Featured Article
Top 10 open source projects hit by HTTP/2 'Rapid Reset' zero-day
Introducing our 9th annual State of the Software Supply Chain report
5 minute read time
Sonatype announces the arrival of our 9th annual State of the Software Supply Chain report that explores open source security, industry trends, and more.
Read More...
Supply chain security inside and out
3 minute read time
Every organization needs to safeguard their SDLC. Take a look at two key aspects of ensuring external and internal security for your software supply chain.
Read More...
New design, new feature: Maven Central improvements for developers
2 minute read time
Hosted by Sonatype, Maven Central has a refreshed interface and new features to improve the developer experience.
Read More...
What is hashing? A look at unique identifiers in software
10 minute read time
Get a handle on software security with these odd-looking but very accessible tools to help sort good from bad on the internet.
Read More...
The shifting landscape of open source supply chain attacks - Part 3
12 minute read time
Brian Fox shares insights on who’s responsible for the security of software supply chains, and how orgs can minimize impact on efficiency and speed.
Read More...
Java serialization - The gift that keeps on taking (Part 2)
7 minute read time
Part two of our Java serialization series: the unexpected consequences of design and how the data stream can be compromised.
Read More...
NIST: Adopt a Secure Software Development Framework (SSDF) to Mitigate Risk of Software Vulnerabilities
2 minute read time
NIST recommends a SSDF framework to assess open source component cybersecurity risks, including an SBOM and automated security controls in the SDLC.
Read More...
What Does the New CVSS 3.1 Scoring Model Mean for Enterprise Security?
3 minute read time
Learn how CVSS 3.1 is different from earlier versions and why changes to this security rating matters.
Read More...
The “Big Hack” That Actually Happened - Chinese Military Implicated in Equifax Breach
3 minute read time
Members of the Chinese Military were implicated in the attack on Equifax's software supply chain. It's time to take software supply chain hygiene seriously.
Read More...