All news with #sbom tag

🔍 In this analysis, the author argues that enterprises should avoid running separate bill-of-materials (BOM) programs for software, cryptography, AI models, authorization and runtime artifacts. Instead, organizations need a federated evidence graph that links domain-specific records via a common envelope and relationship semantics so incident responders can answer cross-cutting questions about affected products, exposure and remediation. The piece details standards, pilot steps and governance to ensure accuracy, trust and least-disclosure practices.

🔒 Red Hat's open-source security initiative Lightwell has remediated over 400 novel vulnerabilities across core Java libraries since launching in June. The company announced the general availability of the Lightwell Clearinghouse after a pilot phase, aiming to validate AI-generated reports and reduce noise for maintainers. Backed by IBM and supported by major financial institutions, Lightwell offers continuous signed binaries, SBOMs and a premium clearinghouse for targeted backports to production systems.

🔧 Over six months Chainguard doubled its output from 500 million to over 1 billion container build manifests, surpassing 3,000 images and 675,000 versions. The article explains what a build manifest represents and how Chainguard OS and Chainguard Factory produce continuous, reproducible artifacts with SLSA Level 3 provenance, Sigstore signatures, and SBOMs. It describes the transition from an event-driven Factory to Factory 2.0 (DriftlessAF), which uses continuous reconciliation, redundant work queues, and targeted AI to remove toil and accelerate rebuild velocity. The piece argues that faster rebuilds are essential to staying ahead of AI-enabled attackers and outlines future expansion and open sourcing of DriftlessAF.

🔍 Unit 42 details how supply chain attacks have escalated, shifting adversaries from finished applications to the developer tooling and CI/CD pipelines that build software. The report examines incidents like ChainDrop, Axios, and Shai-Hulud to show how malicious preinstall scripts, account hijacks, and memory scraping steal credentials and self-propagate. It argues that SBOMs alone are insufficient and recommends continuous visibility, execution controls, ephemeral CI servers, and short-lived credentials to stop autonomous malware.

🔍 Amazon Inspector’s SBOM Generator (inspector-sbomgen) now supports a plugin system that lets developers add custom package collectors without recompiling or waiting for official releases. The post explains how to scaffold plugins, the discovery-collection pipeline, testing with Lua fixtures, and IDE support for rapid iteration. It also details the sandboxed safety model, artifact tracing via source_path, and how plugin-generated components integrate with Amazon Inspector for vulnerability scanning.

🔒 Google Threat Intelligence Group and Mandiant outline recent trends in large-scale open source supply chain compromises observed in 2025–2026 and provide practical mitigation and hardening recommendations. The post highlights actor techniques such as repository compromise, malicious package injection, and abuse of CI/CD triggers, and emphasizes increased risk from AI-enabled workflows. It recommends inventories, SBOMs/ABOMs, SDLC threat modeling, active risk monitoring, and configuration controls to reduce exposure.

🔒 This article presents a blueprint for securing AI workloads on Google Kubernetes Engine (GKE), consolidating controls across Google Cloud services and GKE features to create a secure-by-default platform. It covers three layers—infrastructure, supply chain, and application—and details capabilities such as Confidential GKE Nodes, Workload Identity Federation, k8s-aibom for AI SBOMs, Model Armor, and the GKE Inference Gateway. The blueprint recommends a three-phase rollout: Deploy, Operate, and Govern, and emphasizes integrating Google Cloud controls to maintain security at enterprise scale.

🛡️ AWS Security Hub now offers an AI inventory that gives central security teams a continuously updated, organization-wide view of AI assets and their security posture. It automatically discovers AI workloads via managed-service integration, SBOM analysis for self-hosted workloads, and GuardDuty DNS telemetry for external API endpoints. Discovered assets are mapped to underlying infrastructure and correlated with security findings to help prioritize remediation. The feature is included with Security Hub Essentials at no additional cost and is available in all commercial AWS Regions where Security Hub is offered.

🔍 k8s-aibom is an unprivileged Kubernetes controller that continuously monitors cluster workloads to detect AI runtimes and generate standard CycloneDX 1.6 Machine Learning Bill of Materials (ML-BOMs). It runs as a single Deployment with zero developer friction—no sidecars, no privileged DaemonSets—and exports deterministic BOMs to in-cluster CRs and optional external sinks like Google Cloud Storage. Designed for audit-grade evidence, it supports compliance frameworks and GitOps workflows.

🛡️ Software supply chain security has evolved as AI tools and agents become integral to builds. What used to be a question of third‑party packages and transitive dependencies now includes models, agents, prompts, and autonomous tooling as provenance concerns. Teams must extend lineage to models and pipeline actions, and prioritize findings by actual exploitability to avoid alert overload. The discussion surfaces in a webinar on July 22 covering new research and practical program changes.

