@ericgallagher.bsky.social
💪 Author of "Securing the Backbone" newsletter | Challenging the status quo in software supply chain security | 🏃Trying to make running a habit | 🎾Tennis and ♠️poker nerd | WV
Full executive brief:
securingthebackbone.com/blog/stb-exe...
The organization didn’t eliminate the work.
It made the work continuous.
That’s not failure.
That’s a shift from deferred cost to recurring cost.
If teams close issues faster but new ones keep flowing in at the same rate, the system looks cleaner while labor demand stays flat — or rises.
02.02.2026 14:35 — 👍 0 🔁 0 💬 1 📌 0Backlog metrics measure inventory.
Cost reflects throughput.
You can reduce the pile…
while the conveyor belt keeps running just as fast.
Your vulnerability backlog is shrinking.
Your remediation costs aren’t.
Both can be true at the same time.
👉 Get the full report from ActiveState to see the complete findings and benchmarks.
www.activestate.com/resources/20...
If container security and compliance are part of your 2026 priorities, the full 2026 State of Vulnerability Management & Remediation Report: Container Security Edition breaks down exactly where organizations are falling behind, and what’s replacing broken approaches.
06.01.2026 14:06 — 👍 1 🔁 0 💬 1 📌 0The real failure point is remediation:
❌ Outdated base images
❌ Inherited CVEs
❌ Manual fixes that can’t keep up with ephemeral containers
The report shows that container adoption has outpaced security maturity, turning audits into a recurring risk event instead of a checkpoint.
🚨 78% of organizations have likely failed a compliance audit due to CVEs in container images.
Not because teams aren’t scanning.
Not because they don’t care about security.
But because finding vulnerabilities is no longer the hard part.
When compromise propagates inside the ecosystem itself, there is no clear breach moment and often nothing to “patch.”
This shift is explored further in a recent STB Executive Brief written for executive leadership. Reach out if you want a copy.
Some of the most disruptive software supply-chain attacks no longer exploit vulnerabilities.
They exploit trust, automation, and legitimate access — spreading through authorized workflows rather than breaking in.
I don’t know you, just found your feed, but don’t stop. Decline or not, you’re running, and that’s a win. “The best run is the run you CAN do now”
01.01.2026 14:04 — 👍 2 🔁 0 💬 1 📌 0
31.12.2025 23:14 — 👍 2 🔁 0 💬 0 📌 0
Here’s a little glimpse into the future. Go @sanfrancisco49ers.bsky.social !
31.12.2025 15:12 — 👍 2 🔁 1 💬 0 📌 0Solutions like @ActiveState focus on preventing untrusted code from entering the pipeline in the first place, not just reacting after the fact.
Because when software can infect software, “just patch it” stops being a strategy.
It becomes a liability.
The real fix is control:
✔️ controlling which open-source packages enter the organization
✔️ controlling how builds are composed
✔️ controlling who can publish, pull, and promote artifacts
This is where curated catalogs, immutable builds, and hardened base images matter.
This new class of supply-chain attack spreads inside trusted developer workflows:
• no zero-days
• no obvious malware
• no CVEs to patch
Just automation + trust + public dependencies.
That’s why detection alone won’t stop it.
Shai Hulud isn’t scary because it’s sophisticated.
It’s scary because it’s allowed.
If you're in those boardroom conversations talking about CVE's, I expand on this further in this month's STB Executive Brief.
30.12.2025 01:24 — 👍 1 🔁 0 💬 0 📌 0As scanning improves, numbers rise, remediation effort compounds, and leadership confidence can move in the wrong direction.
That gap rarely makes it into board conversations.
CVE counts are often treated as a proxy for security risk.
In reality, they measure visibility, not exposure — and say little about the labor required to manage that risk over time.
🚨 Python devs targeted in phishing scam spoofing PyPI!
Emails urge you to “verify” your account via pypj[.]org—a fake site stealing credentials.
✅ Don’t click links
✅ Use MFA
✅ Go directly to pypi.org
Stay sharp.
