ActiveState (@ActiveState) / X

ActiveState

14.7K posts

ActiveState

@ActiveState

ActiveState enables DevOps, InfoSec, and Development teams to improve their security posture while simultaneously increasing productivity and innovation.

Vancouver, BC

Joined November 2008

ActiveState
@ActiveState
1h
A validator confirming a vulnerability is real and an organization deciding what to do about it are different jobs. Gold Eagle does the first. The second is still yours, on your timeline. securityboulevard.com/2026/08/what-g… #CISOAccountability #SoftwareSupplyChain
ActiveState
@ActiveState
Aug 5
An AI coding agent invents a package name that does not exist. Then it invents the same one again. Up to 85% of the time for repositories. 100% for skill installs. Attackers do not need to break anything. They register the name first and let your pipeline collect the payload.
ActiveState
@ActiveState
Aug 1
CISA just told every vendor to formalize vulnerability disclosure: policy, process, a real clock from report to fix. A clean scan won't meet that bar. A documented, owned process will. buff.ly/DCZantZ
ActiveState
@ActiveState
Jul 30
Three AI attack patterns in six months. All the same flaw: agents trust names no one verified. Scanners can't catch this, governance at intake does. Read how slopsquatting, phantom squatting, and HalluSquatting are identical threats on BleepingComputer.
Slopsquatting, Phantom Domains, and HalluSquatting Are the Same AI Attack
From bleepingcomputer.com
ActiveState
@ActiveState
Jul 29
A zero-CVE package is not a secure package. Scanners don't catch undisclosed flaws, malicious code, or a compromised maintainer. That's the gap your board isn't being told about. securityboulevard.com/2026/07/cisas-… #CISOAccountability #SoftwareSupplyChain #OpenSourceGovernance