Welcome to the JFrog Blog

Latest:

Introducing JFrog Threat Hub: Turning Vulnerability Intelligence into Blast Radius Analysis

November 10, 2026 Omer Buchnik, JFrog Senior Manager of Product Management

8 min read

A new supply chain attack hits the news. A CVE with a dramatic name starts trending. A malicious package turns up in npm, PyPI, and Hugging Face. Within minutes, your Slack channels fill up, your CISO wants an update, and someone asks the question every DevSecOps professional dreads: "How are we affected?" Providing a definitive…

Read More

All Blogs

bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot

bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot

November 3, 2026 Yuval Moravchick, JFrog Vulnerability Research Team Lead Natan Nehorai, JFrog Application Security Researcher | 18 min read

Software supply chain attacks are on the rise, and naturally taking the headlines. But with the rise of localized models and common software embedded into smart “things”, risks may even be hidden in plain sight - or, in some cases, quite literally watching you. Vulnerabilities and malicious packages may extend risks to the unlikeliest of…
Read More
Your Artifactory is fine. Your Linux kernel hosting it might not be.

Your Artifactory is fine. Your Linux kernel hosting it might not be.

November 2, 2026 Barak Haryati, JFrog Senior Director of Product Security | 6 min read

Summary As we've written, AI is shrinking the time between “a fix is public” and “someone has a working exploit” to near-zero. JFrog products are not affected by Linux kernel CVE-2026-98432. Artifactory, Xray, and the rest of the JFrog Platform do not contain this flaw, as it lives in the Linux kernel itself. We are…
Read More
“Are We Exposed?” What CISOs Need to Know About Their Software Risk

“Are We Exposed?” What CISOs Need to Know About Their Software Risk

October 30, 2026 Paul Davis, Field CISO | 6 min read

Recent events have once again highlighted the need to quickly answer the question, “Are we exposed?” We now face threats to businesses and governments from vulnerabilities and compromises in three fundamental components used in software development: Curl, PHP, and LiteLLM. Curl When it comes to Curl and its underlying transfer library libcurl, the threat can…
Read More
The Impact of AI on CVEs: Industry Challenges

The Impact of AI on CVEs: Industry Challenges

October 27, 2026 Tamir Friedman, JFrog Security Researcher Afek Berger, JFrog Security Researcher Aviv Engelberg, Frog Security Researcher | 10 min read

Integrating artificial intelligence into cybersecurity has fundamentally changed vulnerability research - and not necessarily for the better. For decades, discovering and verifying Common Vulnerabilities and Exposures (CVEs) required deep technical expertise, creating a disciplined process that kept disclosure volume relatively manageable. Today, Generative AI has obliterated that barrier to entry. While AI empowers seasoned security…
Read More
Scanning AI Assets: Catching What SCA and SAST Might Miss

Scanning AI Assets: Catching What SCA and SAST Might Miss

October 21, 2026 Or Cohen Naznin, JFrog Product Manager | 8 min read

Your standard application security tools are designed to protect your software pipeline by checking third-party components for known vulnerabilities (via SCA), analyzing source code for security flaws (via SAST), and scanning for accidentally exposed credentials (using secret scanners). But if a developer drops a SKILL.md file into their coding agent, installs a plugin from a…
Read More
Shadow AI Detection Now Extends to Developer Workstations

Shadow AI Detection Now Extends to Developer Workstations

October 21, 2026 Ohad Shalev, JFrog Product Marketing Manager, AI Security | 6 min read

ZIP files shared between co-workers containing new agent skills, locally-developed MCP servers passed between developers, and locally stored newly-minted agents are all seemingly harmless files that are commonly used in corporate software development environments. Unfortunately, far from being harmless, these locally stored files can contain AI assets that were never detected or registered as an…
Read More
Anthropic’s Free OSS Scanner: What It Means For Your Team

Anthropic’s Free OSS Scanner: What It Means For Your Team

October 16, 2026 Tal Zarfati, VP, Chief Architect at JFrog | 9 min read

On October 8, 2026, Anthropic announced OSS Scanner, a free, opt-in vulnerability scanning service for eligible open-source projects. The OSS Scanner is powered by their most capable models, including Claude Mythos. It scans codebases, identifies vulnerabilities, proposes patches, and sends reports directly to maintainers. As you read this, it has already identified real, high-severity issues…
Read More
Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown

Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown

October 16, 2026 The JFrog Team | 8 min read

At JFrog's swampUP 2026 conference in New York, security leaders gathered to tackle the rapidly evolving landscape of software supply chain security and AI-driven development. In this exclusive sit-down interview from the event, former SolarWinds CISO TIM (now CISO in Residence at Team8) sits with JFrog CISO Paul Davis and reflects on the historic 2020…
Read More
The Year the Vulnerability Backlog Changed Shape

The Year the Vulnerability Backlog Changed Shape

October 2, 2026 Paul Davis, Field CISO | 9 min read

As we enter the AI era, few among us have found themselves so entrenched in the throes of the shifting landscape as CISOs. With the threat landscape shifting, they are up against increasing rates of vulnerabilities and exploits alongside rapidly scaling demands for ever more secure environments. As CISOs, with our role as the protectors…
Read More
Governing the Agentic SDLC Through Continuous Policy Enforcement

Governing the Agentic SDLC Through Continuous Policy Enforcement

October 12, 2026 Carmit Hershman, JFrog Senior Software Architect, CTO Office Yuval Kainan, JFrog AI Architect, CTO Office | 14 min read

The way software gets built has changed faster than the standards that govern it. AI agents now create pull requests, select dependencies, refactor codebases, interpret test failures, and execute infrastructure changes across the entire Software Development Life Cycle (SDLC). AI agents are autonomous team members, but unlike human engineers, they are ephemeral: their reasoning, decisions,…
Read More

Popular Tags