Cybersecurity articles tagged #Supply Chain Security on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/cmmc-compliance-confidence-rises-proof-lags-for-dod-contractorshttps://runtimerebel.com/blog/cmmc-compliance-confidence-rises-proof-lags-for-dod-contractorsDoD contractors report higher confidence in CMMC compliance, yet struggle to provide verifiable proof, leading to legal and contract risks.Mon, 24 Aug 2026 00:42:31 GMTSupply Chain SecurityComplianceCMMCDFARSDoDhttps://runtimerebel.com/blog/recorded-future-enhances-third-party-risk-with-unified-threat-intelhttps://runtimerebel.com/blog/recorded-future-enhances-third-party-risk-with-unified-threat-intelRecorded Future integrates threat intelligence and risk ratings into a unified third-party risk management platform to proactively identify vendor compromises.Wed, 19 Aug 2026 16:25:18 GMTThreat IntelligenceThird Party Risk ManagementVendor RiskRecorded FutureSupply Chain Securityhttps://runtimerebel.com/blog/nico-waisman-evolution-of-offensive-security-and-open-sourcehttps://runtimerebel.com/blog/nico-waisman-evolution-of-offensive-security-and-open-sourceExplore Nico Waisman's journey from self-taught hacker to pioneering offensive security and leading open source supply chain efforts.Tue, 18 Aug 2026 16:21:57 GMTOffensive SecurityOpen Source SecurityPenetration TestingSupply Chain SecurityGitHub Security Labhttps://runtimerebel.com/blog/nc-ports-cyberattack-disrupts-operations-at-key-facilitieshttps://runtimerebel.com/blog/nc-ports-cyberattack-disrupts-operations-at-key-facilitiesNorth Carolina Ports confirmed a cyberattack disrupting IT systems and operations across its facilities. Recovery efforts are underway, with expected delays.Sun, 09 Aug 2026 08:31:30 GMTNorth Carolina PortsCyberattackOperational DisruptionCritical InfrastructureSupply Chain Securityhttps://runtimerebel.com/blog/emerging-attack-vectors-in-ai-harnesses-trust-boundary-exploitationhttps://runtimerebel.com/blog/emerging-attack-vectors-in-ai-harnesses-trust-boundary-exploitationAnalysis of potential exploit opportunities within complex AI software stacks due to inter-component trust issues. Understand emerging attack vectors.Thu, 30 Jul 2026 21:13:36 GMTAI SecurityMachine Learning SecurityTrust BoundariesSupply Chain SecurityEmerging Threatshttps://runtimerebel.com/blog/fcc-blocks-foreign-robots-and-power-inverters-via-covered-listhttps://runtimerebel.com/blog/fcc-blocks-foreign-robots-and-power-inverters-via-covered-listThe FCC has added foreign-produced mobile robots and networked power inverters to the Covered List, citing supply chain risks and national security concerns.Thu, 30 Jul 2026 10:26:21 GMTFCCCovered ListMobile RobotsPower InvertersSupply Chain SecurityNational Securityhttps://runtimerebel.com/blog/github-and-pypi-policy-updates-target-supply-chain-securityhttps://runtimerebel.com/blog/github-and-pypi-policy-updates-target-supply-chain-securityGitHub and PyPI introduce new restrictions to thwart supply chain attacks, including a Dependabot cooldown and limits on historical package file uploads.Mon, 27 Jul 2026 14:40:00 GMTGitHubPyPISupply Chain SecurityDependabotOpen Sourcehttps://runtimerebel.com/blog/lookout-msec-tackling-supply-chain-risks-via-mobile-app-sbomshttps://runtimerebel.com/blog/lookout-msec-tackling-supply-chain-risks-via-mobile-app-sbomsLookout launches the Mobile Security Exposure Center (MSEC) to provide visibility into vulnerable third-party components and mobile app dependencies via SBOMs.Mon, 27 Jul 2026 11:26:52 GMTLookout MSECSBOMMobile App SecuritySupply Chain SecurityApplication