Chainguard

Chainguard secures the foundation that banks build on to prevent AI-driven supply chain attacks.

Frontier AI is breaking cybersecurity. Chainguard helps banks protect their critical data from malware, zero-days, and CVE exploits.

ICYMI this week - Chainguard can now run our frontier model harness on your first party apps. Connect a repo and let it hunt. We've tuned this for deep searches and all findings are validated with real exploit chains in our sandbox environment. No false positives, a true deep scan on your code. Powered by Mythos 5.1 and available through the Anthropic Marketplace. It'll find issues in your code, your third-party code, and chains between all of it. We'll tell you how to remediate, deal with any upstream disclosures, and can run again after to be sure you've remediated. https://lnkd.in/g2Nx3xY6

If your supply chain defense only checks public sources, it can't see the malware nobody has reported yet, and that blind spot is bigger than most people assume. Resilient Cyber partner Chainguard just shared data from their Go and .NET beta. Their scanner returned malware verdicts on more than 5,000 packages, and over 10% of those had no match in any public source when they were caught. I've been saying for a while that we can't keep treating the software supply chain as a reactive problem. Attackers are using AI to scale their campaigns and make them more convincing, and if you only learn about a malicious package after it's been pulled into a build, you're always going to be a step behind. The control belongs earlier, stopping the bad package before anything pulls it in. That's the direction Chainguard is taking as Chainguard Libraries expands into Go and .NET in early access, scanning endpoints for malware and greyware and adding a configurable cooldown so brand new packages don't land in your environment the minute they're published. Check it out if Go or .NET are part of your stack https://lnkd.in/e5eF9jgD

Everyones worried about frontier models finding zero-days right now, but most teams were already way behind on plain old CVEs before any of this started. Ive run vuln management on some big codebases and the backlog is very real. The average enterprise is months behind on patches that have had fixes, advisories, and scanner coverage for years. This weeks Vulnerable U sponsor, Chainguard, is doing its part by sharing the threat intel theyve collected through Athena with the rest of the ecosystem. They’ve started publicly disclosing the zero-days theyve collected, validated, and remediated, and they put the patch files up on GitHub for anyone to grab. If youre a Chainguard Libraries customer you also get remediated artifacts you can swap straight into your apps. See how Chainguard is protecting everyone from zero days: https://lnkd.in/gY-WeB7z

A full commit SHA pin can still run an attacker's code. Yes, you read it right. Forks share their parent's object store, so a fork-only commit is reachable through the original project's name. SHA pinning checks validity, not provenance. Don't get me wrong: pinning to a SHA commit is still a good practice, but for today's threat landscape that is not enough to secure your CI/CD. The good news is that Chainguard Actions is now GA: actions rebuilt from verified source, hardened, and continuously re-evaluated. I talked a bit about this in this short video! I will also be running 2 webinars about the topic in the upcoming weeks. Two opportunities to learn about securing your GitHub Actions beyond SHA pinning! I'll share the links to both webinars in the comments. #GitHubActions #SupplyChainSecurity #DevSecOps