Supply Chain Security

A threat-hunting report puts the gap between a public proof-of-concept and active exploitation at about 48 hours. Here is what that does to patch scheduling, why severity scores are the wrong primary signal, and a few adjustments worth making.

A practitioner breakdown of the npm worm that sweeps environment variables on install and republishes itself through Trusted Publishing.

Cisco compromised Claude Code’s persistent memory to deliver insecure guidance across projects, sessions, and reboots. What engineering teams should do.

How the April 2026 compromise of CPUID’s site turned CPU-Z and HWMonitor downloads into a multi-stage malware delivery chain.

Every consumer router made outside the US is now on the FCC Covered List. Why firmware verification matters more than the import ban.

If the AppsFlyer script loads on your payment pages, you may have been serving malicious code. What the requirements actually ask you to do.

What the IBM X-Force Threat Intelligence Index 2026 says about AI-accelerated attacks, and why basic hygiene failures still cause the damage.

A follow-up on OpenClaw’s remediation, what actually improved, and the questions raised when Peter Steinberger joined OpenAI.