Riskhttps://runtimerebel.com/blog/github-dependabot-3-day-cooldown-mitigating-supply-chain-attackshttps://runtimerebel.com/blog/github-dependabot-3-day-cooldown-mitigating-supply-chain-attacksGitHub introduces a 3-day cooldown for Dependabot to prevent the rapid adoption of malicious packages, enhancing supply chain security for developers.Mon, 27 Jul 2026 11:25:20 GMTGitHubDependabotSupply Chain SecurityMalicious PackagesOpen Sourcehttps://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attackshttps://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attacksGitHub and PyPI introduce time-based delays in Dependabot to mitigate supply chain attacks by preventing the immediate ingestion of malicious packages.Sun, 26 Jul 2026 17:03:02 GMTGitHubPyPIDependabotSupply Chain SecurityPythonhttps://runtimerebel.com/blog/risk-ledger-secures-32m-series-b-for-supply-chain-risk-platformhttps://runtimerebel.com/blog/risk-ledger-secures-32m-series-b-for-supply-chain-risk-platformRisk Ledger raises $32 million in Series B funding to scale its collaborative supply chain security platform, addressing critical third-party risk management.Fri, 17 Jul 2026 10:00:13 GMTRisk LedgerSupply Chain SecurityTPRMSeries B FundingCyber Risk Managementhttps://runtimerebel.com/blog/threatsday-report-emerging-deception-rapid-ransomware-threatshttps://runtimerebel.com/blog/threatsday-report-emerging-deception-rapid-ransomware-threatsAnalysis of recent threats, including deceptive game cheat spyware, rapid ransomware deployments, and Chrome sync abuse.Thu, 16 Jul 2026 17:22:58 GMTSpywareRansomwareSocial EngineeringSupply Chain SecurityDeceptionChromehttps://runtimerebel.com/blog/2-click-cursor-exploit-dev-environment-takeover-risks-mitigationshttps://runtimerebel.com/blog/2-click-cursor-exploit-dev-environment-takeover-risks-mitigationsAnalyze the '2-click cursor exploit' leveraging 'age-old bugs' to compromise developer environments, risking source code and IP theft.Wed, 15 Jul 2026 13:49:23 GMTDeveloper EnvironmentsSupply Chain SecurityApplication SecurityExploitationSource Code Thefthttps://runtimerebel.com/blog/cybersecurity-m-a-trends-implications-for-enterprise-securityhttps://runtimerebel.com/blog/cybersecurity-m-a-trends-implications-for-enterprise-securityAnalyze the impact of 37 cybersecurity M&A deals in June 2026 on vendor ecosystems, supply chain risks, and security strategy for enterprises.Mon, 13 Jul 2026 14:43:37 GMTCybersecurity M aVendor ConsolidationSupply Chain SecuritySecurity StrategyIndustry Trendshttps://runtimerebel.com/blog/npm-12-enhances-supply-chain-security-by-disabling-install-scriptshttps://runtimerebel.com/blog/npm-12-enhances-supply-chain-security-by-disabling-install-scriptsnpm version 12 introduces critical security defaults, disabling install scripts and deprecating GATs, significantly mitigating JavaScript supply chain risks.Thu, 09 Jul 2026 17:57:40 GMTNPMSupply Chain SecurityInstall ScriptsSecurity DefaultsGATs2FAJavaScript Packageshttps://runtimerebel.com/blog/cyberwarfare-fallout-global-business-cybersecurity-gameplanshttps://runtimerebel.com/blog/cyberwarfare-fallout-global-business-cybersecurity-gameplansBusinesses globally face increased cyberwarfare risks from geopolitical conflicts.Thu, 09 Jul 2026 15:16:21 GMTCyber WarfareGeopolitical RiskSupply Chain SecurityCritical Infrastructure ProtectionBusiness ContinuityOrganizational Resiliencehttps://runtimerebel.com/blog/github-actions-attack-patterns-evade-ci-security-scannershttps://runtimerebel.com/blog/github-actions-attack-patterns-evade-ci-security-scannersLearn how sophisticated GitHub Actions attack patterns bypass traditional CI security scanners, exposing CI/CD pipelines to supply chain