Sonatype's tests found that Java's blocked.certs rejected the listed certificate encodings but accepted re-encoded versions that still validated in the tested configurations. We reproduced the ...
PHP says all PHP installations serving web requests are at risk, with the highest risk in Apache configurations using mod_php. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations ...
Most agencies and contractors now have a generative AI (GenAI) policy. Far fewer can tell you what their people are actually running. That gap has a name. Like shadow information technology before it, ...
When a development team adds a dependency, it is placing trust in more than a file. The team expects the component to be what its coordinates say it is, the metadata to help its build tool resolve the ...
Browser protections were an important first response to the eMudhra certificate authority incident. But they don't answer a harder question for organizations: which other tools and environments still ...
Accelerate your DevOps pipelines and enterprise artifact management. Download Sonatype Nexus Repository for free and get started today. When you're ready to upgrade to Pro, we can migrate your ...
Sonatype identified 21,764 open source malware packages in Q1 2026, bringing the total logged since 2017 to 1,346,867. npm accounted for 75% of malicious packages this quarter. Trojans dominated, with ...
The Shai-Hulud Miasma campaign has a fresh series of malicious packages following the compromise of the czirker maintainer account, affecting both the RStreams and Leo Platform ecosystems. We have ...
Today, we've observed a software supply chain attack targeting npm maintainers' publishing credentials, followed by the rapid release of new versions carrying malicious payloads. To be clear, this is ...
Milestone: Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale: Sonatype Research Labs logged 149,329 open source malware ...
Coding agents now do much of the work of building software. They plan changes, edit files, add packages, run tests, and open pull requests. Somewhere in that loop, an agent decides which open source ...
At the end of Q2 2026, Sonatype Research reached 1.8 million malicious packages logged. In Q2, npm accounted for 96.6% of malicious package counts, with repository abuse and trojan-class activity ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results