When AppSec Scanners Become a Supply Chain Attack Vector

Summary

Researchers have discovered that application security (AppSec) scanners, commonly embedded in CI/CD pipelines and the software supply chain, can be compromised and weaponized to attack downstream targets. These scanners, intended to detect vulnerabilities, become attack vectors when exploited, allowing threat actors to inject malicious code or gain access to dependent systems. This represents a critical blind spot in supply chain security where trust in security tooling itself becomes a vulnerability.

Entities