Safeguard on social

OpenSSL 3.4 lost upstream support on 22 October. OpenSSL 3.6 follows this Sunday, 1 November. After that the project maintains three lines: 3.5 LTS (to April 2030), 4.0 (to May 2027) and 4.1, released on 23 October (to November 2027). Most servers that take their distribution's updates will not notice. Ubuntu, for example, patches its own build of 3.0 and that follows Ubuntu's support. The risk is the copies nobody counted: base images that were never rebuilt, language runtimes, vendored builds. On one Mac with Homebrew OpenSSL 4 first on the PATH, the openssl command said 4.0.3 while Node reported 3.6.4. Same machine, two versions. Before 1 November: 1. List every copy of OpenSSL and its version. 2. Move what you build, bundle or install yourself to a supported line. 3.5.9 is the conservative target. An SBOM lookup covers step 1: search the SBOMs you already hold for a component and version, and see every project and image that carries it. The full guide, with a checker script for each runtime: https://lnkd.in/ep3Fazns #OpenSSL #AppSec #SBOM

OpenSSL 3.4 lost upstream support on 22 October. 3.6 follows this Sunday, 1 November. Most servers on a distribution will be fine. The risk is the copies nobody counted: base images, language runtimes, vendored builds. On one Mac, the openssl command said 4.0.3 while Node reported 3.6.4. List every copy and its version, then move to a supported line: 3.5 LTS, 4.0 or 4.1. Guide and checker script: link in bio (http://safeguard.sh/resources/blog). #OpenSSL #AppSec #SBOM #DevSecOps

OpenSSL 3.4 lost upstream support on 22 October 2026. 3.6 follows on 1 November. Upstream will then maintain 3.5 LTS (to April 2030), 4.0 (to May 2027) and 4.1 (to November 2027). Distribution packages follow the distribution's support. The risk is OpenSSL you build, bundle or install yourself, and base images nobody rebuilt. List every copy and its version, then move to a supported line. Guide and checker script: https://na2.hubs.ly/H08Cy6_0 #OpenSSL #AppSec #Shorts

OpenSSL 3.4 lost upstream support on 22 October, and 3.6 follows this Sunday, 1 November. The copies to worry about are the ones you build, bundle or brew yourself, plus base images nobody rebuilt. Find every copy and its version, then move to a supported line (3.5 LTS, 4.0 or 4.1). Guide and checker script: https://na2.hubs.ly/H08Cy6-0

Three US software security dates are coming: CMMC Phase 2 on 10 Nov 2026, CISA BOD 26-04 timelines on 7 Dec 2026, Colorado AI developer duties on 1 Jan 2027. There is no single US SBOM law, but customers, sector rules and boards ask for one anyway. Swipe for the dates and a 90-day plan in three phases. Not legal advice. Link in bio: http://safeguard.sh/resources/blog #CMMC #SBOM #AppSec #SupplyChainSecurity #cybersecurity

Three US software security dates are coming up: CMMC Phase 2 on 10 November 2026, CISA BOD 26-04 remediation timelines for federal agencies on 7 December 2026, and Colorado's AI developer duties on 1 January 2027. Our guide covers each rule from its primary text and ends with a 90-day plan in three phases. Swipe through the dates and the plan. https://na2.hubs.ly/H08CDRZ0

Three US software security dates are coming up. 10 November 2026: CMMC Phase 2 begins. Level 2 assessments by third-party assessors can enter applicable defense contracts as a condition of award. 7 December 2026: CISA BOD 26-04 remediation timelines apply to federal agencies. Fix urgency rests on four factors: asset exposure, KEV status, exploit automation and technical impact. 1 January 2027: Colorado developer duties under its automated decision-making technology law begin. There is no single US SBOM law. Buyers ask anyway, through contracts, sector rules and board questions. Our guide takes each rule from its primary text and ends with a 90-day plan in three phases: inventory and owners in the first 30 days, rank, fix and gate in days 31 to 60, evidence and cadence in days 61 to 90. It works with any toolset. Safeguard produces the inputs: an SBOM per release, findings ranked by KEV status and reachability, supplier SBOM requests. Assessors and regulators make the decisions. Not legal advice. Full guide: https://lnkd.in/eZTc2TUM Dates as read on 26 Oct 2026 from the CMMC program rule, CISA BOD 26-04 and Colorado SB26-189. #CMMC #SBOM #AppSec #SupplyChainSecurity