risks.Tue, 07 Jul 2026 14:38:51 GMTGitHub ActionsCI CD SecuritySupply Chain SecuritySecurity ScanningCode Integrityhttps://runtimerebel.com/blog/how-agentjacking-exploits-ai-coding-agents-via-fake-bug-reportshttps://runtimerebel.com/blog/how-agentjacking-exploits-ai-coding-agents-via-fake-bug-reportsResearchers demonstrate 'Agentjacking,' a technique using indirect prompt injection to hijack AI coding agents through malicious GitHub bug reports.Wed, 01 Jul 2026 09:21:10 GMTAgentjackingPrompt InjectionAI SecurityTrail of BitsOpendevinSupply Chain Securityhttps://runtimerebel.com/blog/malware-evades-ai-analysis-with-forbidden-text-tacticshttps://runtimerebel.com/blog/malware-evades-ai-analysis-with-forbidden-text-tacticsThreat actors embed 'forbidden' text in malware to confuse AI analysis tools, targeting bioinformatics and MCP developers.Thu, 25 Jun 2026 05:28:25 GMTAI EvasionMalware AnalysisMini Shai HuludMiasmaHades WormsBioinformatics SecuritySupply Chain Securityhttps://runtimerebel.com/blog/magnitude-secures-10m-to-advance-ai-in-third-party-risk-managementhttps://runtimerebel.com/blog/magnitude-secures-10m-to-advance-ai-in-third-party-risk-managementMagnitude emerges from stealth with $10 million in funding to evolve third-party risk management using autonomous AI agents, bolstering supply chain security.Tue, 16 Jun 2026 13:58:54 GMTMagnitudeTPRMThird Party Risk ManagementAIAutonomous AgentsSupply Chain Securityhttps://runtimerebel.com/blog/tech-coalition-athena-collaborative-oss-vulnerability-pre-disclosurehttps://runtimerebel.com/blog/tech-coalition-athena-collaborative-oss-vulnerability-pre-disclosureThe Athena coalition, comprising over two dozen organizations, establishes a shared platform to proactively triage and remediate open-source software vulnerabilities…Tue, 16 Jun 2026 10:00:00 GMTAthenaOpen Source SoftwareVulnerability ManagementSupply Chain SecurityPre Disclosurehttps://runtimerebel.com/blog/github-to-disable-npm-install-scripts-by-default-in-version-12https://runtimerebel.com/blog/github-to-disable-npm-install-scripts-by-default-in-version-12GitHub announces breaking changes for npm v12, disabling install scripts by default to prevent malicious code execution and enhance supply chain security.Thu, 11 Jun 2026 09:37:20 GMTNPMGitHubNpm V12Supply Chain SecurityMalware Preventionhttps://runtimerebel.com/blog/sofi-hong-kong-data-breach-via-third-party-vendor-compromisehttps://runtimerebel.com/blog/sofi-hong-kong-data-breach-via-third-party-vendor-compromiseAnalysis of the SoFi Hong Kong data breach impacting customer information, stemming from a third-party vendor compromise. Includes mitigation strategies.Tue, 09 Jun 2026 00:56:25 GMTSoFi Hong KongData BreachThird Party RiskSupply Chain SecurityCustomer DataFinancial Serviceshttps://runtimerebel.com/blog/vs-code-extension-auto-update-delay-mitigating-supply-chain-attackshttps://runtimerebel.com/blog/vs-code-extension-auto-update-delay-mitigating-supply-chain-attacksMicrosoft introduces a two-hour delay for VS Code extension auto-updates to prevent rapid compromise during software supply chain attacks.Mon, 08 Jun 2026 09:44:07 GMTVisual Studio CodeMicrosoftSupply Chain SecurityIDE Extensionshttps://runtimerebel.com/blog/pan-os-exploitation-and-linux-auth-flaws-weekly-threat-recaphttps://runtimerebel.com/blog/pan-os-exploitation-and-linux-auth-flaws-weekly-threat-recapAn analysis of active PAN-OS exploitation, a new Linux authentication flaw, and the rise of AI-powered OAuth phishing kits targeting enterprise environments.Mon, 01 Jun 2026 14:10:36 GMTLinux VulnerabilityPAN OSOauth PhishingSupply Chain