Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CERT Polska disclosed 11 flaws in the CGM CLININET hospital system on 23 Oct 2026. Five are fixed in 2026.MS3, six have no stated fix. What to do now.
The PHP Foundation is a sponsor funded collective, formed in November 2021, that pays core developers to maintain and secure PHP. Here is how it works.
Roundcube 1.6.20 and 1.7.5 fix 20 flaws, including IMAP command injection and a session object injection primitive. Versions, CVEs and how to patch now.
Apache Tomcat disclosed eight CVEs on 20 Oct 2026, led by a JNDIRealm login bypass. Upgrade to 11.0.27, 10.1.61 or 9.0.123; 8.5 and 7.0 get no fix.
NLWeb turns a site's Schema.org and RSS data into an /ask endpoint and an MCP server. How it works, what it exposes, and how to lock it down.
A media server flaw at Arcadia exposed up to 3.136M emails in a disaster alert SaaS used by Japanese councils and police; a backdoor sent 1.42M phish.
CycloneDX formulation, added in 1.5, records how software was built: workflows, tasks, steps, inputs and environments. Fields, risks and a CI example.
MCP tasks let a server return a durable handle for slow tool calls that clients poll, update and cancel. How they work and how to secure task IDs.
IEC 62443-4-1 sets the secure development process an industrial product supplier must run. See its 8 practices, 4 maturity levels and how it is certified.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
