# News articles

## Pages

- [This Week in SBOMs: OpenSSH's musl Hole, APT Swaps Packages, and the CRA Reporting Platform Hits v1.3](https://sbomify.com/2026/11/06/this-week-in-sboms-2026-11-06/) (2026-11-06): SBOM news for 31 October to 6 November 2026: the OpenSSH 10.6p2 password bypass on musl systems (CVE-2026-123158), the APT man-in-the-middle flaw CVE-2026-109518, zlib 1.4 and libexpat 2.10.0, ENISA's SRP v1.3 and secure-update advisory, MAS's cryptographic inventory proposal, and a quiet week for SPDX, CycloneDX and PURL releases.
- [This Week in SBOMs: PHP2Shell Goes Live, Brotli Hides Behind Version Numbers, and Alpine's GitLab Scare](https://sbomify.com/2026/10/30/this-week-in-sboms-2026-10-30/) (2026-10-30): SBOM news for 24 to 30 October 2026: PHP2Shell added to CISA KEV and exploited in firewalls, the Brotli CVE-2026-111497 KEV entry and PHP's rebuilt Windows packages, the attempted GitLab exploit at Alpine Linux, a quiet week for the CRA and NIS2, NIST IR 8547 final, CISA 2030, and steady work on SPDX, CycloneDX and PURL.
- [This Week in SBOMs: PHP2Shell, a Wave of Poisoned Releases, ENISA's SBOM Advisory and Germany's CRA Law](https://sbomify.com/2026/10/23/this-week-in-sboms-2026-10-23/) (2026-10-23): A month of SBOM news, 22 September to 22 October 2026: the PHP2Shell RCEs, LiteLLM and other poisoned releases, compromised eMudhra CA keys, the ENISA Technical Advisory for SBOMs, national CRA implementation laws in Germany, Italy and France, ENISA SRP updates, NIS2 reporting reshaped by the Digital Omnibus, PURL and VERS approved by Ecma TC54, CycloneDX 2.0 proposals.
- [CISA's Minimum Elements now in Draft](https://sbomify.com/2025/08/23/cisa-minimum-elements/) (2025-08-23): Analysis of CISA's 2025 draft SBOM Minimum Elements update, adding required hash, license, and tool provenance fields to succeed the 2021 NTIA guidance.
- [Unpacking Raspberry Pi's Built‑In SBOM Magic](https://sbomify.com/2025/04/17/unpacking-raspberry-pi-s-built-in-sbom-magic/) (2025-04-17): How Raspberry Pi's rpi-image-gen tool generates SPDX SBOMs out of the box, achieving a 7.8/10 quality score with sbomqs for embedded image builds.
- [Exploring the Future of Software Security: Join Us at BSides Bristol](https://sbomify.com/2024/08/26/bsides-bristol/) (2024-08-26): sbomify presents 'Navigating the SBOM Landscape: Formats, Relevance, and Tooling in 2024' at BSides Bristol, covering SPDX, CycloneDX, and current SBOM tooling.
- [Get the latest SBOMs from the top 15 most popular images on Docker Hub](https://sbomify.com/2024/06/04/get-the-latest-sboms-from-the-top-15-most-popular-images-on-docker-hub/) (2024-06-04): Automated nightly SBOM generation for Docker Hub's top 15 images including nginx, postgres, redis, and node using Syft in GitHub Actions CI/CD pipeline.
- [Call for Views on the Code of Practice for Software Vendors: Ensuring Security and Resilience](https://sbomify.com/2024/05/26/call-for-views-on-the-code-of-practice-for-software-vendors-ensuring-security-and-resilience/) (2024-05-26): UK government launches consultation on voluntary Code of Practice for Software Vendors to enhance security and resilience of digital products sold to businesses.
- [What really happened to XZ?](https://sbomify.com/2024/04/13/what-really-happened-to-xz/) (2024-04-13): Analysis of the XZ backdoor discovery in Linux distributions, exploring how this supply chain attack worked and the implications for open-source security.

---

From sbomify: https://sbomify.com/categories/news/