Safeguard on social

CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on 23 October: an unauthenticated command injection in the Nextcloud "Collabora Online - Built-in CODE Server" app (richdocumentscode). Web shells have been seen since at least 10 September. Fixed in richdocumentscode 26.4.303, and 26.4.402 is the current release. Standalone Collabora Online servers are not affected. It is a PHP component inside a Nextcloud deployment. Is it in your SBOM? How the bug works and how to check a server: link in bio (http://safeguard.sh/blog). #nextcloud #cisakev #sbom #appsec #supplychainsecurity

Before you add a dependency, look it up. Gold Open Source is free and needs no login. A package page shows the version Gold indexed, the known vulnerability count, a verification panel and an OpenSSF Scorecard grade. Then check the version against your pull request, read the license and look at the install scripts yourself. Full routine: link in bio, http://safeguard.sh/resources/blog #OpenSource #AppSec #DevSecOps #SupplyChainSecurity

A CISO needs one page to watch every week and one short pack for the board every month. In Safeguard that page is the Program Overview dashboard. Two tiles carry the most weight: known exploited vulnerabilities open in production, which the docs say should read zero, and time to remediate. Scheduled reports send a daily digest, a Monday executive summary and a monthly board pack as PDF plus JSON. Link in bio: http://safeguard.sh/resources/blog #CISO #AppSec #SupplyChainSecurity #BoardReporting

Your coding agents already emit telemetry. Send it to Safeguard. OpenAI Codex and Claude Code export OpenTelemetry. Safeguard shows sessions, tool decisions and results, model calls, tokens and cost, and raises AI detections in Detection & Response that your SOC can act on. The ingest token is send-only, prompt content is off by default, credentials are redacted on arrival. Setup guide: link in bio (http://docs.safeguard.sh/docs/integrations/otlp) #AISecurity #AppSec #DevSecOps #OpenTelemetry #ClaudeCode #Codex

Revocation alone does not fix a CA compromise. A stolen CA key can sign its own "good" answers, so replace certificates and remove the old CA from every trust store. Apps that ship their own CA bundle or pin a key ignore operating system trust store changes. Safeguard's SBOMs help you find them. Link in bio: safeguard.sh/resources/blog/ca-compromise-response-runbook-inventory-revoke-reissue

CVE-2026-113788 lets any Lagoon user run code through the core ssh service. Every release before 2.33.2 is affected, and 2.33.1 has no security fix. Fixed in 2.33.2 (lagoon-core chart 1.62.2, 25 August 2026). Workaround: disable the ssh service. No exploitation reported in the sources we checked. Safeguard's SBOM scan flags vulnerable components in your estate. Link in bio: http://safeguard.sh/resources/blog #Lagoon #CVE #Kubernetes #SupplyChainSecurity

The software you buy ships open source too. Atlassian's October security bulletin lists 75 unique CVEs, all in bundled third-party libraries such as Tomcat, Netty and Bouncy Castle. Know what is inside each vendor product and which version you run. Walkthrough: link in bio (http://safeguard.sh/resources/blog) #AppSec #SupplyChainSecurity #VulnerabilityManagement #SBOM

The maintainer has not shipped a fix for a dependency you use. There are two gaps: a fix that exists but has not reached your builds, and no fix at all. Swipe for the route: an SBOM per build, tested remediation pull requests (switched off until you turn them on), upstream first, then a fork and a hardened Gold build when upstream will not move. And the honest limit: vendor appliances, hosted services and operating systems you do not build still need the vendor's fix. Look up your top twenty dependencies free at http://gold.safeguard.sh. Full brief: link in bio (http://safeguard.sh/blog). #opensource #supplychainsecurity #appsec #sbom #devsecops

The router you forgot you own is part of your attack surface. ASUS fixed three High rated router flaws on 23 October. The CVE records list a firmware series and no fixed version. How many routers do you own, and do you know their firmware? Walkthrough: link in bio (http://safeguard.sh/resources/blog) #NetworkSecurity #VulnerabilityManagement #CVE #ITSecurity

Two separate exposures at Amadeus, the airline booking technology provider, surfaced in October 2026. Korean Air and Asiana cite misuse of a system account login. heise online found an unauthenticated Spring Boot heap dump. No source links the two. Five questions to ask any booking or SaaS vendor: which system accounts read our data, how credentials rotate, whether test environments hold real data, how many days of logs, and how many hours until they tell you. Link in bio: http://safeguard.sh/resources/blog #vendorrisk #thirdpartyrisk #appsec #cybersecurity

The Fix Window, Ep 5 is live: Three days: how fast to patch a bug that is already being used. Four facts from CISA's BOD 26-04 decide the clock: exposed or not, on the KEV catalog or not, automatable or not, partial or total control. Then a fast lane, a CI gate on known exploited CVEs, and six things to do this week. Mira, Cal and Theo are AI voices. The script is written by the Safeguard team. Link in bio: http://safeguard.sh/podcast #securitypodcast #appsec #vulnerabilitymanagement #devsecops

One mistyped package name, stopped before it lands. Safeguard's Package Firewall sits between your developers, your CI and the public registries for npm and pip, and blocks malicious, typosquatted and dependency confusion packages at install time. Start in audit mode, then enforce. Walkthrough and CLI commands: link in bio (http://safeguard.sh/resources/blog) #SupplyChainSecurity #AppSec #DevSecOps #npm #pip

