Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk

JFrog’s security research team continuously monitors open-source software registries, proactively identifying and addressing potential malware and vulnerability threats to foster a secure and reliable ecosystem for open-source software development and deployment. This blog details a PyPI supply chain attack technique the JFrog research team discovered had been recently exploited in the wild. This attack technique …

From MLOps to MLOops: Exposing the Attack Surface of Machine Learning Platforms

From MLOps to MLOops: Exposing the Attack Surface of Machine Learning Platforms

NOTE: This research was recently presented at Black Hat USA 2024, under the title “From MLOps to MLOops – Exposing the Attack Surface of Machine Learning Platforms”. The JFrog Security Research team recently dedicated its efforts to exploring the various attacks that could be mounted on open source machine learning (MLOps) platforms used inside organizational …

Out with the Old? Keeping Your Software Secure by Managing Dependencies

Out with the Old – Keeping Your Software Secure by Managing Dependencies

During 2023, the U.S. witnessed a record high in supply chain cyber-attacks, affecting 2,769 organizations. This figure represents the largest number recorded since 2017, marking an approximate 58% annual increase in impacted entities. If there ever was a doubt, now it’s crystal clear that YOUR SOFTWARE SUPPLY CHAIN IS A TARGET. Developers, DevOps and Security …

The Software Extinction Event That Wasn’t

Note: This blog post was previously published on DevOps.com Imagine if the world’s most pervasive programming language, used in the majority of organizations, services, websites and infrastructure today, was itself made to be malicious? Cybersecurity researchers from JFrog recently discovered a GitHub Personal Access Token in a public Docker container… due to the popularity of …

Accelerate Your Migration to JFrog SaaS with the AWS ISV Workload Migration Program

In the fast-paced, ever-evolving world of software development, the ability to seamlessly migrate and manage workloads on the cloud is a game changer. At JFrog, we’re committed to empowering organizations to achieve their DevOps, DevSecOps, and MLOps goals with speed, security, and efficiency. Migrating these workloads to the cloud offers numerous advantages, including increased scalability, …

CVE-2024-38428 Wget Vulnerability: All you need to know

On Sunday, June 2nd 2024, a fix commit was pushed for a vulnerability in GNU’s popular Wget tool. Two weeks later, the vulnerability was assigned the ID CVE-2024-38428 and later was classified as a critical vulnerability – with a CVSS score of 9.1.  In this blog, we take a dive deep into this threat by …

Mind the Gap: The Disconnect Between Execs & Developers

Note: This blog post was previously published on Hackeroon We surveyed 1,200+ technology professionals from around the globe, including 300+ VP and C-level executives, on their AI/ML usage and software supply chain security efforts. Upon analysis, a surprising gap emerged between what executives believe is happening and what developers and engineers report is happening. Here’s …

GitHub and JFrog Webinar Q&A

JFrog & GitHub Integration: Q&A on Implementation and Impact

The software development industry reacted with excitement to the news about the partnership between JFrog and GitHub and its potential impact on software development operations as covered in our online JFrog – GitHub Integration Tour. As VP of DevSecOps Research at IDC, Jim Mercer, commented “This announcement from GitHub and JFrog… brings together two of …

Meet JFrog’s Newest Board Member, Luis Felipe Visoso

We are honored to welcome Luis Felipe Visoso, current CFO of Unity Software Inc., to JFrog’s Board of Directors. With decades of financial leadership from Palo Alto Networks, AWS, Cisco, and Procter & Gamble, Luis brings invaluable global insights in cybersecurity, cloud, and enterprise software. We sat down with Luis to learn more about what …