own "good" answers, so the plan is to replace certificates and remove trust, not just revoke. Apps that ship their own CA bundle or pin a key ignore operating system trust store changes. Safeguard's SBOMs help you find them. Inventory, revoke, reissue runbook: https://na2.hubs.ly/H08J5c30

Your coding agents already emit telemetry. Send it to Safeguard and see what they actually did, as detections your SOC can act on. OpenAI Codex and Claude Code export OpenTelemetry. Safeguard turns it into sessions, tool decisions and results, model calls, tokens and cost, and AI detections in Detection & Response. The ingest token is send-only, prompt content is off by default and credentials are redacted on arrival. Setup guide: https://na2.hubs.ly/H08FpzX0

Revocation alone does not fix a CA compromise. A CA key can sign its own CRLs and OCSP responses, so an attacker holding it can make a bad certificate look good. An intermediate has to be revoked by its parent. A root has no parent, so the only real response is to remove it from every trust store. The runbook order that follows: contain the key and stop issuance, inventory by issuer and Authority Key Identifier (not just hostname), reissue under a new key, remove the old CA from trust stores, then prove with scans that nothing still chains to it. Software that ships its own CA bundle or pins a key will not pick up an operating system trust store change. Safeguard builds SBOMs of your repositories and images, so you can find those bundled CA packages and pinning libraries in each application. The full runbook: https://lnkd.in/gZ4R5u2A

Your coding agents already emit telemetry. Send OpenAI Codex or Claude Code OpenTelemetry to Safeguard and see sessions, tool decisions, model calls and cost, plus AI detections your SOC can act on. Send-only token, credentials redacted. https://t.co/FkOFlO6ur6 https://t.co/O7U2fSmu93