Running Adobe Commerce or Magento Open Source? Patch CVE-2026-48356 (unrestricted file upload, CVSS 9.3) with Adobe's fix in APSB26-73. Then check pub/media/custom_options/ for files that are not real images, review admin users and rotate credentials if you find anything. Patching does not remove what an attacker already left behind. Safeguard inventories each store from its lock file and puts KEV listed findings first. Link in bio: safeguard.sh/resources/blog/adobe-commerce-magento-cve-2026-48356-kev-unrestricted-file-upload-what-to-patch-and-check

Don't let your security program depend on one model vendor. Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, the risk is any single provider. In Safeguard you pick the model per task: one OpenAI-compatible endpoint, change the id, not the integration. Bring your own model for Safeguard's AI features, or run Zero AI. Your model, your call (1/3). Link in bio: http://safeguard.sh/models/compare Claude is a product of Anthropic. ChatGPT is a product of OpenAI. #appsec #aisecurity #supplychainsecurity #devsecops

OpenSSL 3.4 lost upstream support on 22 October. 3.6 follows this Sunday, 1 November. Most servers on a distribution will be fine. The risk is the copies nobody counted: base images, language runtimes, vendored builds. On one Mac, the openssl command said 4.0.3 while Node reported 3.6.4. List every copy and its version, then move to a supported line: 3.5 LTS, 4.0 or 4.1. Guide and checker script: link in bio (http://safeguard.sh/resources/blog). #OpenSSL #AppSec #SBOM #DevSecOps

Three US software security dates are coming: CMMC Phase 2 on 10 Nov 2026, CISA BOD 26-04 timelines on 7 Dec 2026, Colorado AI developer duties on 1 Jan 2027. There is no single US SBOM law, but customers, sector rules and boards ask for one anyway. Swipe for the dates and a 90-day plan in three phases. Not legal advice. Link in bio: http://safeguard.sh/resources/blog #CMMC #SBOM #AppSec #SupplyChainSecurity #cybersecurity

One vendor breach, two universities. NEC says a company it outsources to was attacked, and valid accounts were misused against its customers. Your risk includes your vendors' vendors. Can you name every company that touches your systems or your data? Timeline from the official notices and questions for your vendors: link in bio (http://safeguard.sh/resources/blog). #ThirdPartyRisk #SupplyChainSecurity #CyberSecurity #VendorRisk

26 of the 68 advisories on the nginx security advisories page were fixed in releases shipped in 2026. Patch cadence is the easy part. The hard part is knowing which nginx build runs in each image and host, because distribution and container packagers set your patch timing. An SBOM turns that question into a lookup. Release history, advisory process and upgrade checklist: link in bio, http://safeguard.sh/resources/blog Counts as of 26 Oct 2026. #nginx #sbom #appsec #devsecops

Stolen GitHub tokens are being used to push one workflow file that prints repository secrets into the Actions log. Researchers count 13,500+ planted branches across 850+ accounts. GitHub's approval hold covers public repos on http://github.com. Private repos and GitHub Enterprise Server are not covered. Check today: ci-sync-* branches, who can edit workflows, token lifetimes, required reviewers on production secrets. Link in bio: http://safeguard.sh/resources/blog #GitHubActions #DevSecOps #CICD

28 October: Node 26 moves to LTS, and Node 27 starts its Alpha phase. A good day to check which Node line every service actually runs. Node 20 ended on 30 April 2026. Node 22 ends on 30 April 2027. The 21 October 2026 security release covered 26.x, 24.x and 22.x. List every service with its Node version, then find every place that version lives. Safeguard's SBOM lookup shows where a component and version sits across your estate. Release history, LTS lines and security releases: link in bio (http://safeguard.sh/blog). #nodejs #appsec #devsecops #softwaresupplychain

Most teams connect their code host and stop. Coverage is exactly as wide as the sources you add. Swipe for every card on Safeguard's Integrations page, grouped by family: source code, images, AI, uploads, and posture and testing. The last slide is the rollout order we suggest. Every card is generally available. Link in bio: http://safeguard.sh/resources/blog #appsec #devsecops #supplychainsecurity #sbom

A verified listing in the MCP Registry tells you who published it. Not who runs the endpoint. Safeguard is now in the official MCP Registry as http://sh.safeguard/safeguard. Before you connect an AI assistant to any MCP server: Pick by name, not title. Reverse the namespace. Match the endpoint to the vendor's own docs. Hosted server? Nothing to install. Full walkthrough: link in bio. #MCP #AppSec #AISecurity #DevSecOps #SupplyChainSecurity #CyberSecurity #AIAgents

CVE-2026-114625, a SQL injection in on-prem Arista VeloCloud Orchestrator, was added to CISA's Known Exploited Vulnerabilities catalog on 23 October. Three checks today: is it on-prem, is the build 5.2.3.18, 6.1.3.10, 6.4.2.12 or later, and is the web portal limited to admin networks with logs reviewed. Link in bio: http://safeguard.sh/resources/blog/arista-velocloud-orchestrator-cve-2026-114625-exploited #VeloCloud #CISAKEV #NetworkSecurity

You can hold about four things in mind at once. Some AI models hold a million tokens, word for word, with no hard line between your instructions and a stranger's web page. That's how a tool result or a web page ends up steering an AI agent. Guard what reaches the context, and keep the agent's tools narrow. Full post on http://safeguard.sh (link in bio). #AISecurity #PromptInjection #AIAgents #LLM #CyberSecurity #AppSec #MachineLearning #SecurityEngineering