Blog Home

Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings
July 27, 2026

Just last week, OpenAI and Hugging Face jointly disclosed what may be the first incident of its kind: during an internal evaluation of frontier cyber capabilities, OpenAI’s models, running deliberately without production safeguards in an isolated research environment, autonomously discovered and employed chained vulnerabilities to escape its sandbox, reach the open internet, and extract evaluation …

Read More
NuGet typesquat attack - Thumbnail

The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results
July 21, 2026

The JFrog Security Research team has discovered and disclosed a typosquatted NuGet package named Newtonsoftt.Json.Net. Note the double t and the .Net suffix.  This package has been masquerading as the popular Newtonsoft.Json library while quietly shipping a trojanized fork. The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results …

Read More

Beyond Tokens SF: Best Ideas of the Evening
July 07, 2026

AI agents are changing how software gets built, but the infrastructure around them hasn’t caught up. Agents burn through tokens on noise. They take actions they shouldn’t. Context evaporates between releases. And most delivery pipelines were never designed for the pace and volume of agentic development. On June 11th we brought together developers in San …

Read More
JFrog Powers Kiro - 1200X628

Introducing the JFrog Power for Kiro
June 12, 2026

A new CVE drops into a package you depend on. With the JFrog power for Kiro installed, your next move is a single prompt in your IDE, not a tab switch to the JFrog UI and thirty minutes of hand-rolled REST calls. This is what governed agentic development looks like in practice. If your team …

Read More
Preparing for the CVE Blitz - Blog_Thumbnail (1)

Three Architectural Principles for Mythos & GPT-Cyber Readiness
May 11, 2026

Since Anthropic announced Project Glasswing and the capabilities of Claude Mythos Preview, and OpenAI announced  GPT-Cyber – my calendar has looked the same every day: Back-to-back calls with CISOs, AppSec leads, and security architects. And every call starts with the same question: “What do we need to do to prepare?” It’s the right question. But …

Read More

The Dependency Dilemma: Balancing Innovation Speed with Supply Chain Resilience
March 11, 2026

Sponsored by JFrog ~  Development teams are shipping faster than ever. Generative AI coding assistants, early agentic workflows, and increasingly modular architectures have compressed the distance between concept and deployment. AI-enabled innovation has become an executive mandate, and teams are expected to deliver at speed without sacrificing security or compliance. At the same time, modern …

Read More

From Silos to Synergy: Unifying Your Security Tools for a Stronger More Resilient Software Supply Chain
October 01, 2025

In the race to secure today’s ever-expanding attack surface, many companies have made a  practice of using a mix of tools to monitor, assess, and remediate threats. This practice has resulted in a fragmented and chaotic landscape of security solutions across several teams, increasing complexity and forcing companies to have a reactive vs. proactive security …

Read More
Benchmarking Application Security - 863x300

Why Cloudsmith Is a Risk You Can’t Afford: A Wake-Up Call on Superficial Software Supply Chain Security
June 24, 2025

On the surface, some tools market DevSecOps capabilities as part of their software supply chain solution. Still, DevOps and Security teams who dig deeper into these tools will quickly spot some red flags, including: Packaging Competitor’s Open Source as an Enterprise solution: Selling a paid “security” solution that’s little more than a thin UI layer …

Read More

Mitigating Image Integrity Violations: A Real-World Example in Runtime Environments
October 17, 2024

In the never-ending quest to speed up software release cycles, ensuring the security and integrity of application artifacts has never been more critical. As applications are continuously built, tested, and deployed, every element of the software pipeline—from source code to container images—needs to be trusted and verifiable. A key aspect of maintaining this trust is …

Read More
JFrog Runtime Announcement Thumbnail

JFrog Unveils First Runtime Security Solution to Deliver Complete Software Integrity and Lineage from Code to Cloud
September 10, 2024

When it comes to software supply chain security, we all do everything we can to prevent insecure software from being released into production. Hence we see software supply chain security shifting left to discover potential threats as early as possible in the software development lifecycle. But what happens when vulnerabilities are only discovered after an …

Read More

Popular Tags