Topic

Supply Chain Security: news, advisories and analysis

15 articlesUpdated 18 Oct 2026

CyberSecureToday covers Supply Chain Security across 15 articles published between 13 Sep 2026 and 18 Oct 2026. The coverage includes 9 vulnerability advisories, 3 incident or breach reports and 3 analysis or guidance pieces. 8 advisories are rated critical or high severity, and 2 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Supply Chain Security most often intersect with Remote Code Execution, HackerOne and Authentication Bypass, with Technology, Cloud & SaaS the most affected sector. The most recent story, “AWS Amplify CLI Prototype Pollution Flaw in Velocity Template Engine Enabled Local Code Execution”, was published 18 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSHigh
AWS Amplify CLI Prototype Pollution Flaw in Velocity Template Engine Enabled Local Code Execution
A prototype chain traversal flaw in AWS Amplify's velocity template engine allowed attackers with malicious VTL files to execute arbitrary local commands.
Aisha Noor18 Oct 202614 min read
Cyber AttackBanking & Fintech
R3 Artifactory Takeover Exposes Corda Enterprise and Central Bank Digital Currency Supply Chain
A critical default join key flaw in R3's JFrog Artifactory granted full administrative control over 269 repositories, including Corda Enterprise and CBDC builds.
Daniel Okafor18 Oct 202616 min read
ThreatsCloud & SaaSHigh
RubyGems Flaw in Gem Transfer Flow Allowed Organization Admins to Hijack Owner Rights and Evict Founders
A missing authorization boundary in RubyGems.org's gem transfer workflow enabled organization admins to invite attacker-controlled owners and evict founders.
Daniel Okafor18 Oct 202611 min read
Cyber AttackCloud & SaaS
International Airline Reports Network Intrusion Hitting Flight Dispatch and Crew Scheduling
SEC Form 8-K filing reveals an advanced persistent threat breached the corporate IT network of a major commercial airline, accessing flight dispatch and crew scheduling platforms.
Priya Raman9 Oct 20268 min read
Cyber AttackCloud & SaaS
Aerospace Defense Contractor Reports CAD Blueprint Theft via Compromised Engineering Portal
SEC Form 8-K filing reveals an advanced persistent threat exfiltrated sensitive aerospace engineering CAD designs and satellite propulsion telemetry.
Priya Raman9 Oct 20268 min read
InsightsCloud & SaaS
EU Cyber Resilience Act Enforces Mandatory Automated SBOMs and 24-Hour Flaw Disclosures for Connected Devices
The European Union Cyber Resilience Act enters critical enforcement phases, requiring hardware OEMs and software vendors to maintain machine-readable SBOMs and report actively exploited flaws within 24 hours.
CST Editorial Desk8 Oct 20268 min read
InsightsBanking & Fintech
EU NIS2 Directive 24-Hour Early Warning Mandate Enforced Across Critical Infrastructure Operators
The European Union's NIS2 Directive enforces strict 24-hour early warning notifications and executive liability for critical entities facing major cyber incidents.
CST Editorial Desk7 Oct 20268 min read
ThreatsCloud & SaaSHigh
Malicious PyPI Package Masquerades as vLLM Process to Exfiltrate Vector Database Weights (GHSA-rghm-9c3j-wc97)
A sophisticated typosquatted Python package targets AI engineering pipelines, masquerading as vLLM inference worker daemons to exfiltrate proprietary model weights.
CST Editorial Desk30 Sep 202610 min read
ThreatsCloud & SaaSHigh
Ollama GGUF Parser Integer Overflow Exposes AI Inference Servers to Memory Corruption
A critical integer overflow flaw CVE-2026-86289 in the Ollama GGUF model decoder allows attackers to trigger memory corruption and remote code execution on AI inference clusters.
Priya Raman25 Sep 202616 min read
ThreatsCloud & SaaSHigh
ORAS-Go Symlink Path Traversal Flaw Opens OCI Artifact Supply Chain to Compromise
A high-severity CVSS 8.8 path traversal vulnerability in oras-go allows malicious OCI container artifacts to escape extraction roots and execute arbitrary code.
CST Editorial Desk23 Sep 202616 min read
InsightsGov & Defence
EU NIS2 Directive Enforcement Mandates 24-Hour Incident Reporting and C-Suite Liability Across 18 Critical Sectors
The European Union enacts NIS2 Directive enforcement, establishing mandatory 24-hour incident notifications, personal C-suite liability, and strict supply chain audits.
CST Editorial Desk22 Sep 202617 min read
ThreatsCloud & SaaSCritical
Langflow Custom Component Code Validator Flaw CVE-2026-0768 Weaponized for Remote Code Execution Across AI Pipelines
Critical code validation bypass flaw CVE-2026-0768 in Langflow AI orchestration platform allows unauthenticated remote attackers to execute arbitrary system commands.
Mei-Lin Chen21 Sep 202616 min read
ThreatsCloud & SaaSCritical
SimpleHelp Remote Support Platform Critical Authentication Bypass CVE-2026-48558 in Active Attacks
CISA adds SimpleHelp remote support platform vulnerability CVE-2026-48558 (CVSS 9.8) to KEV catalog following active exploitation against enterprise networks.
Daniel Okafor17 Sep 202613 min read
ThreatsCloud & SaaSCritical
N-able N-central Critical Authentication Bypass CVE-2026-18577 Exploited in MSP Supply Chain Attacks
CISA adds N-able N-central vulnerability CVE-2026-18577 (CVSS 9.8) to KEV catalog following active in-the-wild exploitation against MSP management infrastructure.
Mei-Lin Chen17 Sep 202614 min read
ThreatsCloud & SaaS
GitHub adds a merge gate for pull requests with unresolved secret alerts
GitHub’s new ruleset can block pull-request merges until selected secret-scanning alerts are resolved, adding a review-stage guard beyond push protection.
Daniel Okafor13 Sep 20265 min read