Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2026-76460 affects Cisco Identity Services Engine and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2026-09-16.
CVE-2026-58704 affects Google Pixel and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2026-09-16.
A factual look at the July 2024 CrowdStrike Falcon content update that crashed millions of Windows hosts worldwide, and why an incident with no adversary belongs in any serious discussion of software supply chain risk.
A factual retrospective on the Marriott breach disclosed in 2018, where attackers had been present in the Starwood reservation system since 2014, two years before Marriott acquired the company.
A factual retrospective on Conficker, which exploited MS08-067 in late 2008, built a botnet of millions of hosts, and remained detectable on hundreds of thousands of machines many years after the patch shipped.
A factual account of the 2024 campaign against Snowflake customer accounts, which used credentials harvested by infostealer malware against accounts lacking multi-factor authentication, with no vulnerability in Snowflake itself.
A factual retrospective on Cloudbleed, a 2017 buffer overrun in Cloudflare HTML parsing that leaked adjacent memory, including other customers private data, into responses that search engines then cached.
A factual retrospective on the July 2001 Code Red worm, which exploited a buffer overflow in Microsoft IIS, infected hundreds of thousands of servers, and helped establish modern patch management as a discipline.
A factual account of the October 2021 ua-parser-js compromise, in which an attacker hijacked the maintainer npm account and published versions containing cryptominer and credential-stealing malware.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
