Supply Chains and Malware Campaigns: Is CVE the Right Way to Name the Game?
summary
2025–2026 cases force a tradeoff: XZ utils backdoor (CVE‑2024‑3094) and TJ Actions (CVE‑2025‑30066) show a CVE ID speeds automated alerts and toolchain response, while the Shai Hulud NPM worm and other large-wave compromises expose rules that ban general-purpose malware IDs and lack a way to relate hundreds of affected packages. The Trivy compromise (CVE‑2026‑33634 affecting Light LLM and Telnyx) highlights cross‑ecosystem gaps, so a practical rule of thumb emerges: if mitigation is to change versions, issue an identifier and add machine‑readable links or an ADP to connect campaign victims.
AI-written summary · about
chapters (9)
- 0:00Welcome
- 2:32CVE and malware limits
- 4:14XZ Utils backdoor case
- 10:59TJ Actions compromise
- 18:01Shai Hulud in NPM
- 29:55Trivy compromise impact
- 42:10Authority in cross-package compromises
- 51:15Call to action for CNA
- 1:00:24Q&A
related talks
42mKeynote: The Expanding Universe of Cyber Threats
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
29mWorms, Tokens, and Trust The Industrialization of Supply Chain Attacks
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
20mCVE Unmoored: Implications of the Removal of the Technology Requirement
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026