#supply-chain — Public Fediverse posts

#Mozilla revoca la #chiave #GPG di #Firefox: rischio #supplychain, scatta l'allarme per #Linux

#uno

https://www.redhotcyber.com/post/mozilla-revoca-la-chiave-gpg-di-firefox-rischio-supply-chain-scatta-lallarme-per-linux/

#Mozilla revoca la #chiave #GPG di #Firefox: rischio #supplychain, scatta l'allarme per #Linux

#uno

https://www.redhotcyber.com/post/mozilla-revoca-la-chiave-gpg-di-firefox-rischio-supply-chain-scatta-lallarme-per-linux/

Security researchers report the “Shai-Hulud” npm worm variant “ChainDrop” poisoned 444 packages, spreading via tarballs and stealthy dev-tool hooks that trigger when opening infected branches in VS Code/Claude. It can harvest write-privileged npm tokens + credentials, then republish itself. 🐛🔒 #SupplyChain #Npm https://www.theregister.com/security/2026/08/15/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses/5287958

Security researchers report the “Shai-Hulud” npm worm variant “ChainDrop” poisoned 444 packages, spreading via tarballs and stealthy dev-tool hooks that trigger when opening infected branches in VS Code/Claude. It can harvest write-privileged npm tokens + credentials, then republish itself. 🐛🔒 #SupplyChain #Npm https://www.theregister.com/security/2026/08/15/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses/5287958

How Cyclospora Evaded the U.S. Food Safety System to Sicken Thousands

https://web.brid.gy/r/https://www.nytimes.com/2026/08/15/health/cyclospora-invesigation-fda.html

How Cyclospora Evaded the U.S. Food Safety System to Sicken Thousands

https://web.brid.gy/r/https://www.nytimes.com/2026/08/15/health/cyclospora-invesigation-fda.html

[#TRADESHOW] #Fenestration #BAU #China 2026 will be held from October 28 to 30, 2026, at China #International #Exhibition #Center Shunyi Hall in #Beijing. As the #Asia-#Pacific’s premier #trade #expo for #windows, #doors, #facades, and #building envelope technologies, the #business #event serves as a major #B2B #platform for #innovation, #sourcing, and #industry exchange across the full fenestration #SupplyChain. https://cnbusinessforum.com/event/fenestration-bau-china-2026/

[#TRADESHOW] #Fenestration #BAU #China 2026 will be held from October 28 to 30, 2026, at China #International #Exhibition #Center Shunyi Hall in #Beijing. As the #Asia-#Pacific’s premier #trade #expo for #windows, #doors, #facades, and #building envelope technologies, the #business #event serves as a major #B2B #platform for #innovation, #sourcing, and #industry exchange across the full fenestration #SupplyChain. https://cnbusinessforum.com/event/fenestration-bau-china-2026/

[#TRADESHOW] 2026 #China (#Guzhen) #International #Lighting #Fair will be held from October 22 to 25, 2026, at Guzhen #Convention and #Exhibition #Centre in #Zhongshan. As a leading lighting #trade #show in #China, the #business #event serves as a major #B2B #platform for lighting #products, #LED technologies, #smart #home solutions, and related #furnishings across the #global lighting #SupplyChain. https://cnbusinessforum.com/event/2026-china-guzhen-international-lighting-fair/

[#TRADESHOW] 2026 #China (#Guzhen) #International #Lighting #Fair will be held from October 22 to 25, 2026, at Guzhen #Convention and #Exhibition #Centre in #Zhongshan. As a leading lighting #trade #show in #China, the #business #event serves as a major #B2B #platform for lighting #products, #LED technologies, #smart #home solutions, and related #furnishings across the #global lighting #SupplyChain. https://cnbusinessforum.com/event/2026-china-guzhen-international-lighting-fair/

@velliajs/discord (npm) contains CRITICAL malicious code in versions 1.0.3 – 1.0.7: hardcoded GitHub PATs enable remote code execution & a hidden kill-switch disables bots unless allow-listed. Remove & audit now. No CVE. Details: https://radar.offseq.com/threat/malicious-code-in-velliajsdiscord-npm-7547c8c4c481ae98 #OffSeq #npm #infosec #supplychain

Apple's plan to source memory chips from Chinese firms CXMT and YMTC faces opposition from the U.S. government due to national security concerns. The administration urges Apple to find alternative solutions, reflecting the ongoing tension between supply chain needs and geopolitical factors in tech manufacturing.

#Apple #MemoryChips #SupplyChain #NationalSecurity #TechNews #USChinaRelations

https://thedailytechfeed.com/us-commerce-secretary-opposes-apples-use-of-chinese-memory-chips/

DecryptAds, built by Svart Works Inc., turns hidden ad supply chains into public insight 📊🧩 It maps ads.txt/app-ads.txt plus sellers.json/buyers.json/adagents.json, surfaces geographic risk, and flags quiet removals. Researchers and enterprises use a REST API + MCP server. 🔍 https://decryptads.com/ #adtech #supplychain #transparency

https://infosec.exchange/@briankrebs/117094507707502754

This is friggin amazing 🤩

DecryptAds, built by Svart Works Inc., turns hidden ad supply chains into public insight 📊🧩 It maps ads.txt/app-ads.txt plus sellers.json/buyers.json/adagents.json, surfaces geographic risk, and flags quiet removals. Researchers and enterprises use a REST API + MCP server. 🔍 https://decryptads.com/ #adtech #supplychain #transparency

https://infosec.exchange/@briankrebs/117094507707502754

This is friggin amazing 🤩

#LiteLLM-Angriff: Mehr als 2500 Unternehmen betroffen | Security https://www.heise.de/news/LiteLLM-Angriff-Mehr-als-2500-Unternehmen-betroffen-11412654.html #SupplyChain #Datenleck #DataLeak #Datenschutz #privacy

#LiteLLM-Angriff: Mehr als 2500 Unternehmen betroffen | Security https://www.heise.de/news/LiteLLM-Angriff-Mehr-als-2500-Unternehmen-betroffen-11412654.html #SupplyChain #Datenleck #DataLeak #Datenschutz #privacy

Trump’s Sweeping New Drone Tariffs Target China and Reshape Global Supply Chains — Here’s What’s Next

Full story 👇

Learn more: https://www.earthinsider.in/2026/08/trump-drone-tariffs-china-supply-chains.html

#EarthInsider #EarthInsiderNews #EINews #US #America #USNews #USPolitics #DroneTariffs #SupplyChain #ChinaTrade #BreakingNews #Trending

[#TRADESHOW] #China #Ningbo #International #Auto #Parts and #Aftermarket #Fair (#CAPAFAIR) 2026 from August 12 to 14, 2026, at Ningbo International #Convention and #Exhibition #Center. #Event serves as a major #B2B #business #sourcing #platform for #global #buyers, #importers, #exporters, and #SupplyChain professionals. Fair brings together #manufacturers, #industrial clusters, and service #providers across the full #automotive supply chain. https://cnbusinessforum.com/event/china-ningbo-international-auto-parts-and-aftermarket-fair-capafair-2026/

[#TRADESHOW] #China #Ningbo #International #Auto #Parts and #Aftermarket #Fair (#CAPAFAIR) 2026 from August 12 to 14, 2026, at Ningbo International #Convention and #Exhibition #Center. #Event serves as a major #B2B #business #sourcing #platform for #global #buyers, #importers, #exporters, and #SupplyChain professionals. Fair brings together #manufacturers, #industrial clusters, and service #providers across the full #automotive supply chain. https://cnbusinessforum.com/event/china-ningbo-international-auto-parts-and-aftermarket-fair-capafair-2026/

Scorte LME quasi esaurite: perché l’alluminio rischia una crisi di liquidità
https://www.metallirari.com/breakingnews39/
#Alluminio #Aluminium #LME #LondonMetalExchange #Metalli #MateriePrime #Commodities #Mercati #SupplyChain #Russia #Iran #Geopolitica #Industria #Prezzi #Trading #MetalliIndustriali #Economia #GlobalMarkets

Apparently, it takes less than an hour to get a massive amount of credentials.

Terabytes of credentials leaked in massive supply-chain attack

https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/

#Credentials #Leak #Vulnerability #AI #LiteLLM #SupplyChain #Security #Tech

Apparently, it takes less than an hour to get a massive amount of credentials.

Terabytes of credentials leaked in massive supply-chain attack

https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/

#Credentials #Leak #Vulnerability #AI #LiteLLM #SupplyChain #Security #Tech

[#TRADESHOW] #Fenestration #BAU #China 2026 will be held from October 28 to 30, 2026, at China #International #Exhibition #Center Shunyi Hall in #Beijing. As the #Asia-#Pacific’s premier #trade #expo for #windows, #doors, #facades, and #building envelope technologies, the #business #event serves as a major #B2B #platform for #innovation, #sourcing, and #industry exchange across the full fenestration #SupplyChain. https://cnbusinessforum.com/event/fenestration-bau-china-2026/

[#TRADESHOW] #Fenestration #BAU #China 2026 will be held from October 28 to 30, 2026, at China #International #Exhibition #Center Shunyi Hall in #Beijing. As the #Asia-#Pacific’s premier #trade #expo for #windows, #doors, #facades, and #building envelope technologies, the #business #event serves as a major #B2B #platform for #innovation, #sourcing, and #industry exchange across the full fenestration #SupplyChain. https://cnbusinessforum.com/event/fenestration-bau-china-2026/

[#TRADESHOW] 2026 #China (#Guzhen) #International #Lighting #Fair will be held from October 22 to 25, 2026, at Guzhen #Convention and #Exhibition #Centre in #Zhongshan. As a leading lighting #trade #show in #China, the #business #event serves as a major #B2B #platform for lighting #products, #LED technologies, #smart #home solutions, and related #furnishings across the #global lighting #SupplyChain. https://cnbusinessforum.com/event/2026-china-guzhen-international-lighting-fair/

[#TRADESHOW] 2026 #China (#Guzhen) #International #Lighting #Fair will be held from October 22 to 25, 2026, at Guzhen #Convention and #Exhibition #Centre in #Zhongshan. As a leading lighting #trade #show in #China, the #business #event serves as a major #B2B #platform for lighting #products, #LED technologies, #smart #home solutions, and related #furnishings across the #global lighting #SupplyChain. https://cnbusinessforum.com/event/2026-china-guzhen-international-lighting-fair/

LiteLLM attack: Over 2500 companies affected

https://www.heise.de/en/news/LiteLLM-attack-Over-2500-companies-affected-11412943.html

#security #supplychain #attack #Python

https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/

#AI #SecurityBreach #SupplyChain #litellm

“A window of roughly 40 minutes in which the LiteLLM dependency was hacked led to over 430,000 instances in which millions of secrets were harvested. This magnitude pushes us into a completely new world regarding the type of response required from the cybersecurity industry.”

A partial listing of the affected companies follows; the arstechnica article has a link to the full list.

https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/

#AI #SecurityBreach #SupplyChain #litellm

“A window of roughly 40 minutes in which the LiteLLM dependency was hacked led to over 430,000 instances in which millions of secrets were harvested. This magnitude pushes us into a completely new world regarding the type of response required from the cybersecurity industry.”

A partial listing of the affected companies follows; the arstechnica article has a link to the full list.

📢⚠️ #TeamPCP used a poisoned Trivy scanner to hijack LiteLLM releases. Researchers linked the breach to 2,500+ companies and 434K CI/CD pipelines. The malware stole cloud, developer, and AI credentials.

Listen/Read: https://hackread.com/litellm-breach-2500-companies-434k-ci-cd-pipelines

#CyberSecurity #LiteLLM #DataBreach #SupplyChain

📢⚠️ #TeamPCP used a poisoned Trivy scanner to hijack LiteLLM releases. Researchers linked the breach to 2,500+ companies and 434K CI/CD pipelines. The malware stole cloud, developer, and AI credentials.

Listen/Read: https://hackread.com/litellm-breach-2500-companies-434k-ci-cd-pipelines

#CyberSecurity #LiteLLM #DataBreach #SupplyChain

In a supply chain attack on the popular LiteLLM library in March this year, around 434,000 build pipelines – which were in use at more than 2,500 companies – are believed to have been compromised: https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines
How you can protect yourselves against such and similar attacks is explained in our @Python4DataScience tutorial: https://python4data.science/en/latest/productive/security/index.html
#Python #ITSecurity #SupplyChain #LiteLLM

In a supply chain attack on the popular LiteLLM library in March this year, around 434,000 build pipelines – which were in use at more than 2,500 companies – are believed to have been compromised: https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines
How you can protect yourselves against such and similar attacks is explained in our @Python4DataScience tutorial: https://python4data.science/en/latest/productive/security/index.html
#Python #ITSecurity #SupplyChain #LiteLLM

Stretto di Hormuz, traffici ancora al palo e supply chain sotto stress
https://www.metallirari.com/breakingnews90/
#Hormuz #StrettoDiHormuz #SupplyChain #Logistica #Petrolio #Brent #Energia #Commodities #Mercati #Trasporti #Geopolitica #Iran #GlobalTrade #Shipping #Economia

Alluminio: nuovi guai in Amazzonia con Alunorte che taglia la produzione del 50%
https://www.metallirari.com/alluminio-nuovi-guai-amazzonia-alunorte-taglia-produzione-50-percento/
Il taglio di produzione di allumina ad Alunorte, deciso da Norsk Hydro per problemi di fornitura gas, si somma alla crisi mediorientale legata alla guerra in Iran e spinge l’alluminio a un massimo di sette settimane, con le scorte LME ai minimi dal 1990.
#Alluminio #Alunorte #NorskHydro #Iran #LME #MercatoMetalli #CommoditiesTrading #Allumina #Geopolitica #SupplyChain #Brasile

[#TRADESHOW] #China #Ningbo #International #Auto #Parts and #Aftermarket #Fair (#CAPAFAIR) 2026 from August 12 to 14, 2026, at Ningbo International #Convention and #Exhibition #Center. #Event serves as a major #B2B #business #sourcing #platform for #global #buyers, #importers, #exporters, and #SupplyChain professionals. Fair brings together #manufacturers, #industrial clusters, and service #providers across the full #automotive supply chain. https://cnbusinessforum.com/event/china-ningbo-international-auto-parts-and-aftermarket-fair-capafair-2026/

[#TRADESHOW] #China #Ningbo #International #Auto #Parts and #Aftermarket #Fair (#CAPAFAIR) 2026 from August 12 to 14, 2026, at Ningbo International #Convention and #Exhibition #Center. #Event serves as a major #B2B #business #sourcing #platform for #global #buyers, #importers, #exporters, and #SupplyChain professionals. Fair brings together #manufacturers, #industrial clusters, and service #providers across the full #automotive supply chain. https://cnbusinessforum.com/event/china-ningbo-international-auto-parts-and-aftermarket-fair-capafair-2026/

Why Can't You Find Canned Sardines?

https://corneroffifth.studio/why-cant-you-find-canned-sardines-right-now/

Comments: https://news.ycombinator.com/item?id=49279013

#HackerNews #cannedsardines #sardines #shortage #foodindustry #supplychain #seafood

Why Can't You Find Canned Sardines?

https://corneroffifth.studio/why-cant-you-find-canned-sardines-right-now/

Comments: https://news.ycombinator.com/item?id=49279013

#HackerNews #cannedsardines #sardines #shortage #foodindustry #supplychain #seafood

Apple's MacBook Air is facing significant supply constraints, with delivery estimates extending weeks. Alternative retailers like Amazon offer immediate availability for select models, some at discounted prices. Exploring these options may help secure a MacBook Air sooner.

#MacBookAir #Apple #TechNews #SupplyChain #Amazon #Refurbished

https://thedailytechfeed.com/macbook-air-shortages-intensify-where-to-find-one-now/

This was posted yesterday, if you missed it.

CloudSek: 2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026 https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines @cloudsek

More:

Security Week: https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/ @SecurityWeek #infosec #supplychain #cyberattack

This was posted yesterday, if you missed it.

CloudSek: 2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026 https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines @cloudsek

More:

Security Week: https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/ @SecurityWeek #infosec #supplychain #cyberattack

Pegatron confirms Apple's base iPhone 18 model will launch in early 2027, following the Pro versions' 2026 release. This shift may address supply chain challenges and market dynamics, aiming to optimize production efficiency and consumer engagement.

#Apple #iPhone18 #Pegatron #TechNews #SupplyChain #ProductLaunch

https://thedailytechfeed.com/apples-iphone-18-base-model-delayed-to-2027-confirms-supplier/

RE: https://mstdn.social/@hkrn/117083023668729288

This is related to what I talked about at #opensourcenorth this year. Small volunteer teams maintaining massively used open source projects are part of the supply chain weaknesses we are seeing exploited. The only lasting way we have to combat against this going forward is to be a community and help each other with the work.

#FOSS #supplychain #ublockorigin

RE: https://mstdn.social/@hkrn/117083023668729288

This is related to what I talked about at #opensourcenorth this year. Small volunteer teams maintaining massively used open source projects are part of the supply chain weaknesses we are seeing exploited. The only lasting way we have to combat against this going forward is to be a community and help each other with the work.

#FOSS #supplychain #ublockorigin

Gunra Ransomware Targets Infrastructure via Fortinet Flaws

Gunra Ransomware is exploiting critical Fortinet flaws, including CVE-2024-55591, to gain super-admin privileges and infiltrate government and critical infrastructure networks. This alarming vulnerability allows remote attackers to craft requests and bypass authentication, putting sensitive systems at risk.

https://osintsights.com/gunra-ransomware-targets-infrastructure-via-fortinet-flaws?utm_source=mastodon&utm_medium=social

#GunraRansomware #Fortinet #Cve202455591 #Ransomware #SupplyChain

Gunra Ransomware Targets Infrastructure via Fortinet Flaws

Gunra Ransomware is exploiting critical Fortinet flaws, including CVE-2024-55591, to gain super-admin privileges and infiltrate government and critical infrastructure networks. This alarming vulnerability allows remote attackers to craft requests and bypass authentication, putting sensitive systems at risk.

https://osintsights.com/gunra-ransomware-targets-infrastructure-via-fortinet-flaws?utm_source=mastodon&utm_medium=social

#GunraRansomware #Fortinet #Cve202455591 #Ransomware #SupplyChain

Apple's M4 Mac Mini, featuring the M4 chip and redesigned compact chassis, is now available on Amazon amid previous supply constraints. The base model, with 16GB RAM and a 512GB SSD, is priced at $999, with delivery between August 18 and 20. This offers a timely opportunity for users seeking to upgrade their desktop setups without prolonged wait times.

#Apple #MacMini #M4 #TechNews #Amazon #SupplyChain

https://thedailytechfeed.com/amazon-restocks-apples-m4-mac-mini-amid-supply-constraints/

You can't buy 20 pieces of aluminum tube online

https://vestalmetals.com/blog/aluminum-tube-bin-packing/

Comments: https://news.ycombinator.com/item?id=49271047

#HackerNews #aluminumtube #onlinepurchase #supplychain #restrictions #metals

You can't buy 20 pieces of aluminum tube online

https://vestalmetals.com/blog/aluminum-tube-bin-packing/

Comments: https://news.ycombinator.com/item?id=49271047

#HackerNews #aluminumtube #onlinepurchase #supplychain #restrictions #metals