SBOMs in Practice: SPDX vs CycloneDX and What Actually Breaks
SPDX vs CycloneDX compared honestly, how to generate SBOMs that match production, and the failure modes that sink real adoption — plus the EU CRA deadlines now in force.
The 3CX Supply-Chain Attack: When Signed Updates Turn Against You
3CX’s signed desktop app shipped a trojan after its build pipeline fell to an upstream vendor compromise — the first documented double supply-chain attack.
ownCloud CVE-2023-49103: The CVSS 10.0 in the Docker Image
The graphapi app bundled in ownCloud’s Docker deployment images exposed mail credentials, database passwords, and S3 keys to unauthenticated visitors — a mis-packaged dependency that became full infrastructure compromise. CISA KEV-listed it within ten days.
Biden’s Zero Trust Executive Order: The Procurement Pivot
EO 14028 turned zero trust from slide-ware into federal procurement doctrine — MFA, SBOMs, NIST 800-207, the Cyber Safety Review Board — and reset vendor incentives industry-wide.
Software Supply Chain Security for AI Agents and MCP Servers
A deep dive into securing AI agent supply chains — MCP server vetting, dependency integrity, sandboxing, and trust anchors for AI infrastructure.
Supply Chain Security: Risks in Dependencies, Builds & Secrets
Software Supply Chain Security: Risks in Dependencies, Builds, and Secrets
A practical guide to software supply chain security covering dependency risks, secrets exposure, CI/CD trust failures, artifact integrity verification, SBOM management, and real-world attack case studies.