Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A malicious SSH peer could deadlock a whole connection in Go's x/crypto/ssh. Both clients and servers are affected. Upgrade to v0.56.0 and rebuild.
On Windows, uv 0.12.7 to 0.12.17 could let a malicious wheel write files outside the environment, including onto PATH. Upgrade to 0.12.18 or later.
Two high severity Gradle advisories let a local user run code in another user's daemon over loopback. Shared build hosts are most at risk. Upgrade the wrapper.
PHP's 24 September releases fix 11 GHSA advisories, including an FPM IPv6 ACL bypass, TLS CN fallback and credential leaks on HTTP redirects. Here's how to triage.
rustls 0.23.46 fixes four advisories from 14 October, after a September fix in 0.23.45. Most need a specific feature or API. Here's how to tell.
Google's 8 Sept Android bulletin lists 178 CVEs and 30 Critical, including a Critical adbd fix and Linux kernel CVEs first published in April and June.
October's Android bulletin is small, 25 CVEs and 7 Critical, mostly in Bluetooth. It also restates that AOSP source now lands only in Q2 and Q4.
Between 1 Sept and 15 Oct Chrome shipped 11 desktop Stable updates, three new majors and 771 security fixes. Pinned headless Chrome in CI and render services falls behind fast.
Mozilla's 13 Oct releases fix 77 CVEs in Firefox 158 and 61 in ESR 153.5, including three Enterprise Policies bypasses and an Application Update privilege escalation.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
