[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDA8NFh4NtdFITP7X1gypzikqlDxcLAyMrFCKtW3jd3s":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"6b6ed317-4b0d-426a-9489-40b6e4e8a59a","When AppSec Scanners Become a Supply Chain Attack Vector","when-appsec-scanners-become-a-supply-chain-attack-vector-fbaca3","New research shows how security scanners embedded in the software supply chain can be attacked to serve as a foothold for downstream attacks.","Researchers have discovered that application security (AppSec) scanners, commonly embedded in CI\u002FCD pipelines and the software supply chain, can be compromised and weaponized to attack downstream targets. These scanners, intended to detect vulnerabilities, become attack vectors when exploited, allowing threat actors to inject malicious code or gain access to dependent systems. This represents a critical blind spot in supply chain security where trust in security tooling itself becomes a vulnerability.","Security scanners in software supply chain found vulnerable to attacks serving as downstream exploit vectors.","https:\u002F\u002Fwww.darkreading.com\u002Fapplication-security\u002Fwhen-appsec-scanners-become-supply-chain-attack-vector","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblte3ee632c446d5f42\u002F6a6a3d1bf118fd682ddbc4c8\u002Fsupplychain_IncrediVFX_shutterstock.jpg?width=720&quality=80&disable=upscale","2026-07-29T17:06:52+00:00","2026-07-29T18:00:07.564646+00:00",8,[17,20],{"name":18,"type":19},"AppSec Scanners","technology",{"name":21,"type":19},"CI\u002FCD Pipelines","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":22,"icon":24,"name":25,"slug":26},null,"Supply Chain","supply-chain",[28,33,38],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":39},{"id":40,"icon":24,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":46,"vendors":134},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":77,"name":78,"problem":79,"products":80},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-breach-and-attack-simulation","Picus Breach and Attack Simulation","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fbreach-and-attack-simulation","Continuously tests live defences against current threats, shows what controls block, detect, log and miss, and provides ready-to-apply fixes.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-flex","AttackIQ Flex","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fflex\u002F","Agentless, on-demand testing of security controls without deploying the full platform.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"slug":106,"name":107,"problem":108,"products":109},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":150},"trusted-appsec-scanners-weaponized-as-supply-chain-attack-vectors","Trusted AppSec Scanners Weaponized as Supply Chain Attack Vectors","Researchers have found that application security scanners embedded in CI\u002FCD pipelines can be compromised and turned against the very systems they are meant to protect, exploiting the implicit trust organizations place in their own security tooling. The root cause lies in insufficient vetting and integrity verification of third-party and open-source security tools integrated into automated pipelines. Because these scanners operate with elevated privileges and broad access to codebases and infrastructure, a compromised scanner becomes a high-value pivot point for attackers. This blind spot is particularly dangerous because security teams rarely apply the same scrutiny to their defensive tools that they apply to production software. The incident underscores that no component of the software supply chain — including security tooling — should be implicitly trusted.",[140,141,142,143,144,145,146,147,148,149],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management","NIST SP 800-204C: DevSecOps Pipeline Security","NIST SA-12: Supply Chain Protection","NIST SI-7: Software, Firmware, and Information Integrity","SLSA Supply Chain Levels for Software Artifacts (Levels 3–4)","OWASP Software Component Verification Standard (SCVS)","NIST SSDF (Secure Software Development Framework) PO.1, PS.3","ISO\u002FIEC 27036: Information Security for Supplier Relationships",{}]