See how AI is collapsing the exploit window, turning patches into attacker intelligence, and forcing security teams to rethink software risk.

The package poses as a security tool targeting developers looking to integrate Internet-based apps with telecom networks using Twilio.

ExtraHop's Kanaiya Vasani unpacks the concept of the agentic SOC — and how the Agentic SOC Alliance is working to build them out.

ReversingLabs built a Spectra Analyze integration with CrowdStrike Falcon. The connector is available now as part of Spectra Analyze v9.6.0.

YouTube video by ReversingLabs

Original RL research on ClickFix: the attack chain, the MaaS economy behind it, and the YARA detection strategy that catches what AV and EDR miss.

Explore the new Gartner® Magic Quadrant™ for software supply chain security and learn why ReversingLabs is recognized.

By disabling install scripts by default, it closes the vector worms like Shai-Hulud rely on. Here's what the update fixes — and what it doesn't.

RL has discovered two social engineering attack techniques targeting users via short-form videos. Here’s how they work.

48,000 CVEs were reported in 2025 — but just 58 were critical. A new report highlights why signal-to-noise ratio matters for AppSec.

Analyzing C2 responses from compromised GitHub Actions linked a current threat to an earlier one, showing the value of retrohunting.

RL researchers documented 163 samples tied to CVE-2026-31431, identified active malware adoption — and developed YARA rules to identify them.

Here are the facts on Mythos — and why your organization must adopt a layered security framework to match the new frontier models.

This class of AI tool supply chain attack highlights how trust of agents can be exploited by threat actors.

The malicious npm package has evolved into a dependency that allows attackers to access users’ crypto wallets and funds.

ReversingLabs built it to help development and AppSec teams secure open source dependencies, detect malware — and prevent supply chain attacks.

NK threat actors targeting crypto developers are back with an LLC and new techniques to hide malware. Here's RL's analysis.

NK threat actors targeting crypto developers are back with an LLC and new techniques to hide malware. Here's RL's analysis.

Here's an incident-response checklist and ongoing best practices. Plus: How RL’s xBOM and Spectra Assure Community can help.

JPMC CISO Patrick Opet discussed his open letter on third-party software risk — and the changes suppliers have made since.

Supply chain risk analysis for axios@1.14.1. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

Supply chain risk analysis for telnyx@4.87.2. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

The final-stage malware in the Ghost campaign is a RAT designed to steal crypto wallets and sensitive data.

Supply chain risk analysis for @teale.io/eslint-config@1.8.9. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

Package URLs give software components an exact address to improve vulnerability matching, which reduces alert fatigue and simplifies compliance.

AI coding is the new reality — and it will further destabilize software supply chain security. So step up your AppSec.

In this latest incident, threat actors target developers with a bogus package — a shift away from cryptocurrency development targets.

Learn how to leverage ReversingLabs’s dynamic analysis of <em>pkr_mtsi</em> for defense using YARA Rules in Spectra Analyze.

A new branch of a well-coordinated fake job recruitment campaign is targeting Javascript and Python developers via social channels.

A months-long compromise of the popular source code editor underscores a diversification of attack methods. Here's why going beyond trust is key.

The new GitHub-based lab aims to tame MCP servers with security server and tool-integration training, demos, and instruction on attack methods.

Open source supply chain attacks move through normal development workflows, turning routine updates and trusted code into delivery paths.

ReversingLabs looked at last year's report in the rear-view mirror. Here's a retrospective with what the team got right -- and wrong.

The software supply chain is the end-to-end pathway through which software components are sourced, assembled, and deployed into production.

The concept of an “Upside Down” is a good way to think about software risks, as the latest Software Supply Chain Security Report makes clear.

Open source malware activity increased in 2025, with attackers using public registries and installs to reach developers and CI systems.

AI coding tools are making the memory-safe language Rust a favorite of developers -- even those maintaining massive codebases like Microsoft's.

Here's what the $1.5M investment in the Python Software Foundation will mean for AI security and open-source management.

By Mario Vuksan, CEO & Co-founder, ReversingLabs This year marks the 9th anniversary of the Cyber Threat Alliance (CTA) — a milestone that highlights nearly a decade of collaboration, trust, and share...

NIST has broadened the Secure Software Development Framework to include the full software development lifecycle. Here's why it matters.

The EU's Cyber Resilience Act introduces a legal obligation for software producers to create, maintain, and retain an SBOM. Are you prepared?

A new CSA report stresses getting out in front of AI risk — and offers insights into AI in SecOps. Here’s why you need guardrails.