Supply Chain Malware in PyTorch Lightning — AI's Attack Surface
··1190 words·6 mins
A Dune-themed malware campaign targeting the PyTorch Lightning library highlights how AI/ML supply chains are becoming prime targets for sophisticated attacks.
- Osmond van Hemert — Senior Software Engineer & AI Product Builder/
- Blog Categories: AI, Security, Development & Infrastructure/
- Security Incidents, Vulnerabilities & Defense/
Security Incidents, Vulnerabilities & Defense
This category gathers posts where security is the main story: breaches, vulnerabilities, software supply-chain incidents, and the practical response to each. Use the articles below to examine how attacks work, what is known, and which defensive decisions follow from the evidence.
For incident timelines, visit Breaches & Zero Days. The Cybersecurity tag follows security themes across other categories too, including infrastructure and developer tooling.
The xz Utils Aftermath — One Year Later, What Have We Fixed?
··1213 words·6 mins
Nearly two years after the xz Utils backdoor shocked the open source world, the supply chain security landscape has changed — but not enough.
Software Supply Chain Security Gets Serious — SLSA and SBOM Rise
··1231 words·6 mins
Supply chain security frameworks like SLSA and SBOM requirements are moving from recommendations to mandates.
Post-Quantum Cryptography — The Migration Clock Is Ticking
··861 words·5 mins
NIST’s post-quantum cryptography standards are finalized, and the migration timeline is no longer theoretical — it’s operational.
Ultralytics Supply Chain Attack — Dependencies Bite Back
··969 words·5 mins
A supply chain attack on the popular Ultralytics YOLO package highlights the persistent vulnerability of the Python ecosystem’s distribution pipeline.
The Zero-Day Treadmill — Why Patch Tuesday Still Matters in 2025
··888 words·5 mins
November’s Patch Tuesday brought critical zero-days being actively exploited, reminding us that patch management is still the unglamorous foundation of
Secure by Design — CISA's Push Is Finally Gaining Real Traction
··865 words·5 mins
CISA’s Secure by Design initiative is moving from voluntary pledges to measurable industry impact, and software vendors are starting to feel the pressure.
EU ChatControl Is Back — And It's Still a Terrible Idea
··1074 words·6 mins
The EU’s latest push to scan encrypted messages reignites the fundamental debate about whether governments can mandate backdoors without destroying security
AWS re:Inforce 2025 — Cloud Security Gets Serious About AI
··891 words·5 mins
AWS re:Inforce 2025 puts AI workload security front and center, with new guardrails, identity controls, and data protection features that signal where cloud
NPM Supply Chain Attacks — The Problem That Won't Go Away
·1108 words·6 mins
Another wave of malicious npm packages reminds us that JavaScript’s dependency ecosystem remains one of software’s biggest security challenges.
The Spring 2025 Exploit Wave — Fortinet and Ivanti Under Fire
··977 words·5 mins
A surge of active exploitation targeting Fortinet and Ivanti edge devices highlights the persistent vulnerability of network perimeter infrastructure.
IngressNightmare — Critical Kubernetes NGINX Vulnerability Found
··1003 words·5 mins
CVE-2025-1974 and related vulnerabilities in the Kubernetes ingress-nginx controller allow unauthenticated remote code execution, affecting an estimated 40% of