Securityhttps://runtimerebel.com/blog/geopolitical-competition-and-cyber-risks-of-humanoid-roboticshttps://runtimerebel.com/blog/geopolitical-competition-and-cyber-risks-of-humanoid-roboticsAnalysis of how global competition for humanoid robots and embodied AI introduces physical risks and supply chain vulnerabilities for organizations.Mon, 01 Jun 2026 09:57:41 GMTHumanoid RobotsEmbodied AiSupply Chain SecurityIndustrial SecurityRobotics Securityhttps://runtimerebel.com/blog/russian-intelligence-intensifies-tech-procurement-and-infrastructure-reconhttps://runtimerebel.com/blog/russian-intelligence-intensifies-tech-procurement-and-infrastructure-reconRussian spies are leveraging front companies and cyber espionage to bypass sanctions and gather intelligence for potential attacks on Western infrastructure.Sat, 30 May 2026 16:27:21 GMTRussian IntelligenceSanctions EvasionIndustrial Control SystemsSupply Chain Securityhttps://runtimerebel.com/blog/linux-vulnerabilities-and-defender-zero-days-weekly-threat-recaphttps://runtimerebel.com/blog/linux-vulnerabilities-and-defender-zero-days-weekly-threat-recapWeekly intelligence recap covering Linux flaws, Microsoft Defender zero-days, router botnets, and supply chain compromises targeting developer toolchains.Mon, 25 May 2026 16:48:57 GMTLinux SecurityMicrosoft DefenderSupply Chain SecurityBotnetshttps://runtimerebel.com/blog/npm-staged-publishing-new-2fa-controls-prevent-supply-chain-attackshttps://runtimerebel.com/blog/npm-staged-publishing-new-2fa-controls-prevent-supply-chain-attacksGitHub introduces staged publishing for npm, requiring manual 2FA approval for package releases to mitigate malicious automated updates and account takeovers.Sat, 23 May 2026 20:21:54 GMTNPMGitHubSupply Chain SecurityTwo Factor AuthenticationStaged PublishingApplication Securityhttps://runtimerebel.com/blog/grafana-codebase-stolen-via-tanstack-supply-chain-attackhttps://runtimerebel.com/blog/grafana-codebase-stolen-via-tanstack-supply-chain-attackGrafana confirms unauthorized access to private GitHub repositories after a developer token leaked in the TanStack breach was not rotated.Fri, 22 May 2026 09:17:25 GMTGrafanaTanStackGithub Token LeakSupply Chain Securityhttps://runtimerebel.com/blog/securing-agentic-ai-workflows-with-advanced-ai-bom-frameworkshttps://runtimerebel.com/blog/securing-agentic-ai-workflows-with-advanced-ai-bom-frameworksLearn why CISOs must transition from traditional SBOMs to Agentic-Ready AI BOMs to manage risks in autonomous AI systems and data supply chains.Fri, 22 May 2026 00:56:56 GMTAIBOMAgentic AISupply Chain SecurityCycloneDXLLM Securityhttps://runtimerebel.com/blog/ai-boms-in-security-ciso-guide-to-usability-influencehttps://runtimerebel.com/blog/ai-boms-in-security-ciso-guide-to-usability-influenceExplore how CISOs can effectively prepare for and integrate AI Bill of Materials (AI BOMs) into their modern security programs, influencing their generation for better…Wed, 20 May 2026 13:07:01 GMTAIAIBOMCISOSupply Chain SecurityMachine LearningRisk Managementhttps://runtimerebel.com/blog/320-antv-npm-packages-compromised-in-mini-shai-hulud-attackhttps://runtimerebel.com/blog/320-antv-npm-packages-compromised-in-mini-shai-hulud-attackA maintainer account compromise has led to a major supply chain attack against Alibaba’s @antv NPM namespace, impacting over 320 visualization packages.Wed, 20 May 2026 13:06:33 GMTNPMMini Shai HuludAntvSupply Chain SecurityJavaScripthttps://runtimerebel.com/blog/ai-bom-implementation-for-enterprise-security-bridging-visibilityhttps://runtimerebel.com/blog/ai-bom-implementation-for-enterprise-security-bridging-visibilityAnalyze the rise of AI Bill of Materials (AIBOMs), regulatory drivers like the EU AI Act, and the technical challenges of securing opaque AI supply chains.Wed, 20 May 2026 09:17:00 GMTAIBOMAI SecuritySupply Chain SecurityEU AI ActCycloneDXhttps://runtimerebel.com/blog/ai-bills-of-materials-essential-for-proactive-ai-supply-chain-securityhttps://runtimerebel.com/blog/ai-bills-of-materials-essential-for-proactive-ai-supply-chain-securityExplore the emerging necessity of AI Bills of Materials (AI BOMs) to manage complex AI supply chain risks and enhance transparency in AI systems by 2026.Tue, 19 May 2026 13:21:34 GMTAI BOMsAI SecuritySupply Chain SecurityRisk ManagementArtificial IntelligenceTransparencyhttps://runtimerebel.com/blog/grafana-github-token-compromise-codebase-stolen-via-pathttps://runtimerebel.com/blog/grafana-github-token-compromise-codebase-stolen-via-patGrafana Labs reports a source code breach after attackers leveraged a stolen GitHub Personal Access Token. Analysis of the impact and mitigation steps.Mon, 18 May 2026 17:03:57 GMTGrafanaGitHubCredential TheftSource Code ExfiltrationSupply Chain Securityhttps://runtimerebel.com/blog/cyber-enabled-cargo-theft-how-phishing-and-identity-theft-hijack-freighthttps://runtimerebel.com/blog/cyber-enabled-cargo-theft-how-phishing-and-identity-theft-hijack-freightCyber-enabled cargo crime leverages stolen credentials and phishing to reroute freight, replacing traditional hijackings with digital fraud and identity theft.Thu, 14 May 2026 16:47:04 GMTCargo TheftSupply Chain SecurityNmftaIdentity TheftLogistics Securityhttps://runtimerebel.com/blog/rubygems-suspends-registrations-due-to-malicious-package-influxhttps://runtimerebel.com/blog/rubygems-suspends-registrations-due-to-malicious-package-influxRubyGems maintainers suspended new user registrations after detecting an automated attack involving over 500 malicious packages targeting platform resources.Wed, 13 May 2026 09:09:56 GMTRubyGemsOpen Source SecurityPackage ManagerSupply Chain SecurityMalicious Packageshttps://runtimerebel.com/blog/fcc-adjusts-foreign-router-ban-supply-chain-security-implicationshttps://runtimerebel.com/blog/fcc-adjusts-foreign-router-ban-supply-chain-security-implicationsThe FCC has modified its ban on non-compliant foreign-made routers, extending deadlines for federal agencies. This impacts government supply chain security efforts.Tue, 12 May 2026 00:49:17 GMTFCCSupply Chain SecurityNational SecurityRoutersFederal ProcurementSecure Networks Acthttps://runtimerebel.com/blog/linux-rootkits-and-macos-crypto-stealers-surge-in-supply-chain-attackshttps://runtimerebel.com/blog/linux-rootkits-and-macos-crypto-stealers-surge-in-supply-chain-attacksAnalysis of recent threats involving Linux rootkit persistence, macOS crypto-stealing malware, and the exploitation of poisoned supply chain downloads.Mon, 11 May 2026 16:59:33 GMTLinux RootkitmacOS MalwareSupply Chain SecurityCrypto StealerWebsocket Skimmershttps://runtimerebel.com/blog/quasar-linux-rat-qlnx-targets-developers-for-supply-chain-attackshttps://runtimerebel.com/blog/quasar-linux-rat-qlnx-targets-developers-for-supply-chain-attacksA new Linux implant, Quasar Linux RAT (QLNX), targets developer systems for credential theft and network tunneling to compromise software supply chains.Fri, 08 May 2026 12:36:57 GMTQLNXQuasar Linux RATSupply Chain SecurityLinux MalwareCredential Thefthttps://runtimerebel.com/blog/boost-security-expands-sdlc-defense-via-strategic-acquisitionshttps://runtimerebel.com/blog/boost-security-expands-sdlc-defense-via-strategic-acquisitionsBoost Security secures $4 million and acquires SecureIQx and Korbit.ai to streamline automated governance and