supply chain security

Docker's advisory says account conversion reassigned personal access tokens to new owners from August 2024 until a September 30, 2026 fix; it reports no evidence of exploitation.

GitHub's October 12 changelog says it now records the authenticated pusher of each commit and adds a ruleset condition that blocks mismatched committers, in a limited public preview for Enterprise.

FINOS says its bank-backed OSERA alliance is operational, with six Premier members, a first patching standard and patches for 50-plus Spring and Java projects.

StepSecurity says two hijacked maintainer accounts, including Uber athenadriver's author, pushed a credential-stealing workflow to 345 repositories on October 8; Socket counts 500+ accounts.

In simulated cyber evaluations, GPT-6 Astra completed supply-chain attacks 29.2% of the time versus 6.3% for GPT-5.6 Sol, the UK's AI Security Institute reported.

A scan of 224 million public repositories found 543,699 working credentials; GitHub push protection cut protected-type leaks by 53 percent but 51.8 percent of live secrets fall outside it.

CVE-2026-90898 lets unauthenticated attackers execute arbitrary commands on Bifrost AI gateway servers via a single HTTP request; fixed in transports/v2.1.0.

Security firm Air Security found a zero-click flaw letting a plugin repository owner bypass commit-hash pinning in four AI coding agents.

The indexed-btree npm package evades npm v12's install-script blocking by hiding its malware loader inside a runtime method instead, Checkmarx reports.

The Rust security response working group and crates.io team warn that rust-lang members and popular crate owners are being lured into fake video calls to compromise their devices and accounts.

vlt, a JavaScript package manager built by npm's original developers, ships 1.0 with hosted registries that block malware and phased installs that stop scripts from running automatically.

CISA added CVE-2026-82329, a 9.8-severity Artifactory authentication bypass, to its exploited-vulnerabilities catalog days after JFrog patched it.