Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A factual retrospective on Conficker, which exploited MS08-067 in late 2008, built a botnet of millions of hosts, and remained detectable on hundreds of thousands of machines many years after the patch shipped.
A factual account of the 2024 campaign against Snowflake customer accounts, which used credentials harvested by infostealer malware against accounts lacking multi-factor authentication, with no vulnerability in Snowflake itself.
A factual retrospective on Cloudbleed, a 2017 buffer overrun in Cloudflare HTML parsing that leaked adjacent memory, including other customers private data, into responses that search engines then cached.
A factual retrospective on the July 2001 Code Red worm, which exploited a buffer overflow in Microsoft IIS, infected hundreds of thousands of servers, and helped establish modern patch management as a discipline.
A factual account of the October 2021 ua-parser-js compromise, in which an attacker hijacked the maintainer npm account and published versions containing cryptominer and credential-stealing malware.
A factual retrospective on the 2022 LastPass breaches, where attackers used data from a first incident to target a DevOps engineer personal computer, ultimately obtaining encrypted customer vault backups.
A factual look at Follina, a 2022 Windows vulnerability abusing the MSDT protocol handler, which allowed code execution from a Word document without macros and therefore bypassed the standard defensive advice.
A factual look at Citrix Bleed, a 2023 buffer over-read in NetScaler appliances that leaked valid session tokens, allowing attackers to hijack authenticated sessions without credentials or a second factor.
Reviewing two decades of major incidents, the ones that defined early security were patch-adoption failures. A growing share of recent ones had no patch to apply, because the compromise was in the distribution chain itself. These need different defences.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
