Open Source Security Blog
ISO 27001 open source dependency management is not about proving that every package is perfect. It is about proving that your organisation can identify technical vulnerabilities, assess exposure, take action,…
ℹ️ Note: This post is a practical technical and business guide, not legal advice. Consult a qualified lawyer for your specific licence compliance obligations. Open source licence risk becomes real…
Software supply chain security became a board-level concern after SolarWinds, Log4Shell, XZ Utils, and public package registry attacks showed the same lesson: your application is only as trustworthy as the…
A dependency confusion attack helped security researcher Alex Birsan earn $130,000 in bug bounties after demonstrating that build systems at Apple, Microsoft, PayPal, Uber, Yelp, Tesla, and 30+ other companies…
A team can pass a cloud security review in Wiz and still ship a Node.js service with 47 vulnerable npm packages. That is why teams searching for a wiz security…
A 75-person engineering team can end up paying for an enterprise application security platform when the team mostly needs 2 things: reliable software composition analysis for open source CVEs and…
SharePoint CVE-2026-50522 is now under active exploitation after a public proof-of-concept appeared for the critical Microsoft SharePoint Server vulnerability. The flaw carries a CVSS 9.8 score and allows an unauthorized…
Critical NGINX vulnerability CVE-2026-42533 is a critical heap buffer overflow that can let a remote, unauthenticated attacker crash or restart NGINX worker processes using crafted HTTP requests. F5 has patched…
SonicWall SMA zero-days CVE-2026-15409 and CVE-2026-15410 were exploited before public disclosure against SonicWall Secure Mobile Access 1000 series VPN appliances. The activity has been attributed to a previously undocumented threat…
wp2shell WordPress vulnerability is a critical WordPress core issue that can let an unauthenticated attacker move from a single HTTP request to code execution on vulnerable sites. This is not…