Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A factual retrospective on the 2022 LastPass breaches, where attackers used data from a first incident to target a DevOps engineer personal computer, ultimately obtaining encrypted customer vault backups.
A factual look at Follina, a 2022 Windows vulnerability abusing the MSDT protocol handler, which allowed code execution from a Word document without macros and therefore bypassed the standard defensive advice.
A factual look at Citrix Bleed, a 2023 buffer over-read in NetScaler appliances that leaked valid session tokens, allowing attackers to hijack authenticated sessions without credentials or a second factor.
Reviewing two decades of major incidents, the ones that defined early security were patch-adoption failures. A growing share of recent ones had no patch to apply, because the compromise was in the distribution chain itself. These need different defences.
A factual account of the 2024 polyfill.io incident, in which a widely embedded JavaScript CDN domain was acquired and began serving malicious code to a large number of websites.
A factual retrospective on the 2013 Target breach, in which attackers used credentials stolen from a third-party refrigeration contractor to reach the retail network and deploy point-of-sale malware.
A factual retrospective on the January 2003 SQL Slammer worm, which exploited a patched buffer overflow in Microsoft SQL Server and doubled in size every 8.5 seconds, disrupting internet infrastructure globally.
A factual look at Spring4Shell, the March 2022 remote code execution vulnerability in Spring Framework, including why its real-world impact was narrower than the initial Log4Shell comparisons suggested.
A factual retrospective on Stuxnet, the malware discovered in 2010 that targeted Siemens PLCs controlling uranium enrichment centrifuges, and why it reset expectations about targeted attacks on physical systems.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
