Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A factual explanation of the Spectre and Meltdown speculative execution side-channel vulnerabilities disclosed in January 2018, which affected processors from multiple vendors and could not be fully fixed in software.
A factual retrospective on the 2023 3CX desktop app compromise, notable because the attackers reached 3CX through a prior supply chain compromise of a different vendor, producing a chain of two linked attacks.
A factual retrospective on the 2021 Codecov Bash Uploader compromise, where attackers modified a widely used CI script to exfiltrate environment variables, including credentials, from thousands of build pipelines.
A factual account of the 2018 event-stream npm compromise, in which a new maintainer added a malicious dependency targeting a specific cryptocurrency wallet, and what it revealed about maintainer-trust risk.
A factual retrospective on ProxyLogon (CVE-2021-26855 and related CVEs), a chain of Microsoft Exchange Server vulnerabilities exploited at scale in early 2021, compromising tens of thousands of organizations.
A factual retrospective on the May 2021 Colonial Pipeline ransomware attack, traced to a single compromised VPN account password with no multi-factor authentication, and its effect on U.S. critical infrastructure fuel supply.
A factual account of Alex Birsan’s 2021 dependency confusion research, which used public npm/PyPI/RubyGems packages matching internal company package names to execute code inside Apple, Microsoft, PayPal, and other major organizations.
A factual retrospective on the 2016 Uber breach, where attackers used credentials found in a private GitHub repository to access an AWS account holding rider and driver data, and how it was later concealed.
A factual retrospective on the 2018 British Airways breach, in which attackers injected a JavaScript card-skimming script into the airline's payment page, compromising roughly 380,000 transactions.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
