Welcome to the JFrog Blog

All Blogs

JFrog Takes Software Resilience to the Next Level with 99.99% Uptime SLA

JFrog Takes Software Resilience to the Next Level with 99.99% Uptime SLA

Software delivery is no longer a back-office function; it’s the heartbeat of the modern enterprise. While a 99.9% uptime SLA for essential software delivery services works for many, the acceleration of software velocity has made the "three-nines" benchmark a possible liability. For high performing software organizations, and those delivering critical services, nine hours of annual…
From Prompt to Production: The New AI Software Supply Chain Security

From Prompt to Production: The New AI Software Supply Chain Security

Listen to a NotebookLM podcast version of the blog:   When Anthropic announced Claude Code’s new security scanning capabilities, following the announcement of OpenAI's Aardvark, it marked an important moment for the industry. For the first time, expert-level security review is becoming embedded directly into the act of writing code. Subtle, context-dependent vulnerabilities can now…
The Need for Clean in the AI Era

The Need for Clean in the AI Era

In the AI era, software and new models are being born at a breakneck pace—but they’re also bringing a lot of "baggage" into the world. While AI coding agents are busy accelerating innovation, they’re also excellent at generating a massive byproduct: “digital dust.” Between obsolete releases, orphaned dependencies, and massive model versions, your repository may…
Why I’m Finally Ditching YUM for DNF in 2026 (And You Should, Too)

Why I’m Finally Ditching YUM for DNF in 2026 (And You Should, Too)

If you’ve been managing Red Hat-based systems as long as I have, yum install is likely hardcoded into your muscle memory. For decades, YUM (Yellowdog Updater, Modified) served as the backbone of RPM Linux-based distributions, getting us through countless server setups and late-night patches. But the era of YUM is officially over. With RHEL 9,…
Vulnerability or Not a Vulnerability?

Vulnerability or Not a Vulnerability?

Disputed CVEs: It’s Not a Bug, It’s a Debate Every CVE starts as a vulnerability claim, but not every claim ends in agreement. Between researchers racing to disclose vulnerabilities, and open-source maintainers guarding the stability and reputation of their projects, a gray zone appears where “vulnerability” becomes a matter of debate. This is the story…
Giving OpenClaw The Keys to Your Kingdom? Read This First

Giving OpenClaw The Keys to Your Kingdom? Read This First

In security, we never assume perfection. We assume zero-trust, and we design controls to limit the blast radius. That mindset is missing from many OpenClaw deployments today. It is almost impossible not to hear about the new personal AI assistant, OpenClaw (formerly known as ClawdBot and MoltBot). Since its release in November 2025, it has…
Breaking AppSec Myths – Obfuscated Packages

Breaking AppSec Myths – Obfuscated Packages

As part of the JFrog Security Research team’s ongoing work, we continuously monitor newly published packages across multiple ecosystems for malicious activity. This effort serves the broader open source community through public research disclosures, and it directly impacts the detection capabilities behind JFrog Xray and JFrog Curation. Our scanning pipeline uses a broad set of…
The AI Blind Spot Debt: The Hidden Cost Killing Your Innovation Strategy

The AI Blind Spot Debt: The Hidden Cost Killing Your Innovation Strategy

In today’s AI rush, I’ve seen even the most disciplined organizations find it almost impossible to apply the hard-won lessons of DevOps and DevSecOps onto AI adoption. These organizations often feel forced to choose between moving fast and staying in control. As a result, they develop a "wait and see" approach to AI usage and…
The 282% ROI of Unified Security

The 282% ROI of Unified Security

We’re excited to share the findings of our commissioned Forrester Consulting Total Economic Impact™ (TEI) study, published in January 2026. This study examines the return on investment (ROI) that organizations realized by deploying a unified platform for managing and securing the software supply chain. Today, software supply chains are facing unprecedented pressure from surging open-source…
Dissecting and Exploiting CVE-2025-62507: Remote Code Execution in Redis

Dissecting and Exploiting CVE-2025-62507: Remote Code Execution in Redis

A recent stack buffer overflow vulnerability in Redis, assigned CVE-2025-62507, was fixed in version 8.3.2. The issue was published with a high severity rating and assigned a CVSS v3 score of 8.8. According to the official advisory, “a user can run the XACKDEL command with multiple IDs and trigger a stack buffer overflow, which may…