JFrog · Company blog · 9.5 a month · 24 posts since Aug 24, 2026
Nov 3
Software supply chain attacks are on the rise, and naturally taking the headlines. But with the rise of localized models and common software embedded into smart “things”, risks may even be hidden in plain sight – or, in some cases, quite...
Nov 2
Summary As we’ve written, AI is shrinking the time between “a fix is public” and “someone has a working exploit” to near-zero. JFrog products are not affected by Linux kernel CVE-2026-98432.
Oct 30
Recent events have once again highlighted the need to quickly answer the question, “Are we exposed?” We now face threats to businesses and governments from vulnerabilities and compromises in three fundamental components used in software...
Oct 28
JFrog announced completion of the first-ever Software Supply Chain Excellence Awards, recognizing the teams who have turned their software supply chain into a competitive advantage – unifying development, security and operations around a...
Oct 27
Integrating artificial intelligence into cybersecurity has fundamentally changed vulnerability research – and not necessarily for the better.
Oct 21
ZIP files shared between co-workers containing new agent skills, locally-developed MCP servers passed between developers, and locally stored newly-minted agents are all seemingly harmless files that are commonly used in corporate software...
Oct 21
Your standard application security tools are designed to protect your software pipeline by checking third-party components for known vulnerabilities (via SCA), analyzing source code for security flaws (via SAST), and scanning for...
Oct 16
At JFrog’s swampUP 2026 conference in New York, security leaders gathered to tackle the rapidly evolving landscape of software supply chain security and AI-driven development.
Oct 16
On October 8, 2026, Anthropic announced OSS Scanner, a free, opt-in vulnerability scanning service for eligible open-source projects. The OSS Scanner is powered by their most capable models, including Claude Mythos.
Oct 15
You already know the effectiveness of the JFrog Platform – blocking risky packages, speeding up builds, securing the supply chain, providing end-to-end governance and so much more.
Oct 12
The way software gets built has changed faster than the standards that govern it. AI agents now create pull requests, select dependencies, refactor codebases, interpret test failures, and execute infrastructure changes across the entire...
Oct 2
As we enter the AI era, few among us have found themselves so entrenched in the throes of the shifting landscape as CISOs.
Oct 1
Over the past year, security leaders in software development have faced significant change. The Cloud Security Alliance reports that AI-assisted developers generate code commits three to four times faster than their peers but introduce...
Sep 28
TL;DR: Frontier AI has collapsed the vulnerability exploit window from weeks to mere hours. Attackers now use advanced AI models to reverse-engineer published fixes and generate working exploits faster than human security teams can deploy...
Sep 16
If your NGINX/OpenResty servers or Kong gateways pull Lua modules straight from public luarocks.org, one upstream outage can stall every build and deploy that depends on a “rock”.
Sep 15
Your Mac runs a vulnerable version of Parallels Desktop. A malicious package, compromised CI job, or other unprivileged process is already running on it. No admin access. No Parallels-signed client.
Sep 2
In a single morning, a coding agent can pull an open-source model, connect to an unvetted MCP server, and execute a code-optimizing skill from the web.
Sep 2
When an auditor asks what went into your last release, most teams do the same thing. They open four tabs: GitHub for commits Jira for tickets A Slack thread for the approvals A spreadsheet to track what made it to production (built two...
Sep 2
For decades, proving compliance meant having a person behind every decision – an engineer who remembered the approval, an auditor who could call someone and get an answer.
Sep 2
Every compliance audit starts the same way: Someone flags a deadline, the team scrambles to pull evidence, map controls, and prove that the policies running in production actually match what the framework requires. They make it through.
Sep 2
Live updates from this event have concluded. swampUP 2026 is officially LIVE in New York City! Three days, one stage, one mission: rebuild trust for a software supply chain that increasingly ships itself.
Sep 2
Every developer on your team now runs multiple agents. None of them are waiting for human sign-off to act. That’s exactly the gap we discussed and closed at swampUP 2026.
Aug 28
TLDR: “Preview” isn’t a lightweight version of GA, and it isn’t a beta with a new name on it. It just changes the timing and access.
Aug 24
The riskiest thing agents do all day isn’t writing code; it’s “shopping”. Every minute, they reach out to the internet for a package, a plugin, or an MCP server and consume them with no verification or guarantee of what’s inside.
JFrog's own blog, found on jfrog.com by the daily check; not reviewed yet.
Security (14), AI and agents (6), Product and company (2) in the last six months.
NameOct 27
From the Frog's mouth - JFrog Blog to JFrog Blog
CadenceOct 19
about weekly to several a week
CadenceOct 17
several a week to about weekly
CadenceOct 15
about weekly to several a week
CadenceOct 13
several a week to about weekly
FeedOct 5
failing to ok
FeedOct 3
ok to failing: the feed has no entries with a title, link and date
FeedOct 2
failing to ok
FeedSep 28
ok to failing: the feed has no entries with a title, link and date
Official checkSep 25
not reviewed to official: on jfrog.com
Blog addressSep 25
https://jfrog.com/blog/feed/ to https://jfrog.com/blog/
Blogsby Glyph