Docker Hub now supports OpenID Connect for GitHub Actions. Workflows authenticate with short-lived, per-run tokens instead of storing PATs or OATs in GitHub secrets. Manual credential rotation is officially obsolete.
An unencrypted copy of the GPG key that signs Firefox and Thunderbird Linux downloads landed in an internal Git repository by mistake. Mozilla immediately revoked the key and began a full rotation — every Linux distribution packaging the browser must rebuild against the new key.
From TanStack to Trellix via GitHub Megalodon, the five biggest supply chain attacks of 2026 prove your attack surface extends to every npm install. Third-party risk management must become continuous — the annual questionnaire is dead.
On August 5, 2026, Novee Security demonstrated at Black Hat USA that a GitHub issue opened by an account with no write access was enough to execute arbitrary code on the CI runners behind Claude Code, Gemini CLI, and OpenAI Codex repositories. If your CI/CD pipeline executes code from GitHub issues without sandboxing, treat this as a CVE with no patch — yet.
As of August 1, 2026, GitHub automatically generates SLSA Build Level 3 attestations for every Actions workflow run on a public repository. The software supply chain becomes verifiable without effort — and regulatory compliance follows.
A new variant of the XCSSET malware compromises shared Xcode projects to infect compiled macOS applications. If you clone a repository from an infected developer, your final app ships the malware without a trace.
Manifold Security discovered 77 malicious extensions on the Open VSX marketplace between July 26 and August 1, 2026, exfiltrating Git metadata, CI variables, and development environment details. The attack proves that software supply chains no longer stop at code — they now include the IDE itself.
A self-propagating supply-chain attack named ChainDrop compromised over 1,300 packages on the npm registry on August 4, 2026. The infected packages accounted for 2 billion monthly downloads and reached organizations including Deliveroo, Qlik, and ServiceTitan. Audit your dependencies now.
EU Regulation 2024/2847, the Cyber Resilience Act, enters phased application starting in 2026. It requires every software vendor selling in the EU to produce a complete SBOM, fix known vulnerabilities within five business days, and notify critical incidents to ENISA within 24 hours. Here's what your organization must do before the first binding deadline.
On August 1, 2026, N-able detected active exploitation of an authentication bypass (CVE-2026-18577) in its N-central RMM platform. The fix for CVE-2026-18576 was incomplete, and attackers bypassed it in under thirty days. Here's what MSPs must do and why the RMM supply chain remains cybersecurity's weakest link.
Three attack waves in eighteen months — nullifAI, ShadowPickle, and a fake OpenAI repository — demonstrate that the AI supply chain is now the weakest link in production deployments. The fixes exist, but they require treating every downloaded model as an untrusted binary.
On 20 January 2026, the European Commission proposed a revamped Cybersecurity Act that mandates removing high-risk foreign suppliers from the EU’s telecom networks and ICT supply chains. Operators have three years to comply, with fines reaching 7% of global turnover.
On March 17, 2026, GitHub Enterprise Server 3.20 went GA with two structural security gates: releases are now immutable by default, and secret scanning gains enterprise-wide governance controls. Against a backdrop of escalating supply chain attacks, this release turns the forge into a fortress.
The SafePay ransomware group exfiltrated 8.5 terabytes of data from BPO giant Conduent between October 2024 and January 2025, exposing over 25 million individuals. It's the costliest supply chain breach of the year for US governments — and a wake-up call for any CISO who depends on a critical third party.