security within the development lifecycle.Thu, 07 May 2026 16:42:57 GMTBoost SecuritySDLCDevSecOpsSupply Chain SecurityAutomated Governancehttps://runtimerebel.com/blog/trellix-source-code-repository-breach-analysis-and-impacthttps://runtimerebel.com/blog/trellix-source-code-repository-breach-analysis-and-impactTrellix confirms a data breach following unauthorized access to source code repositories via a third-party service. Learn the impact and mitigation steps.Mon, 04 May 2026 16:40:27 GMTTrellixSource CodeData BreachSupply Chain Securityhttps://runtimerebel.com/blog/ai-powered-phishing-and-github-rce-analyzing-modern-breach-trendshttps://runtimerebel.com/blog/ai-powered-phishing-and-github-rce-analyzing-modern-breach-trendsThreat actors are using AI-powered phishing and GitHub RCE to move from simple breaches to long-term occupation of SaaS and open-source environments.Mon, 04 May 2026 16:39:26 GMTAI PhishingGithub RceLinux Kernel ExploitSaaS SecuritySupply Chain Securityhttps://runtimerebel.com/blog/fbi-warning-cyber-enabled-cargo-theft-losses-surge-to-725-millionhttps://runtimerebel.com/blog/fbi-warning-cyber-enabled-cargo-theft-losses-surge-to-725-millionFBI alerts logistics firms to a massive rise in cyber-enabled cargo theft involving identity theft and fraudulent carrier profiles. Protect your supply chain.Thu, 30 Apr 2026 16:37:05 GMTCargo TheftLogistics SecurityFraudIdentity TheftSupply Chain Securityhttps://runtimerebel.com/blog/bitwarden-npm-supply-chain-attack-analyzing-the-teampcp-campaignhttps://runtimerebel.com/blog/bitwarden-npm-supply-chain-attack-analyzing-the-teampcp-campaignA malicious npm package impersonating Bitwarden was discovered exfiltrating sensitive data via the Shai-Hulud worm in a recent supply chain attack.Fri, 24 Apr 2026 08:49:11 GMTNPMBitwardenTeamPCPShai HuludSupply Chain Securityhttps://runtimerebel.com/blog/state-sponsored-cyber-operations-targeting-critical-mineral-supply-chainshttps://runtimerebel.com/blog/state-sponsored-cyber-operations-targeting-critical-mineral-supply-chainsGeopolitical tensions over critical minerals fuel a rising threat of state-sponsored cyber operations targeting the global mining sector and supply chains.Thu, 23 Apr 2026 16:46:12 GMTCritical MineralsRare Earth ElementsState Sponsored CyberMining SectorSupply Chain SecurityGeopolitical Cyber ThreatsResource Competitionhttps://runtimerebel.com/blog/cloudsmith-funding-boosts-software-supply-chain-security-effortshttps://runtimerebel.com/blog/cloudsmith-funding-boosts-software-supply-chain-security-effortsCloudsmith secures $72M in Series C funding to accelerate development of its software supply chain management platform, enhancing artifact security and integrity.Thu, 23 Apr 2026 16:42:00 GMTCloudsmithSupply Chain SecurityArtifact ManagementDevOpsFundinghttps://runtimerebel.com/blog/vercel-breach-and-qemu-abuse-analyzing-modern-trust-based-attackshttps://runtimerebel.com/blog/vercel-breach-and-qemu-abuse-analyzing-modern-trust-based-attacksAnalysis of the Vercel infrastructure compromise, QEMU-based evasion techniques, and the rise of Android RATs leveraging update channels for delivery.Mon, 20 Apr 2026 16:31:44 GMTVercelQEMUAndroid RATPush FraudSupply Chain Securityhttps://runtimerebel.com/blog/vercel-data-breach-shinyhunters-claim-theft-of-next-js-creator-datahttps://runtimerebel.com/blog/vercel-data-breach-shinyhunters-claim-theft-of-next-js-creator-dataVercel confirms a security incident following claims by ShinyHunters to sell stolen data for $2 million. Analyze the impact on Next.js and supply chains.Mon, 20 Apr 2026 08:54:09 GMTVercelNext JsShinyHuntersData BreachSupply Chain Security