[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZxmUGmLY2hHvCZiJ9ruj-UYY-e5Tsj8XChvt9vZF2h4":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"d97f49f6-7126-4083-bd4a-15a1974965e7","nDiligence Releases Four-Year Study Identifying a Critical Supply-Chain Vulnerability Across 50 Platform Types","ndiligence-releases-four-year-study-identifying-a-critical-supply-chain-vulnerab-b97f92","San Francisco, California, USA, 12th November 2026, CyberNewswire","A four-year study by nDiligence, called Attack the Glass (ATG), has identified a critical supply-chain vulnerability affecting 50 types of software and devices. This vulnerability allows attackers to manipulate what users see on their screens and how applications function after all security checks have passed, by compromising any one of the numerous suppliers involved in runtime client-side rendering. The research highlights that existing security measures like sign-in, encryption, and firewalls do not prevent these attacks, and the underlying vulnerability remains unfixed.","nDiligence study finds 50 platform types vulnerable to runtime client-side rendering exploits.","https:\u002F\u002Fhackread.com\u002Fndiligence-releases-four-year-study-identifying-a-critical-supply-chain-vulnerability-across-50-platform-types\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FATG_PR-11_CyberNewswire_1200x720_dark_4_1794349433OAzVVHzHnr.jpg","2026-11-12T13:15:03+00:00","2026-11-12T14:00:21.289195+00:00",8,[17,20,23],{"name":18,"type":19},"nDiligence","vendor",{"name":21,"type":22},"Attack the Glass","campaign",{"name":24,"type":25},"runtime client-side rendering","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":26,"icon":28,"name":29,"slug":30},null,"Supply Chain","supply-chain",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"domain","Polyfill.io","Domain associated with a code library loaded by over 100,000 websites, which was sold and used to deliver malicious code.",[18],{"controls":56,"vendors":140},[57,86,114],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":48,"name":87,"problem":88,"products":89},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":115,"name":116,"problem":117,"products":118},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":136,"product_name":137,"url":138,"description":139},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":151},"client-side-supply-chain-attacks-bypass-all-traditional-security-controls","Client-Side Supply Chain Attacks Bypass All Traditional Security Controls","A four-year study revealed that attackers can compromise any of the many third-party suppliers involved in runtime client-side rendering to manipulate what users see and how applications behave — after authentication, encryption, and firewall checks have already passed. This matters because organizations typically trust that their security perimeter protects the end-user experience, yet the attack surface extends across dozens of upstream software and device vendors they do not directly control. The vulnerability remains unpatched across 50 platform types, meaning every organization relying on these platforms is currently exposed. Traditional defenses are simply not designed to detect or prevent manipulation at the rendering layer, leaving a systemic blind spot in modern security architectures.",[146,147,148,149,150],"NIS2 Article 21(2)(d)","NIST SP 800-53 SA-12: Supply Chain Protection","CIS Control 16: Application Software Security (v8)","MITRE ATT&CK T1195: Supply Chain Compromise","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(d)":152,"MITRE ATT&CK T1195: Supply Chain Compromise":153,"NIST SP 800-53 SA-12: Supply Chain Protection":154,"OWASP A06:2021 Vulnerable and Outdated Components":155,"CIS Control 16: Application Software Security (v8)":156},"This point explicitly requires organizations to address security risks arising from supplier relationships and third-party dependencies, which is exactly the attack surface exposed by compromised client-side rendering vendors.","This technique describes how adversaries compromise software or hardware before it reaches the end user, directly matching the attack vector of manipulating client-side rendering through any upstream supplier.","SA-12 requires organizations to protect against supply chain threats by assessing and managing risks from all entities involved in the development and delivery of systems and components, covering the multi-vendor client-side rendering pipeline described in this study.","This category covers the risk of using third-party components without verifying their integrity or monitoring for compromise, which is the core mechanism enabling the client-side supply chain attacks documented in this study.","CIS Control 16 requires organizations to manage the security lifecycle of internally developed and acquired software, including validating the integrity of third-party components that execute within applications."]