Vulnerability Analysis
VMware ESXi CVE-2024-37085 Auth Bypass by Ransomware
CVE-2024-37085 abuses ESXi's AD domain join to grant admin via a specially named group. Exploitation by Akira and Black Basta, detection, and fix.
Feb 11, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Analysis
Apache OFBiz CVE-2023-51467: Authentication Bypass in Enterprise Resource Planning
CVE-2023-51467 bypassed a previous patch for an authentication flaw in Apache OFBiz, granting unauthenticated access to ERP functionality. A patch bypass that exposed critical business data.
Feb 10, 20266 min read
Vulnerability Analysis
The event-stream npm Attack Explained
In 2018, a hijacked npm maintainer account turned event-stream into a supply chain weapon against crypto wallets. Here's the full CVE-style breakdown.
Feb 10, 20267 min read
Vulnerability Analysis
The Codecov Supply Chain Attack Explained
A breakdown of the 2021 Codecov breach: how the Bash Uploader was compromised, what CI secrets were exposed, and the remediation steps teams need now.
Feb 10, 20268 min read
Vulnerability Analysis
The Kaseya VSA Ransomware Attack Explained
A deep dive into the 2021 Kaseya VSA supply chain ransomware attack: the CVE chain, CVSS/KEV context, full timeline, and remediation steps.
Feb 10, 20268 min read
Vulnerability Analysis
What is Spring4Shell
Spring4Shell (CVE-2022-22965) let attackers gain unauthenticated RCE on Java apps via Spring data binding. Here's the full breakdown and fix.
Feb 10, 20267 min read
Vulnerability Analysis
The left-pad npm Incident Explained
No CVE, no CVSS — just one unpublished package that broke the internet's build pipelines. Here's what left-pad still teaches security teams.
Feb 9, 20268 min read
Vulnerability Analysis
Apache Struts CVE-2023-50164: Critical File Upload RCE Echoes Equifax-Era Nightmares
A critical path traversal vulnerability in Apache Struts allowed RCE through file upload manipulation. The disclosure triggered flashbacks to the 2017 Equifax breach caused by a similar Struts flaw.
Feb 9, 20266 min read
Vulnerability Analysis
The clawdhub Malicious AI Agent Skills Campaign Explained
A coordinated supply-chain campaign poisoned 1,184+ ClawHub AI agent skills, stealing crypto wallets and SSH keys via CVE-2026-25253.
Feb 9, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.