Welcome to the JFrog Blog

Latest:

Scanning AI Assets: Catching What SCA and SAST Might Miss

October 21, 2026 Or Cohen Naznin, JFrog Product Manager

8 min read

Your standard application security tools are designed to protect your software pipeline by checking third-party components for known vulnerabilities (via SCA), analyzing source code for security flaws (via SAST), and scanning for accidentally exposed credentials (using secret scanners). But if a developer drops a SKILL.md file into their coding agent, installs a plugin from a…

Read More

All Blogs

Shadow AI Detection Now Extends to Developer Workstations

Shadow AI Detection Now Extends to Developer Workstations

October 21, 2026 Ohad Shalev, JFrog Product Marketing Manager, AI Security | 6 min read

ZIP files shared between co-workers containing new agent skills, locally-developed MCP servers passed between developers, and locally stored newly-minted agents are all seemingly harmless files that are commonly used in corporate software development environments. Unfortunately, far from being harmless, these locally stored files can contain AI assets that were never detected or registered as an…
Read More
Anthropic’s Free OSS Scanner: What It Means For Your Team

Anthropic’s Free OSS Scanner: What It Means For Your Team

October 16, 2026 Tal Zarfati, VP, Chief Architect at JFrog | 9 min read

On October 8, 2026, Anthropic announced OSS Scanner, a free, opt-in vulnerability scanning service for eligible open-source projects. The OSS Scanner is powered by their most capable models, including Claude Mythos. It scans codebases, identifies vulnerabilities, proposes patches, and sends reports directly to maintainers. As you read this, it has already identified real, high-severity issues…
Read More
JFrog Business Value Center: Celebrate the ROI of Your Software Supply Chain

JFrog Business Value Center: Celebrate the ROI of Your Software Supply Chain

October 15, 2026 Barry Spielman, JFrog Senior Product Marketing Manager Guy Rosenfeld, JFrog, Platform Product Manager | 7 min read

You already know the effectiveness of the JFrog Platform  - blocking risky packages, speeding up builds, securing the supply chain, providing end-to-end governance and so much more. But when it comes time to renew the license, a new VP may ask: "What are we actually getting in return?" or finance wants to understand the ROI:…
Read More
Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown

Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown

October 16, 2026 The JFrog Team | 8 min read

At JFrog's swampUP 2026 conference in New York, security leaders gathered to tackle the rapidly evolving landscape of software supply chain security and AI-driven development. In this exclusive sit-down interview from the event, former SolarWinds CISO TIM (now CISO in Residence at Team8) sits with JFrog CISO Paul Davis and reflects on the historic 2020…
Read More
Governing the Agentic SDLC Through Continuous Policy Enforcement

Governing the Agentic SDLC Through Continuous Policy Enforcement

October 12, 2026 Carmit Hershman, JFrog Senior Software Architect, CTO Office Yuval Kainan, JFrog AI Architect, CTO Office | 14 min read

The way software gets built has changed faster than the standards that govern it. AI agents now create pull requests, select dependencies, refactor codebases, interpret test failures, and execute infrastructure changes across the entire Software Development Life Cycle (SDLC). AI agents are autonomous team members, but unlike human engineers, they are ephemeral: their reasoning, decisions,…
Read More
The Year the Vulnerability Backlog Changed Shape

The Year the Vulnerability Backlog Changed Shape

October 2, 2026 Paul Davis, Field CISO | 9 min read

As we enter the AI era, few among us have found themselves so entrenched in the throes of the shifting landscape as CISOs. With the threat landscape shifting, they are up against increasing rates of vulnerabilities and exploits alongside rapidly scaling demands for ever more secure environments. As CISOs, with our role as the protectors…
Read More
The New Rules of Patching: When a Fix Becomes a Blueprint for Attackers

The New Rules of Patching: When a Fix Becomes a Blueprint for Attackers

September 28, 2026 Shachar Menashe, JFrog VP Security Research | 8 min read

TL;DR: Frontier AI has collapsed the vulnerability exploit window from weeks to mere hours. Attackers now use advanced AI models to reverse-engineer published fixes and generate working exploits faster than human security teams can deploy updates. In the AI era, publishing a patch creates a blueprint for attackers. Surviving this threat requires vendors to tier sensitive…
Read More
ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell

ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell

September 15, 2026 Yuval Moravchick, JFrog Vulnerability Research Team Lead | 9 min read

Your Mac runs a vulnerable version of Parallels Desktop. A malicious package, compromised CI job, or other unprivileged process is already running on it. No admin access. No Parallels-signed client. One appliance-install request later, attacker-controlled code runs as root. While testing Desktop 26.4.0 (build 57513) on Apple silicon, we found that an unprivileged local user…
Read More
JFrog Artifactory Supports LuaRocks Hosting for NGINX, OpenResty and Kong

JFrog Artifactory Supports LuaRocks Hosting for NGINX, OpenResty and Kong

September 16, 2026 Dean Lalezar, JFrog Product Manager | 6 min read

If your NGINX/OpenResty servers or Kong gateways pull Lua modules straight from public luarocks.org, one upstream outage can stall every build and deploy that depends on a “rock”. With LuaRocks support in JFrog Artifactory, you host and proxy those modules from a private LuaRocks registry you control, using the native experience you expect, not a…
Read More
Extending the Single Source of Truth to the Agentic Software Supply Chain

Extending the Single Source of Truth to the Agentic Software Supply Chain

September 2, 2026 The JFrog Team | 15 min read

Every developer on your team now runs multiple agents. None of them are waiting for human sign-off to act. That's exactly the gap we discussed and closed at swampUP 2026. JFrog unveiled new capabilities that extend the JFrog Platform as not only the Single Source of Truth for OSS and heritage software, but now the…
Read More

Popular Tags