One vendor breach, two universities, and a question most vendor reviews skip. On 20 October NEC said a company it outsources development and maintenance to was attacked in late September, and that valid accounts were misused against NEC customers. Osaka Metropolitan University says a further subcontractor's valid account was used to access its systems. Osaka University says files were shared on cloud storage outside the contract, and a third party downloaded them. 77,851 people are affected, duplicates removed. The notices do not name the subcontractor. What they do show is how long the chain can be: your risk includes your vendors' vendors. Can you name every company that touches your systems or your data? Which outside accounts could log in to you today, and when were they last used? Our post sets out the timeline from the official notices and the questions to send your vendors this week. If you track suppliers in Safeguard, the Third-Party Risk Manager handles vendor onboarding and ongoing risk monitoring. https://lnkd.in/gtruXqsm #ThirdPartyRisk #SupplyChainSecurity #CyberSecurity

One vendor breach, two universities. NEC says a company it outsources to was attacked, and valid accounts were misused against its customers. Your risk includes your vendors' vendors. Can you name every company that touches your systems or your data? Timeline from the official notices and questions for your vendors: link in bio (http://safeguard.sh/resources/blog). #ThirdPartyRisk #SupplyChainSecurity #CyberSecurity #VendorRisk

NEC said a company it outsources work to was attacked in late September and valid accounts were misused against its customers. Osaka Metropolitan University and Osaka University each published notices. Can you name every company that touches your systems or your data? Timeline and vendor questions: https://na2.hubs.ly/H08C1b00 #ThirdPartyRisk #SupplyChainSecurity #Shorts

One vendor breach, two universities. NEC says a company it outsources to was attacked in late September and valid accounts were misused against its customers. Osaka University says a third party downloaded files shared on cloud storage outside the contract: 77,851 people, duplicates removed. Your risk includes your vendors' vendors. Can you name every company that touches your systems or your data? Timeline from the official notices and questions to ask your vendors: https://na2.hubs.ly/H08C19j0

CISA put an Adobe Commerce and Magento flaw on its Known Exploited Vulnerabilities (KEV) list on 27 October 2026, and researchers say attackers have been using it since March. This first full Patch Monday briefing covers four stories from 21 to 27 October, each with what happened, who is stuck with it right now, and one thing to do on Monday morning. A CVE and vulnerability management story: CVE-2026-48356 in Adobe Commerce and Magento Open Source, how to patch it and how to check a store for web shells left behind. A cloud platform breach and secrets story: Railway's disclosure and preliminary report on an unauthorized party that may have accessed encrypted environment variables, and how to rotate API keys and credentials in the right order. A compliance story: the paused CMMC program, NIST SP 800-171 and what a defense supplier can do while the Pentagon decides, as reported by Federal News Network. And an AI coding agent security story: a malicious AGENTS.md file in a Downloads folder, Codex and Claude Code, and the malicious npm package an agent tried to install.

Anthropic filed a Form S-1 on 26 October. For teams that already run on Claude, the risk factors are a vendor security review answered in public: model weights named as a state-sponsored target, "known limitations or gaps" in defenses at times, agent hijack paths, and dated outages and export restrictions. Your side of the work: an AI-BOM, an MCP connector inventory and least-privilege agent permissions. Not investment advice.

Anthropic filed a Form S-1 with the SEC on 26 October. If your teams already run on Claude, its risk factors read like a vendor security review answered in public. What stands out for security and third-party risk teams: 1. Model weights are named as a high-value target for state-sponsored theft, and the filing says Anthropic has at times operated with "known limitations or gaps" in its defenses. 2. Agent attack paths in plain terms: poisoned external content steering an agent, hijacked sessions using a customer's own credentials, and errors that compound across multi-step workflows. 3. Dated events, including a March 2026 outage and a June 2026 export restriction that led Anthropic to disable two models for every customer until it was lifted. 4. Incidents can come from customer misconfiguration. Your side of the work: an AI-BOM, an inventory of MCP connectors and least-privilege agent permissions. We read the filing only for what it tells a customer's security team. This is not investment advice. Page references and the vendor review questions to ask: https://lnkd.in/guzrSEUt

When a dependency has a known vulnerability and the maintainer has not shipped a fix, you can fork it and patch it yourself. This shows the fork-and-patch route in Safeguard and how the patched build stays tracked. Try Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=fix-stories&utm_content=fork-and-patch Full guide: https://safeguard.sh/resources/blog/fork-and-patch-vulnerable-packages Topics: fix vulnerable dependency, fork and patch, patch without upstream, open source remediation, software supply chain security.

Scan a container image in your CI pipeline before it is pushed or deployed, so a vulnerable base layer never reaches a registry. This shows where the scan sits in the pipeline and what a failed gate looks like. Try Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=safeguard-in-action&utm_content=container-scan-ci Full guide: https://safeguard.sh/resources/blog/scan-container-images-in-ci-with-safeguard-before-push-and-deploy Topics: container image scanning, scan Docker images in CI, container vulnerability scanning, DevSecOps pipeline.