Skip to content

// #dependency-management

3 articles

← All tags
💻 AppSec

Magento Extension Supply Chain Risk: CVE-2026-45247 and the Third-Party Plugin Attack Surface

CVE-2026-45247 in the Mirasvit Full Page Cache Warmer illustrates a structural security problem in the Magento ecosystem: eCommerce site security is determined not just by the core platform version, but by every third-party extension installed. This guide covers how to assess and reduce the Magento extension attack surface.

#magento +7
⚖️ Risk Mgmt

Nine CVEs in One Go Cryptography Library: What Mass Advisories in Open-Source Crypto Mean for Enterprise Risk Management

The nine-CVE golang.org/x/crypto advisory is the latest in a pattern of mass security advisories from widely used open-source cryptographic libraries. For enterprise risk managers, the recurring pattern raises questions about how dependency-level cryptography risk is assessed, tracked, and communicated — and whether current SCA tooling is adequate for the velocity of advisory publication.

#open-source +7
💻 AppSec

pnpm 11 Defaults to 24-Hour Package Age Minimum — Blocking Automated Post-Publish Supply Chain Attacks

pnpm 11, released this week, introduces a package quarantine feature that by default blocks installation of any npm package published within the past 24 hours. The control targets the automated post-publish compromise pattern used by TeamPCP, CanisterSprawl, and similar supply chain threat actors who publish malicious package versions and immediately trigger mass installation before defenders can respond. It is the most substantive supply-chain-defensive default configuration added to a package manager since npm's provenance attestation.

#pnpm +7

Commentary tagged #dependency-management

Opinion

Mass Open-Source Cryptography Advisories Are Becoming the New Normal — and the Industry Isn't Ready

The nine-CVE golang.org/x/crypto advisory follows a pattern that is accelerating: coordinated mass advisories in foundational open-source cryptographic libraries that affect thousands of downstream applications simultaneously. The industry's response tooling and processes have not kept pace with the advisory volume or the structural complexity of transitive dependency exposure.

CipherWatch Editorial

Security Intelligence Platform