Software Supply Chain Security

October 6, 2026

SSRF in Harbor Webhooks: Any User Can Reach the Server’s Cloud Credentials

• 

Igor Stepansky

September 28, 2026

PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels

• 
• 
• 

Nir Zadok, Moshe Siman Tov Bustan, Vitalii Chepurko

September 24, 2026

How MCP Is Bypassing a Decade of Cloud Security Best Practices

• 
• 
• 
• 

Moshe Siman Tov Bustan, Nir Zadok, Roni Bar, Vitalii Chepurko

September 14, 2026

Technical Analysis: Netty CVE-2026-75595, Next.js CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 & GitPython CVE-2026-78676

• 
• 

Nir Zadok, Moshe Siman Tov Bustan

September 8, 2026

CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox

• 
• 

Nir Zadok, Moshe Siman Tov Bustan

August 9, 2026

Shai-Hulud Outbreak Debrief: The Worm Evolves into MCP

• 

Moshe Siman Tov Bustan

July 28, 2026

OX Security Named a Sample Vendor Across Three Categories in the Gartner® Hype Cycle™ for Application Security, 2026

• 

OX Security

July 21, 2026

CVE-2026-59873: Decompression DoS Via Unlimited Input In node-tar, 90M Weekly Downloads Affected

• 
• 

Nir Zadok, Moshe Siman Tov Bustan

July 19, 2026

CVE-2026-3602: SQL Injection in IBM App Connect Enterprise Leads to Code Execution

• 
• 

Nir Zadok, Moshe Siman Tov Bustan

July 14, 2026

AsyncAPI npm organization compromised, 2M weekly downloads affected

• 

Moshe Siman Tov Bustan

July 12, 2026

Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials

• 

Moshe Siman Tov Bustan

July 9, 2026

Injectivelabs npm Package Hijacked, Impacting 87 Dependent Packages

• 

Moshe Siman Tov Bustan