[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Ftop10-2021-a08":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","top10-2021-a08","A08:2021","A08:2021 Software and Data Integrity Failures",39,"OWASP Foundation","**What it asks for.** This category, new in 2021, covers code and infrastructure that do not protect against integrity violations. Examples include relying on plugins, libraries or updates from untrusted sources, insecure CI\u002FCD pipelines, automatic updates without integrity verification and insecure deserialisation of untrusted data, which was merged into this category.\n\n**In practice.** Organisations verify signatures or hashes on software and updates, use trusted and pinned dependency sources, protect build pipelines with access control, separation and review, and avoid deserialising untrusted data or verify its integrity first. Evidence includes signing and verification configuration, pipeline access reviews, build provenance and code review records for pipeline changes.\n\n**Common gaps.** Pipelines are often less protected than production, with broad credentials and unreviewed changes. Updates and artefacts are frequently signed but never verified when consumed.",null,"https:\u002F\u002Fowasp.org\u002FTop10\u002FA08_2021-Software_and_Data_Integrity_Failures\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"fakegit-campaign-uses-17000-malicious-github-repos-to-spread-malware","FakeGit Campaign Uses 17,000+ Malicious GitHub Repos to Spread Malware","2026-10-08T18:20:38.285+00:00",{"slug":23,"title":24,"published_at":25},"unpatched-lmcache-flaw-enables-unauthenticated-remote-code-execution","Unpatched LMCache Flaw Enables Unauthenticated Remote Code Execution","2026-10-07T18:21:31.402+00:00",{"slug":27,"title":28,"published_at":29},"fake-cloudflare-pages-trick-users-into-installing-lunexstealer-via-compromised-sites","Fake Cloudflare Pages Trick Users Into Installing LunexStealer via Compromised Sites","2026-10-07T08:20:36.6+00:00",{"slug":31,"title":32,"published_at":33},"placeholder-domains-in-ai-agent-skills-hijacked-to-serve-scams","Placeholder Domains in AI Agent Skills Hijacked to Serve Scams","2026-09-26T20:20:37.092+00:00",{"slug":35,"title":36,"published_at":37},"ai-driven-threat-actors-compromise-27-retailers-steal-600k-credit-card-records","AI-Driven Threat Actors Compromise 27 Retailers, Steal 600K Credit Card Records","2026-09-24T19:21:41.765+00:00",{"slug":39,"title":40,"published_at":41},"ai-powered-open-source-agents-compromise-27-retailers-exfiltrate-600k-credit-card-records","AI-Powered Open-Source Agents Compromise 27 Retailers, Exfiltrate 600K Credit Card Records","2026-09-23T20:22:16.866+00:00",{"slug":43,"title":44,"published_at":45},"ai-coding-agents-can-be-fed-malicious-plugins-despite-version-pinning","AI Coding Agents Can Be Fed Malicious Plugins Despite Version Pinning","2026-09-18T14:21:39.704+00:00",{"slug":47,"title":48,"published_at":49},"stolen-cloudflare-api-key-enables-supply-chain-attack-via-cdn-edge-manipulation","Stolen Cloudflare API Key Enables Supply-Chain Attack via CDN Edge Manipulation","2026-09-17T18:20:24.712+00:00",{"slug":51,"title":52,"published_at":53},"unpatched-woocommerce-plugin-lets-attackers-upload-php-backdoors","Unpatched WooCommerce Plugin Lets Attackers Upload PHP Backdoors","2026-09-16T10:22:50.804+00:00",{"slug":55,"title":56,"published_at":57},"compromised-wordpress-plugin-backdoors-1500-sites-via-malicious-updates","Compromised WordPress Plugin Backdoors 1,500 Sites via Malicious Updates","2026-09-15T22:20:45.8+00:00",{"slug":59,"title":60,"published_at":61},"unpatched-woocommerce-plugin-opens-100000-wordpress-sites-to-webshell-attacks","Unpatched WooCommerce Plugin Opens 100,000+ WordPress Sites to Webshell Attacks","2026-09-15T16:22:50.029+00:00",{"slug":63,"title":64,"published_at":65},"critical-gitlab-path-traversal-flaw-demands-immediate-patching","Critical GitLab Path Traversal Flaw Demands Immediate Patching","2026-09-11T12:20:40.919+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",20,{"slug":73,"name":74,"problem":75,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",18,{"slug":78,"name":79,"problem":80,"stories":81},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",16,{"slug":83,"name":84,"problem":85,"stories":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",11,{"slug":88,"name":89,"problem":90,"stories":91},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",7,{"slug":93,"name":94,"problem":95,"stories":96},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",6,[98,104,110,115,120,125,131,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","2","Control 2","Inventory and Control of Software Assets",31,{"family":105,"item":106,"code":107,"title":108,"together":109},"gdpr","32","Article 32","Security of processing",25,{"family":99,"item":111,"code":112,"title":113,"together":114},"7","Control 7","Continuous Vulnerability Management",23,{"family":99,"item":116,"code":117,"title":118,"together":119},"16","Control 16","Application Software Security",19,{"family":121,"item":122,"code":123,"title":124,"together":76},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":126,"item":127,"code":128,"title":129,"together":130},"nist-800-53","si-2","SI-2","Flaw Remediation",14,{"family":132,"item":133,"code":134,"title":134,"together":130},"itil","overview","ITIL",{"family":126,"item":136,"code":137,"title":138,"together":139},"sa-12","SA-12","Supply Chain Protection",12]