News
This Week in SBOMs: OpenSSH's musl Hole, APT Swaps Packages, and the CRA Reporting Platform Hits v1.3
This is the third issue of This Week in SBOMs, covering Saturday 31 October to Friday 6 November 2026. Last week was about finding PHP and...
News
This Week in SBOMs: PHP2Shell Goes Live, Brotli Hides Behind Version Numbers, and Alpine's GitLab Scare
Welcome to the second issue of This Week in SBOMs, marking the first time we cover a standard seven-day period: Saturday 24 October to...
News
This Week in SBOMs: PHP2Shell, a Wave of Poisoned Releases, ENISA's SBOM Advisory and Germany's CRA Law
Welcome to the inaugural This Week in SBOMs, a weekly survey of developments within software security, regulation and standards, viewed...
Announcement
Announcing sbomify v26.9.0: The One That Speaks SPDX 3
If you generate SBOMs from an embedded Linux build, you have probably had a version of this experience with us: the document uploads,...
Announcement
Announcing sbomify-action v26.9.0: The One That Runs on Every CI
The action has always claimed to work on any CI system. That was true in the sense that it ran, and false in every sense that matters once...
Compliance
The CRA Single Reporting Platform Opens Tomorrow: What ENISA Actually Requires
Tomorrow, the Cyber Resilience Act’s reporting obligations stop being a date on a slide. From 11 September 2026, manufacturers of...
Announcement
Announcing sbomify v26.8.0: The One With Security Advisories
Most vulnerability tooling stops at the moment of discovery. You get a finding, a severity, maybe a fix version, and then you are on your...
Announcement
Announcing sbomify-action v26.8.0: The One That Went on a Diet
The headline number in this release is that the container image went from 515MB to 106MB. That is the fun part. The part that should...
Compliance
BSI TR-03183 Is Now Four Documents, and the CRA Clock Runs Out in Three Weeks
If you built your EU Cyber Resilience Act plan around a single BSI document, it is out of date. Not because the SBOM requirements changed,...
Announcement
Announcing sbomify v26.7.1: The One That Says "Not Affected"
An SBOM tells you what is in your software. A vulnerability scanner tells you which of those components have known CVEs. Neither answers the...
Compliance
ENISA's New Healthcare Procurement Guidelines Ask for SBOMs Without Saying the Word
In July 2026, the European Union Agency for Cybersecurity (ENISA) published its updated Procurement guidelines for the cybersecurity of...
Announcement
Announcing sbomify v26.7.0: The One That Gets Quantum-Ready
Most of the SBOM world is focused on one question: what software am I shipping? v26.7.0 adds a second question that is about to matter a...