Mend.io Blog

Mend.io’s Stephanie Broyles Named to CRN’s 2026 Women of the Channel List

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

CVE-2026-31431 (Copy Fail): Linux Kernel LPE

Shai-Hulud Strikes SAP: Supply Chain Worm Weaponized Claude Code to Compromise the CAP Framework

The Butlerian Jihad: Compromised Bitwarden CLI Deploys npm Worm, Poisons AI Assistants, and Dumps GitHub Secrets

A Poisoned Xinference Package Targets AI Inference Servers

From Panic to Playbook: Modernizing Zero‑Day Response in AppSec

What Is SAST – Static Application Security Testing

Best Software Composition Analysis (SCA) Tools: Top Solutions in 2026

Anthropic’s Project Glasswing: What It Means for AppSec

Container Security Without Context Is Just More Noise

AI Application Security: 6 Focus Areas and Critical Best Practices

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install

Famous Telnyx Pypi Package compromised by TeamPCP

TeamPCP Supply Chain Attack Part 2: LiteLLM PyPI Credential Stealer

CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive