The Supply Chain Dilemma: Patch Fast for Vulnerabilities, Slow for Backdoors
jd_pressman · x · 2026-10-22
Jon Oberheide highlights the supply chain bind: dependencies are full of vulnerabilities (PHP, Node, eMudhra, etc.) so you must patch super fast, but they're also full of backdoors (LiteLLM), so patching too fast can pull in malicious updates.
JD Pressman builds on this: "just patch all the vulns" isn't sustainable medium term — mitigating supply chain attacks actually requires bringing patch rates way down. Together the posts point at the core contradiction in open-source dependency trust.
More from Safety
- Dev jokes that their SSL root cert's private key is just '5' — kuza55 · 2026-10-22
- GitLab hit by CVSS 10.0 unauthenticated RCE, patches shipped for releases back to 2014 — jd_pressman · 2026-10-22
- PHP Foundation timeline shows Calif, OpenAI, and Wiz all reported the same RCE — basedjensen · 2026-10-22
- Researcher warns GitLab flaw is 'really bad,' urges users to patch now — basedjensen · 2026-10-22
- RCE free-for-all feels like 2000 again, vet says, pointing to PHP2Shell race bugs — moyix · 2026-10-22
- Microsoft: Storm-0940 used agentic AI framework ARTEX to attack hundreds of orgs — basedjensen · 2026-10-22