[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPllbliPDuJhYUuTLMTFeb3Y8MljUPtwDyvrkyUlnEdo":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"3e5d7b73-6d11-4d40-ac97-0f0e245c9f6d","nDiligence Releases Four-Year Study Identifying a Critical Supply-Chain Vulnerability Across 50 Platform Types","ndiligence-releases-four-year-study-identifying-a-critical-supply-chain-vulnerab-e39a2f","San Francisco, California, USA, November 12th, 2026, CyberNewswire Four-year cybersecurity study finds all 50 types of software and devices examined vulnerable, with 46 rated Critical or High risk. nDiligence, Inc. today announced the release of Attack the Glass (ATG) research to the general public. The four-year study examines a cybersecurity vulnerability in how applications use […] The post nDiligence Releases Four-Year Study Identifying a Critical Supply-Chain Vulnerability Across 50 Platform Types appeared first on Cyber Security News.","A four-year study by nDiligence, 'Attack the Glass' (ATG), reveals a critical supply-chain vulnerability affecting all 50 examined software and device types, with 46 rated Critical or High risk. The vulnerability allows attackers to manipulate what users see and what their software does after all security checks have passed, by compromising any supplier in the runtime client-side rendering process. The research highlights the potential for disinformation, false operational pictures, and hidden safety alerts, with the Polyfill.io incident in February 2024 serving as a past example.","nDiligence study finds 50 platform types vulnerable to supply-chain attacks.","https:\u002F\u002Fcybersecuritynews.com\u002Fndiligence-releases-four-year-study-identifying-a-critical-supply-chain-vulnerability-across-50-platform-types\u002F","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj6eW_hJ-maORKgGdpsPupB6cnZGujBOxPj54_j4x57m5UeZPrE004gqBuiH7q14uLP_bkki1gjP2_lfM1u0dm3oRM793CAmGXtJPLyFMCwQRvER7m_OIuIkPp_ivc-LXa3QPueKpJrlQ-CTFTA6e5hFxAaJ0nk5XY8-6WpaGvGwOOKCW0sZxwBsaUSEHQ\u002Fs1600\u002FInsignary%20Launches%20Clarity%20On-Demand_%20SBOMs,%20No%20Annual%20Commitment%20Required%20Toronto,%20Canada,%20July%2015th,%202026,%20CyberNewswire%20Enterprise-grade%20binary%20software%20verification%20for%20one%20project,%20one%20team,%20or%20%20(96.webp","2026-11-12T14:25:32+00:00","2026-11-12T15:00:27.571501+00:00",8,[17,20,23],{"name":18,"type":19},"nDiligence","vendor",{"name":21,"type":22},"Attack the Glass","campaign",{"name":24,"type":25},"runtime client-side rendering","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":26,"icon":28,"name":29,"slug":30},null,"Supply Chain","supply-chain",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"domain","Polyfill.io","Domain associated with a code library used by over 100,000 websites, which was sold and later used in an attack.",[18],{"controls":56,"vendors":140},[57,86,111],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":48,"name":87,"problem":88,"products":89},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":107,"product_name":108,"url":109,"description":110},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":112,"name":113,"problem":114,"products":115},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":151},"client-side-supply-chain-attacks-can-bypass-all-security-controls-at-runtime","Client-Side Supply Chain Attacks Can Bypass All Security Controls at Runtime","A four-year study found that all 50 examined software and device platform types contain a critical supply-chain vulnerability in their runtime client-side rendering process, with 46 rated Critical or High risk. The core danger is that any compromised supplier in the rendering chain can manipulate what users see or what software does *after* all security checks have already passed, making traditional defenses ineffective. The 2024 Polyfill.io incident demonstrated this at scale, where a compromised third-party JavaScript library silently altered behavior for millions of users. This matters because organizations typically audit their direct vendors but rarely map or monitor the full dependency chain of every component rendered at runtime. Without visibility into these transitive dependencies, attackers can silently manipulate data, suppress safety alerts, or inject disinformation into trusted interfaces.",[146,147,148,149,150],"NIST CSF 2.0 GV.SC-06: Cybersecurity of the supply chain","NIS2 Article 21(2)(d)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(d)":152,"NIST SP 800-53 SA-12: Supply Chain Protection":153,"OWASP A06:2021 Vulnerable and Outdated Components":154,"NIST CSF 2.0 GV.SC-06: Cybersecurity of the supply chain":155,"CIS Control 2: Inventory and Control of Software Assets (v8)":156},"This point mandates supply chain security measures including security practices relating to the relationships between entities and their direct suppliers or service providers, which would have required scrutiny of every third-party component in the client-side rendering chain.","SA-12 requires organizations to protect against supply chain threats by employing safeguards such as provenance tracking and integrity verification of software components, which would have mitigated the risk of compromised third-party rendering libraries.","This risk category covers the use of third-party components without verifying their integrity or tracking their provenance, directly matching the scenario where a compromised upstream supplier (Polyfill.io) silently altered client-side behavior.","This category requires organizations to understand and manage cybersecurity risks from suppliers throughout the supply chain, directly addressing the failure to assess and monitor third-party runtime rendering dependencies.","CIS Control 2 requires organizations to actively manage all software on the network, including third-party and open-source components, which would have revealed the exposure created by unmanaged runtime dependencies."]