🔍 Insignary Clarity delivers binary-first analysis that inspects what is actually built, shipped, and deployed to produce accurate SBOMs and identify open-source components that never appear in manifests. The platform generates AIBOMs, performs reachability analysis to prioritize exploitable vulnerabilities, and provides continuous alerts by monitoring stored SBOMs against updated CVE sources. Insignary is cited across multiple Gartner reports and positioned to help organizations meet evolving global regulatory requirements for binary-verified SBOMs.

🔒 The Open Source Security Foundation (OpenSSF) warns of broad unfamiliarity and structural unreadiness for the EU Cyber Resilience Act (CRA), with 66% of surveyed manufacturers and developers reporting limited awareness. The report highlights confusion over applicability, deadlines, penalties and roles like manufacturers versus stewards, and notes low adoption of full Software Bills of Materials (SBOMs). OpenSSF also flags risky reliance on private forks and passive upstream dependence as potential compliance failures.

🛡️The EU Cyber Resilience Act (CRA) shifts focus from development practices to product safety, extending CE-like obligations to software, firmware, backend services and connected devices. It mandates SBOMs, minimum support lifecycles, and rapid reporting: organizations must have vulnerability and incident processes in place by Sept 11 and report exploited flaws within 24 hours, with full reports in three days. Many vendors and CIOs remain unprepared, particularly around automated SBOMs, open source obligations, and the wider conformity assessments the law introduces.

🔒 Kaspersky Container Security (KCS) is presented as a comprehensive platform that reaches beyond registry image scanning to secure container workflows across development and production. The Product Security Team uses KCS in CI/CD pipelines, registry correlation, and cluster runtime monitoring to tie findings to specific artifacts, pipelines, and scan times. KCS computes risk ratings, supports SBOM processing, and produces reports in SARIF, CycloneDX, SPDX and standard formats to integrate with AppSec and internal tooling.

🔍 A G7 Cybersecurity Working Group paper published on 12 May defines minimum elements for software bills of materials (SBOMs) tailored to AI systems, aiming to boost transparency across AI supply chains. It outlines seven clusters — Metadata, System Level Properties, Models, Dataset Properties, Key Performance Indicators, Infrastructure and Security Properties — to guide producers and users. The guidance stresses clusters are non-mandatory, that SBOMs alone are insufficient, and recommends linking SBOMs to vulnerability, advisory and tooling ecosystems.

🔍 The US Cybersecurity and Infrastructure Security Agency (CISA), working with G7 cyber partners, released supplemental minimum elements for an AI software bill of materials to document models, datasets, software components, providers, licenses, and other dependencies. The guidance extends traditional SBOM concepts into AI and is positioned to support procurement and vendor-risk assessments while remaining non‑exhaustive and non‑mandatory. Security teams should press vendors for model provenance, training and update practices, and runtime controls, but must recognize AI SBOMs provide visibility rather than assurance.

⚠️ TrueSec reports a malicious supply-chain compromise in the Python Package Index package litellm version 1.82.8. The published wheel contains a malicious .pth file named litellm_init.pth (34,628 bytes) that the Python interpreter executes automatically on every startup, without requiring any explicit import of the module. This behavior enables silent, persistent code execution on affected systems and increases the risk to downstream projects and production environments. The incident underscores the urgent need for SBOMs, SLSA, and SigStore adoption to harden supply-chain defenses.

🔒 Supply chain attacks now bypass traditional defenses by exploiting trusted vendors, open-source components, cloud services, and MSP tools, creating cascading impact across distributed environments. Map and inventory all dependencies, classify them by criticality, and continuously evaluate supplier posture using SBOMs, patch cadence, and incident response readiness. Apply Zero Trust controls: MFA, least privilege, segmentation, and just-in-time access, and centralize unified telemetry across endpoints, identity, network, email, and backups to detect anomalies faster. Finally, design recovery playbooks, immutable backups, and automated restore testing to shorten downtime when compromise occurs.

🔒 Supply chain security has shifted from a technical concern to a board-level business priority, driven by high-profile incidents and emerging regulation such as the European Cyber Resilience Act. CSOs must confront pervasive open-source risk—highlighted by Log4Shell—and adopt SBOMs, tooling and processes that reduce false positives. Automation, integration with developer workflows and rapid supplier communication are essential to limit fines and protect customer trust.

🔍 AWS announces general availability of AWS Transform custom's comprehensive codebase analysis transformation, delivering up-front deep static analysis that documents architecture, technical debt, code metrics, and migration plans to preserve institutional knowledge and reduce documentation overhead. The transformation supports any language — including Python, Java (Maven and Gradle), Node.js, and .NET — and scales to codebases exceeding one million lines. Behavior analysis is available in early access. To run it locally, install the AWS Transform CLI and execute: atx custom def exec -n AWS/comprehensive-codebase-analysis -p. The service is available in US East (N. Virginia) and Europe (Frankfurt).