Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A factual account of the 2024 polyfill.io incident, in which a widely embedded JavaScript CDN domain was acquired and began serving malicious code to a large number of websites.
A factual retrospective on the 2013 Target breach, in which attackers used credentials stolen from a third-party refrigeration contractor to reach the retail network and deploy point-of-sale malware.
A factual retrospective on the January 2003 SQL Slammer worm, which exploited a patched buffer overflow in Microsoft SQL Server and doubled in size every 8.5 seconds, disrupting internet infrastructure globally.
A factual look at Spring4Shell, the March 2022 remote code execution vulnerability in Spring Framework, including why its real-world impact was narrower than the initial Log4Shell comparisons suggested.
A factual retrospective on Stuxnet, the malware discovered in 2010 that targeted Siemens PLCs controlling uranium enrichment centrifuges, and why it reset expectations about targeted attacks on physical systems.
A factual explanation of the Spectre and Meltdown speculative execution side-channel vulnerabilities disclosed in January 2018, which affected processors from multiple vendors and could not be fully fixed in software.
A factual retrospective on the 2023 3CX desktop app compromise, notable because the attackers reached 3CX through a prior supply chain compromise of a different vendor, producing a chain of two linked attacks.
A factual retrospective on the 2021 Codecov Bash Uploader compromise, where attackers modified a widely used CI script to exfiltrate environment variables, including credentials, from thousands of build pipelines.
A factual account of the 2018 event-stream npm compromise, in which a new maintainer added a malicious dependency targeting a specific cryptocurrency wallet, and what it revealed about maintainer-trust risk.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
