ReversingLabs

With artificial intelligence, trust isn’t what it used to be. AI is prodding security teams to move from static, binary, identity-based trust toward dynamic, probabilistic, behavior-based trust. They’re also adjusting to a shift in security from the component layer of applications to the data layer.AI pushes a meaningful portion of security risk up from static components — libraries, services, containers — and into the data and context the system consumes at runtime, said Christopher Jess, senio

In 2026, supply chain attacks took center stage. Thespring was a stormof open source packages being compromised into pushing malicious updates, infecting a variety of targets and causinguntold amounts of damages. Recently, two actors associated withTeamPCP were arrested. TeamPCP was responsible for many of the recent supply chain compromises, making this an apt time to reflect on those attacks. This retrospective covers attacks from late 2025 to present day, explains how and why they work — and

A longstanding security deficiency in the popular npm package manager — having the installation of scripts turned on by default — will be addressed in the next version of the software, expected to be released in July.The change, in version 12 of npm, meansthe commandnpm-installwill no longer execute preinstall, install, or postinstall scripts from dependencies unless they are explicitly allowed in a project,the npm team explained in a GitHub blog.For years, a single compromised package could run

In the space of a few years, software supply chain security has moved from a niche problem to a major threat and board-level concern for most companies. Every organization depends on software built from code, components, services and AI models created by people they’ll never meet and by organizations they’ll never be able to directly assess.That’s why as the CEO of ReversingLabs, I am thrilled that Gartner® has issued its inaugural Magic Quadrant™ for Software Supply Chain Security (SSCS) — and

It started with a phone call from a friend. He’d tried to log into his university’s Student Association website — a site he used constantly and trusted — and hit a strange CAPTCHA screen. Something felt off. He asked me to take a look.I did. Working with RL’s Spectra Analyze, I ran interactive dynamic analysis. What I found was a textbook ClickFix attack. The student site was compromised and used as a “watering hole” to draw in potential victims. Key to the attack was a pixel-perfect fake Google

Key takeawaysClaude Code Security uses AI reasoning to find logic-level flaws that rules-based SAST misses. Anthropic says it found 500+ overlooked vulnerabilities.It could sharply cut SAST false positives, which run from 68% to 91%.It only sees source code, so it misses deployed artifacts and supply chain attacks like SolarWinds and Log4Shell.It adds to a full AppSec program; it doesn’t replace one.Claude Code Security has attracted considerable attention because it brings AI reasoning directly

Key takeawaysTop mathematicians are moving into AI safety.Fields Medalist Jacob Tsimerman launched MAISI, and Turing winner Shafi Goldwasser co-founded RESI.Proofs can verify what AI does.Zero-knowledge proofs could confirm an agent’s actions and claims without exposing its model or data.Guarantees are only as good as their assumptions.The Hugging Face sandbox escape shows how easily reality can diverge from what a proof assumed.Hard limits beat universal proofs for now.Rules enforced outside th

For years, software supply chain security (SSCS) lived like a teenager in the basement of a bigger house. It was a line item inside the sprawling application security testing (AST) world — important, occasionally praised at dinner, but never quite trusted with its own keys. Everybody nodded along about software bills of material (SBOMs) and provenance the way you nod along about flossing.On June 17, the basement kid got the keys. Gartner published its very firstMagic Quadrant™ for Software Suppl