Welcome to the JFrog Blog

FILTER BY

All
Products
Solutions
Other
JFrog Joins Rust Foundation as Platinum Member

JFrog Joins Rust Foundation as Platinum Member

The technology ecosystem is continually evolving but one truth remains, if there is a new and emerging coding language that captures the heart and minds of developers JFrog will be there. JFrog provides a DevOps Platform to store and secure its artifacts while engaging with the community and foundations that support developers using that language.…
The Software Supply Chain Risks You Need to Know

The Software Supply Chain Risks You Need to Know

Code that an organization’s developers create is only the beginning of modern software development. In fact, first-party code is likely to be only a small portion of an application – sometimes as little as 10% of the application’s artifact ecosystem. An enterprise’s software supply chain is made of many parts, accumulated from many sources: open…
Foundations and JFrog – Meeting Developers at the Source

Foundations and JFrog – Meeting Developers at the Source

TL;DR JFrog is a proud supporter of non-profit, technology foundations and consortiums that focus on helping developers advance the tech ecosystem. If there is one thing I know about JFrog it's that we are committed to developers and making software that enhances productivity, ingenuity and gives software creators the freedom to ‘set it and forget…
4 Operational Risks to Not Leave to Chance

4 Operational Risks to Not Leave to Chance

Not all of the recognizable risks in your software supply chain can be identified by their known vulnerabilities recorded as CVEs. A component that is outdated or inactive may present risks to your application that no one has had cause to investigate. Yet these components could still harbor threats. Security teams and developers must also…
JFrog Providers Support the Terraform Community

JFrog Providers Support the Terraform Community

If you’re reading this blog you’re probably at least somewhat familiar with Hashicorp Terraform and the value it brings to managing the deployment and provisioning of infrastructure resources at scale. We’re big fans and users of it ourselves here at JFrog (see how in our recent webinar!).   Terraform is one of the most, if…
CVE-2021-38297 – Analysis of a Go Web Assembly vulnerability

CVE-2021-38297 – Analysis of a Go Web Assembly vulnerability

The JFrog Security Research team continuously monitors reported vulnerabilities in open-source software (OSS) to help our customers and the wider community be aware of potential software supply chain security threats and their impact. In doing so, we often notice important trends and key learnings worth highlighting. The following analysis of a vulnerability discovered in the…
SATisfying our way into remote code execution in the OPC UA industrial stack

SATisfying our way into remote code execution in the OPC UA industrial stack

The JFrog Security team recently competed in the Pwn2Own Miami 2022 hacking competition which focuses on Industrial Control Systems (ICS) security. One of our research targets for the competition was the Unified Automation C++-based OPC UA Server SDK. Other than the vulnerabilities we disclosed as part of the pwn2own competition, we managed to find and…
Crashing Industrial Control Systems at Pwn2Own Miami 2022

Crashing Industrial Control Systems at Pwn2Own Miami 2022

Earlier this year, the JFrog Security research team competed in the Pwn2Own Miami 2022 hacking competition which focuses on Industrial Control Systems (ICS) security. We were proud to take part in this competition and join other researchers in the effort to make mission-critical industrial environments safe and secure. During the Pwn2Own Miami competition we competed…
swampUP 2022 is Going on the Road – Sign up for the Tour

swampUP 2022 is Going on the Road – Sign up for the Tour

Did you miss our info-packed keynote session at swampUP San Diego? Take a breath, swampUp is back and coming live to a city near you this October 2022. From New York to London to Munich, swampUP has you and your DevOps needs at heart. But, before you take the leap, what’s the 2022 swampUP city…
How To Put Cloud Nimble to Work to Segment Dev/Test from Production

How To Put Cloud Nimble to Work to Segment Dev/Test from Production

In every workplace, most work gets done at the most cluttered desks. Yet the business also requires an orderly front office to run efficiently. It’s much the same with your DevOps pipeline environments, as the rough and tumble process of innovating code must ultimately produce cleanly released applications. Continuous integration means that developers perform many…