Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Python 3.10 reached end of life on 1 October 2026. Its final release, 3.10.22, shipped that day with fixes for eight CVEs, and the CPython team will not fix anything in 3.10 again. The interpreter keeps running.
PyPI has accepted signed attestations since November 2024, but pip doesn't check them. How to verify one, how to catch a change of publisher in CI, and which of the top 1,000 packages attest today.
CVE and OSV records already have a 'tool' credit type. Of 2,544 CVE records added on 13 and 14 October 2026, two used it. Why AI-found vulnerabilities should credit the tool, and why defenders should care.
curl 8.23.0, released on 14 October 2026, fixes 24 CVEs in one go. That's more than curl published in all of 2024 and 2025 combined, and it takes the project's 2026 total to 69.
Adding a dependency takes ten seconds and commits you to trusting a stranger's code on your build machines for as long as the project lives. Six checks, the signals that should stop you, and what this deliberately does not defend against.
A practical guide to managing telecom OSS/BSS open source risk—from SBOM inventory to dependency scanning—so carrier billing and network software stays secure.
Every npm classic token has been permanently revoked — unrecoverable, unrecreatable. Teams treated it as a chore. Then a worm propagated across 444 packages on exactly that kind of credential.
A seven-step process for vetting open source telecom core network components — SBOMs, signature verification, protocol fuzzing, and procurement sign-off — before they reach production.
A practical guide to finding and fixing e-commerce platform dependency risk across Magento plugins, WooCommerce extensions, and Shopify apps before attackers do.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
