# Supply-Chain articles ## Pages - [This Week in SBOMs: OpenSSH's musl Hole, APT Swaps Packages, and the CRA Reporting Platform Hits v1.3](https://sbomify.com/2026/11/06/this-week-in-sboms-2026-11-06/) (2026-11-06): SBOM news for 31 October to 6 November 2026: the OpenSSH 10.6p2 password bypass on musl systems (CVE-2026-123158), the APT man-in-the-middle flaw CVE-2026-109518, zlib 1.4 and libexpat 2.10.0, ENISA's SRP v1.3 and secure-update advisory, MAS's cryptographic inventory proposal, and a quiet week for SPDX, CycloneDX and PURL releases. - [This Week in SBOMs: PHP2Shell Goes Live, Brotli Hides Behind Version Numbers, and Alpine's GitLab Scare](https://sbomify.com/2026/10/30/this-week-in-sboms-2026-10-30/) (2026-10-30): SBOM news for 24 to 30 October 2026: PHP2Shell added to CISA KEV and exploited in firewalls, the Brotli CVE-2026-111497 KEV entry and PHP's rebuilt Windows packages, the attempted GitLab exploit at Alpine Linux, a quiet week for the CRA and NIS2, NIST IR 8547 final, CISA 2030, and steady work on SPDX, CycloneDX and PURL. - [This Week in SBOMs: PHP2Shell, a Wave of Poisoned Releases, ENISA's SBOM Advisory and Germany's CRA Law](https://sbomify.com/2026/10/23/this-week-in-sboms-2026-10-23/) (2026-10-23): A month of SBOM news, 22 September to 22 October 2026: the PHP2Shell RCEs, LiteLLM and other poisoned releases, compromised eMudhra CA keys, the ENISA Technical Advisory for SBOMs, national CRA implementation laws in Germany, Italy and France, ENISA SRP updates, NIS2 reporting reshaped by the Digital Omnibus, PURL and VERS approved by Ecma TC54, CycloneDX 2.0 proposals. - [Announcing sbomify-action v26.9.0: The One That Runs on Every CI](https://sbomify.com/2026/09/24/announcing-sbomify-action-v26-9-0-the-one-that-runs-on-every-ci/) (2026-09-24): sbomify-action v26.9.0 gives TeamCity, Jenkins, CircleCI and Travis CI first-class support through a new CI platform subsystem, fixes the GitLab invocation we had published in every non-GitHub example, adds DOCUMENT_FILE for publishing PDFs and reports from a pipeline, and makes SPDX 3 documents survive a round trip intact. - [Announcing sbomify-action v26.8.0: The One That Went on a Diet](https://sbomify.com/2026/08/25/announcing-sbomify-action-v26-8-0-the-one-that-went-on-a-diet/) (2026-08-25): sbomify-action v26.8.0 cuts the container image from 515MB to 106MB by fetching verified, attested tool bundles on demand, ends silent SBOM quality downgrades, adds git submodule support, and introduces Clearly Cached, a caching proxy that makes ClearlyDefined license data actually usable from CI. - [What Is a Dependency in Software? A Beginner's Guide](https://sbomify.com/2026/01/29/what-is-a-dependency-in-software/) (2026-01-29): Learn what software dependencies are, the difference between direct and transitive dependencies, how dependency trees work, and how SBOMs document them. - [Software Supply Chain Management: Risks, Best Practices, and SBOM Integration](https://sbomify.com/2025/12/26/software-supply-chain-management/) (2025-12-26): Learn what software supply chain management is, how attacks like Log4Shell and XZ Utils exploit it, and how SBOMs provide visibility and risk reduction. - [What Is SLSA? Understanding Supply Chain Levels for Software Artifacts](https://sbomify.com/2024/08/17/what-is-slsa/) (2024-08-17): What is SLSA? The OpenSSF framework for software supply chain security defines three build levels for provenance and integrity. Learn how SLSA works, how it builds on in-toto, and how to adopt it with GitHub Actions. - [What Is in-toto? Securing the Software Supply Chain End to End](https://sbomify.com/2024/08/14/what-is-in-toto/) (2024-08-14): What is in-toto? The CNCF-graduated framework uses layouts, signed link metadata, and end-to-end verification to cryptographically prove every build step happened as intended. Learn how it underpins SLSA, GitHub attestations, and SBOM integrity. - [What Is Sigstore? Keyless Signing for the Software Supply Chain](https://sbomify.com/2024/08/12/what-is-sigstore/) (2024-08-12): What is Sigstore? The CNCF-graduated project makes cryptographic signing effortless with keyless signing via Fulcio, transparency logging via Rekor, and container signing via Cosign. Learn how Sigstore secures artifacts, SBOMs, and supply chains. - [Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)](https://sbomify.com/2024/06/11/framing-software-component-transparency-establishing-a-common-software-bill-of-materials-sbom/) (2024-06-11): Summary of NTIA's SBOM Framing document 2nd edition highlighting transparency, interoperability standards, and what to expect in the upcoming 3rd edition. - [What Is OpenSSF? Scorecards, SLSA, and the Open Source Security Ecosystem](https://sbomify.com/2024/04/25/openssf-and-openssf-scorecards-bolstering-open-source-security/) (2024-04-25): What is OpenSSF? The Open Source Security Foundation coordinates industry-wide efforts to secure open source software. Learn about OpenSSF Scorecards, how to run them, what they measure, and how they connect to SBOMs, SLSA, and supply chain security. - [What really happened to XZ?](https://sbomify.com/2024/04/13/what-really-happened-to-xz/) (2024-04-13): Analysis of the XZ backdoor discovery in Linux distributions, exploring how this supply chain attack worked and the implications for open-source security. - [NIST Cybersecurity Framework (CSF) 2.0: What It Means for Software Supply Chain Security](https://sbomify.com/2024/04/11/introducing-the-nist-cybersecurity-framework-csf-2-0/) (2024-04-11): A practical guide to NIST CSF 2.0, its six core functions including the new GOVERN function, and how SBOMs support CSF 2.0 implementation for supply chain risk management and vulnerability monitoring. - [SBOM Management for Software Vendors: A Complete Guide to sbomify](https://sbomify.com/2024/04/03/sbomify-a-paradigm-shift-for-software-vendors-in-sbom-management/) (2024-04-03): How software vendors use sbomify to generate compliance-ready SBOMs in CI/CD, enrich them with 11 data sources, attest with GitHub Actions, and share via Trust Center – all from an open source GitHub Action. - [Enhancing SBOM Management for Software Buyers with sbomify](https://sbomify.com/2024/04/03/enhancing-sbom-management-for-buyers-with-sbomify/) (2024-04-03): How sbomify helps CTOs and CISOs manage SBOMs from software vendors – with Trust Center access, vulnerability monitoring, license compliance, and SBOM hierarchy for complex supply chains. - [Demystifying SBOMs: The Backbone of Modern Software Security](https://sbomify.com/2024/04/03/demystifying-sboms-the-backbone-of-modern-software-security/) (2024-04-03): What is an SBOM? A Software Bill of Materials is a machine-readable inventory of every component in your software. Learn about SBOM formats (SPDX, CycloneDX), generation tools, vulnerability management, and compliance requirements. --- From sbomify: https://sbomify.com/tags/supply-chain/