# Spdx articles ## Pages - [This Week in SBOMs: OpenSSH's musl Hole, APT Swaps Packages, and the CRA Reporting Platform Hits v1.3](https://sbomify.com/2026/11/06/this-week-in-sboms-2026-11-06/) (2026-11-06): SBOM news for 31 October to 6 November 2026: the OpenSSH 10.6p2 password bypass on musl systems (CVE-2026-123158), the APT man-in-the-middle flaw CVE-2026-109518, zlib 1.4 and libexpat 2.10.0, ENISA's SRP v1.3 and secure-update advisory, MAS's cryptographic inventory proposal, and a quiet week for SPDX, CycloneDX and PURL releases. - [This Week in SBOMs: PHP2Shell Goes Live, Brotli Hides Behind Version Numbers, and Alpine's GitLab Scare](https://sbomify.com/2026/10/30/this-week-in-sboms-2026-10-30/) (2026-10-30): SBOM news for 24 to 30 October 2026: PHP2Shell added to CISA KEV and exploited in firewalls, the Brotli CVE-2026-111497 KEV entry and PHP's rebuilt Windows packages, the attempted GitLab exploit at Alpine Linux, a quiet week for the CRA and NIS2, NIST IR 8547 final, CISA 2030, and steady work on SPDX, CycloneDX and PURL. - [This Week in SBOMs: PHP2Shell, a Wave of Poisoned Releases, ENISA's SBOM Advisory and Germany's CRA Law](https://sbomify.com/2026/10/23/this-week-in-sboms-2026-10-23/) (2026-10-23): A month of SBOM news, 22 September to 22 October 2026: the PHP2Shell RCEs, LiteLLM and other poisoned releases, compromised eMudhra CA keys, the ENISA Technical Advisory for SBOMs, national CRA implementation laws in Germany, Italy and France, ENISA SRP updates, NIS2 reporting reshaped by the Digital Omnibus, PURL and VERS approved by Ecma TC54, CycloneDX 2.0 proposals. - [Announcing sbomify-action v26.9.0: The One That Runs on Every CI](https://sbomify.com/2026/09/24/announcing-sbomify-action-v26-9-0-the-one-that-runs-on-every-ci/) (2026-09-24): sbomify-action v26.9.0 gives TeamCity, Jenkins, CircleCI and Travis CI first-class support through a new CI platform subsystem, fixes the GitLab invocation we had published in every non-GitHub example, adds DOCUMENT_FILE for publishing PDFs and reports from a pipeline, and makes SPDX 3 documents survive a round trip intact. - [Announcing sbomify v26.9.0: The One That Speaks SPDX 3](https://sbomify.com/2026/09/24/announcing-sbomify-v26-9-0-the-one-that-speaks-spdx-3/) (2026-09-24): sbomify v26.9.0 makes SPDX 3 a first-class format end to end, ships a v2 API that calls things what the product calls them, adds a Helm chart for self-hosting on Kubernetes, puts certification badges and CSAF 2.0 discovery on the Trust Center, and rebuilds vulnerability browsing around a real findings table. - [SPDX 3.0 in Yocto: What Changed and Why It Matters](https://sbomify.com/2026/05/19/yocto-spdx-3-0-overview/) (2026-05-19): Part 3 of the Yocto SBOM series. SPDX 3.0 support arrived in Styhead (Yocto 5.1) with single-document JSON-LD output, first-class Build elements, native VEX support, and richer build provenance features. - [A Deep Dive into Yocto's SPDX 2.2 Pipeline](https://sbomify.com/2026/05/12/yocto-spdx-2-2-pipeline/) (2026-05-12): Part 2 of the Yocto SBOM series. How the create-spdx-2.2.bbclass produces SPDX documents during a Yocto build, the three core BitBake tasks involved, and the document-linking model that ties everything together. - [How Yocto Generates SBOMs Behind the Scenes: A Deep Dive into SPDX 2.2 and SPDX 3.0](https://sbomify.com/2026/05/05/yocto-sbom-deep-dive-introduction/) (2026-05-05): Yocto generates SBOMs during the build itself, not after. Part 1 of a 6-part series on how the Yocto Project builds SPDX 2.2 and SPDX 3.0 SBOMs from BitBake metadata, with first-class VEX support. - [PEP 770: SBOMs Are Now a First-Class Citizen in Python Packages](https://sbomify.com/2026/03/05/pep-770-sboms-in-python-packages/) (2026-03-05): Python's PEP 770 standardizes shipping SBOMs inside packages via .dist-info/sboms/. Here's what it means and how we adopted it in two projects with minimal effort. - [Announcing sbomify-action v0.14: The One With Yocto](https://sbomify.com/2026/03/02/announcing-sbomify-action-v0-14-the-one-with-yocto/) (2026-03-02): sbomify-action v0.14 adds a dedicated Yocto/OpenEmbedded batch processing command, full SPDX 3.0.1 pipeline support, pipdeptree integration for Python transitive dependencies, caching for faster CI runs, and renames from github-action to sbomify-action. - [Why We're Bullish on TEA, And Why You Should Be Too](https://sbomify.com/2026/03/01/why-were-bullish-on-tea/) (2026-03-01): The Transparency Exchange API (TEA) is the missing standard for automated SBOM discovery and exchange. Here's what it is, why it matters, and why sbomify is all in. - [Announcing sbomify v0.27: The One with TEA](https://sbomify.com/2026/02/24/announcing-sbomify-v0-27-the-one-with-tea/) (2026-02-24): sbomify v0.27 adds full Transparency Exchange API (TEA) support, SPDX 3.0 compatibility, scoped access tokens, and improved account management. - [Announcing sbomify v0.25: The One with Attestations](https://sbomify.com/2026/01/23/announcing-sbomify-v0-25-the-one-with-attestations/) (2026-01-23): sbomify v0.25 introduces GitHub Attestation verification via Sigstore/cosign, SPDX 2.3 export, product lifecycle tracking, and compliance badges. - [SBOM Formats Compared: CycloneDX vs SPDX](https://sbomify.com/2026/01/15/sbom-formats-cyclonedx-vs-spdx/) (2026-01-15): A practical comparison of CycloneDX and SPDX SBOM formats covering history, governance, field differences, tooling, compliance preferences, and when to use which. - [Unpacking Raspberry Pi's Built‑In SBOM Magic](https://sbomify.com/2025/04/17/unpacking-raspberry-pi-s-built-in-sbom-magic/) (2025-04-17): How Raspberry Pi's rpi-image-gen tool generates SPDX SBOMs out of the box, achieving a 7.8/10 quality score with sbomqs for embedded image builds. - [What's New in SPDX 3: Enhanced Referencing Capabilities](https://sbomify.com/2024/07/22/whats-new-in-spdx-3-enhanced-referencing-capabilities/) (2024-07-22): SPDX 3 draft introduces nested references, cross-document references, and improved relationship types to match CycloneDX capabilities for complex SBOM management. - [Exploring the New SPDX 3.0: A Game Changer for SBOMs](https://sbomify.com/2024/04/28/exploring-the-new-spdx-3-0-a-game-changer-for-sboms/) (2024-04-28): Overview of SPDX 3.0 improvements including enhanced compatibility, improved accuracy, streamlined automation, and broader software package support for SBOM generation. --- From sbomify: https://sbomify.com/tags/spdx/