Blog Home
Pie chart displaying number of artifacts that were analyzed by JFrog Secrets Detection by platform. DockerHub made up the biggest slice, with 5.78 million of the 8 million scanned artifacts.

JFrogโ€™s Advanced Security Scanners Discovered Thousands of Publicly Exposed API Tokens โ€“ And Theyโ€™re Active
October 20, 2022

Read our full research report on InfoWorld The JFrog Security Research team released the findings of a recent investigation wherein they uncovered thousands of publicly exposed, active API tokens. This was accomplished while the team tested the new Secrets Detection feature in the companyโ€™s JFrog Advanced Security solution, part of JFrog Xray.  The team scanned โ€ฆ

Read More

Prevent Inadvertent Software Supply Chain Exposures When Allowing Public Access to Private Registries
February 09, 2023

At JFrog, weโ€™re serious about software supply chain security. As a CVE Numbering Authority, our JFrog Security Research team regularly discovers and discloses new malicious packages and vulnerabilities posing a threat to development organizations. We know that in order to deliver trusted software on demand, you must have a secure software supply chain โ€” making โ€ฆ

Read More

Detecting Malicious Packages and How They Obfuscate Their Malicious Code
January 30, 2023

Wow! We made it to the last post in our Malicious Packages series. While parting is such sweet sorrow, we hope blogs one, two, and three provide insights into the havoc malicious packages cause throughout your DevOps and DevSecOps pipelines.  In the prior posts: We explained what software supply chain attacks are and learned the โ€ฆ

Read More

Enterprise Package Management for Everyone
October 25, 2022

Suppose you asked developers in the mid-2000s how they managed and compiled their binaries. Youโ€™d probably hear some anxiety-inducing answers (e.g., storing packages in git repositories or insecure file stores). Thankfully, organizations currently have various options for managing their first or third-party packages, dependencies, and containers. Different tools offer different levels of package support and โ€ฆ

Read More
Log4j Vulnerable Packages in Maven Central

Log4j Vulnerability Alert: 100s of Exposed Packages Uncovered in Maven Central
December 30, 2021

The high risk associated with newly discovered vulnerabilities in the highly popular Apache Log4j library โ€“ CVE-2021-44228 (also known as Log4Shell) and CVE-2021-45046 โ€“ has led to a security frenzy of unusual scale and urgency. Developers and security teams are pressed to investigate the impact of  Log4j vulnerabilities on their software, revealing multiple technical challenges โ€ฆ

Read More
Log4shell Vulnerability Explained

Log4j Log4Shell 0-Day Vulnerability: All You Need To Know
December 28, 2021

On Thursday, Dec 9th 2021, a researcher from the Alibaba Cloud Security Team dropped a zero-day remote code execution exploit on Twitter, targeting the extremely popular log4j logging framework for Java (specifically, the 2.x branch called Log4j2). The vulnerability was originally discovered and reported to Apache by the Alibaba cloud security team on November 24th. โ€ฆ

Read More

New Xray Features Enhance Workflows, Productivity and UX
October 21, 2021

The recently released JFrog Xray versions 3.31 & 3.32 have brought to the table a raft of new capabilities designed to improve and streamline your workflows, productivity and user experience.  The new features, detailed below, solidify Xray as the optimum universal software composition analysis (SCA) solution for JFrog Artifactory  thatโ€™s trusted by developers and DevSecOps โ€ฆ

Read More

SDLC Security: Itโ€™s Personal for JFrog
December 23, 2020

The SolarWinds hack, which has affected high-profile Fortune 500 companies and large U.S. federal government agencies, has put the spotlight on software development security โ€” a critical issue for the DevOps community and for JFrog. At a fundamental level, if the code released via CI/CD pipelines is unsafe, all other DevOps benefits are for naught. โ€ฆ

Read More

A Few Minutes More: Add Xray DevSecOps to Artifactory Enterprise on Azure
October 15, 2020

Editorโ€™s Note (2024): Please refer to the current JFrog Software Supply Chain Platform listing on Azure Marketplace to get started with JFrog on Microsoft Azure.   In a prior blog post, we explained how to install or update Artifactory through the Azure Marketplace in the amount of time it takes for your coffee order to arrive on โ€ฆ

Read More

Track JFrog Platform Performance with Datadog Analytics
July 20, 2020

Faithful operation of your JFrog Platform can be best assured by tracking usage data of Artifactory and Xray. With insights gained through real-time observability and log analytics, you can boost the efficiency of your DevOps pipeline and keep your software releases running joyfully. Datadog is a SaaS-based data analytics platform that is a popularly used โ€ฆ

Read More

Popular Tags