Loading story…
Government and industry leaders are intensifying efforts to address software supply chain security, with a particular focus on the adoption of Software Bills of Materials (SBOMs) and the potential for holding software vendors liable for security failures. In the United States, the push for SBOMs has been driven by federal policy, but private sector adoption remains slow, even as the rapid evolution of AI-assisted coding introduces new complexities and risks. Experts are divided on whether AI will reduce or exacerbate vulnerabilities, but there is consensus that transparency in software components remains critical for managing security risks.
In the United Kingdom, lawmakers are calling for significant regulatory changes, including introducing liability for software developers, incentivizing cyber resilience investments, and mandating incident reporting. These recommendations come in response to a series of high-profile cyber incidents, such as the attack on Jaguar Land Rover, which have underscored the economic and public risks posed by insecure software. The debate continues between industry groups, who warn that liability could stifle innovation, and security leaders, who argue that the current system leaves critical infrastructure and the broader economy exposed to escalating cyber threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are moving beyond traditional vulnerability management and treating software transparency as a core security requirement, with **Software Bills of Materials (SBOMs)** becoming central to software supply chain defense. Reporting on preparations for the EU **Cyber Resilience Act (CRA)** says manufacturers of products with digital elements will be required to create, maintain, and when necessary provide inventories of software components, driving broader adoption of SBOM tooling and automation. The shift is intended to improve visibility into open-source libraries and third-party dependencies so teams can identify vulnerable packages, assess supplier risk, and respond faster to newly disclosed flaws. Security practitioners are also pushing companies to use SBOMs as an operational tool rather than a compliance document. Group-IB researcher Anastasia Tikhonova said organizations should apply SBOM data continuously for vulnerability triage, vendor access reviews, identity monitoring, and incident response, as modern supply chain attacks increasingly link phishing, ransomware, and data breaches through inherited trust relationships. She warned that attackers’ use of AI is compressing attack timelines from weeks to minutes, increasing the need to prioritize exposed systems, define compromise windows, contain stolen credentials, and score vendor risk by access level and potential blast radius.
Jul 10, 2026
Governments in the US, UK, and EU are advancing major legislative and regulatory efforts to strengthen cybersecurity and resilience across critical sectors and software supply chains. The European Union’s Cyber Resilience Act (CRA) introduces requirements for software and connected product vendors to embed security from the design phase, manage vulnerabilities throughout the product lifecycle, and deliver rapid updates, with global implications for SaaS providers and technology companies. In the UK, the new Cyber Security and Resilience Bill aims to overhaul protections for critical national infrastructure, updating the NIS Regulations and addressing the growing threat from nation-state actors, as highlighted by recent disruptive attacks on healthcare and other essential services. In the United States, Congress has reauthorized the Cybersecurity Information Sharing Act (CISA 2015) through early 2026, restoring liability protections for organizations sharing threat intelligence with the federal government and sector-specific communities. However, the Cybersecurity and Infrastructure Security Agency (CISA) faces significant staffing shortages and capability gaps, prompting calls for increased funding and new strategies to address escalating cyber threats. Collectively, these legislative and regulatory actions reflect a global trend toward more robust, proactive, and coordinated approaches to cyber resilience and critical infrastructure protection.
Jun 29, 2026
Open-source software forms the backbone of much of today's digital infrastructure, powering browsers, applications, and critical business systems. Security leaders are increasingly aware of the risks associated with integrating open-source components into their environments, as vulnerabilities can be present even in widely used and actively maintained projects. A recent study by James Cusick at Ritsumeikan University compared the security of open-source and proprietary software by scanning millions of lines of code. The analysis revealed that large open-source projects like Chromium, despite their robust contributor communities, still contained over 1,400 potential issues, though only a few were deemed critical or high severity. In contrast, smaller open-source projects such as Genann exhibited a much higher density of potential issues, with one problem for every 27 lines of code. Proprietary software, while not immune, generally fell between these extremes, with most issues rated as medium or low severity. These findings highlight the importance of static code scanning and rigorous review processes for all software, regardless of its origin. The integration of open-source components without thorough vetting can introduce significant supply chain risks, as vulnerabilities may remain undetected and exploitable. In response to these challenges, regulatory frameworks like the European Union's Cyber Resilience Act (CRA) have been developed to enhance software security and transparency. According to Greg Kroah-Hartman, a leading Linux kernel maintainer and member of the CRA working group, the Act has evolved to be more accommodating to open-source developers. The CRA now requires producers of products with digital elements to document, secure, and maintain their software supply chains, including the generation of Software Bills of Materials (SBOMs) and proactive vulnerability management. While initial drafts of the CRA raised concerns among open-source communities about potential legal liabilities, subsequent revisions have made the regulations more palatable and beneficial for open-source contributors. Organizations like the Linux Foundation and Mozilla are required to comply with these rules, but individual contributors are generally exempt unless they are acting as commercial entities. The CRA aims to foster greater transparency and accountability in software development, ultimately benefiting both open-source and proprietary ecosystems. Security leaders are encouraged to adopt comprehensive code scanning and supply chain management practices to mitigate the risks associated with open-source software. The evolving regulatory landscape underscores the need for organizations to stay informed and proactive in addressing software security challenges. By combining technical diligence with compliance efforts, businesses can better protect themselves against the hidden risks inherent in modern software supply chains. The ongoing dialogue between regulators, open-source communities, and industry stakeholders is shaping a more resilient and secure digital environment for all.
Jun 29, 2026