Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Four vulnerabilities across three remote monitoring and management platforms confirmed as exploited between June and September 2026. RMM software's structural appeal to ransomware operators, explained through the actual mechanisms.
Five AI and ML orchestration platforms had vulnerabilities confirmed as exploited in the wild between July and September 2026 — Langflow twice, then MLflow, Ray, and Kestra. Five different root causes, one shared category.
NVD says 9.9. The vendor says 7.0. CVSS v4 says 6.3. Collapsing that to 9.9 does not make you conservative — it discards the disagreement, which was the most informative thing you had.
A CVE that needs Windows, a dev server, and a reachable port is not exploitable because a version matched. Cataloguing what each advisory actually requires turns a lockfile diff into an argument.
Exploitability is not a boolean. Collapsing it into one loses the only state that tells a developer what to do next — and quietly converts every unanswered question into a dismissal.
Lazarus used this afd.sys use-after-free to reach SYSTEM from a local foothold, then loaded a FudModule kernel rootkit. Escalation is never the objective — it is the step before it.
Progress Kemp LoadMaster's flaw lives inside escape_quotes(), the routine meant to neutralise dangerous input. It fails to null-terminate, turning a sanitiser into unauthenticated command injection.
An unauthenticated attacker sends a crafted object to TeamCity's agent polling endpoint and gets OS command execution as the server process. Every credential the build server holds sits downstream.
Langflow's auto-login endpoint mints a superuser token for anyone who asks. Its code-validation endpoint runs Python through exec(). Chained, that is unauthenticated RCE at CVSS 9.8.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
