GitLab CVE-2026-19478 went from disclosure to in-the-wild exploitation in days; a compromised maintainer account backdoored three Rust crates with 245M downloads for 86 minutes; Citrix shipped a CVSS 9.3 NetScaler auth bypass. The week's threats, IoCs, and your Monday patch list.
Three supply chain campaigns in one week: 400+ hijacked AUR packages, Velvet Ant's nine-year Linux PAM backdoor, and KEV entries for Oracle PeopleSoft and Ivanti Sentry. Trust is the attack surface.
Chrome's fifth zero-day of 2026 and the Shai-Hulud PyPI campaign targeting 19 Python packages highlight the growing convergence of browser exploitation and open-source supply chain threats.
From AI-powered attacks to post-quantum cryptography, explore the five cybersecurity trends defining 2026 and what defenders must do now.
A deep dive into securing AI agent supply chains — MCP server vetting, dependency integrity, sandboxing, and trust anchors for AI infrastructure.
One curl request to /.git/HEAD hands attackers your full source, every commit ever made, deleted files, and usually a working credential. A decade of research says this mistake is not aging out. Here is the exploit chain — and the three-layer fix.
A practical guide to software supply chain security covering dependency risks, secrets exposure, CI/CD trust failures, artifact integrity verification, SBOM management, and real-world attack case studies.