The promise of SLSA provenance is straightforward — cryptographic proof that a package was built by a known pipeline from known source code.
GDDR6 spot prices tripled since autumn 2025. From roughly 2.
On July 1, AWS raised its EC2 Capacity Block prices for GPU instances by 20%. This was the second hike in 2026 — a 15% bump landed earlier in the year.
Intel Foundry posted a $2.5 billion operating loss last quarter.
Novee Security scanned 30,000 repositories and found that 300 of them — including repos owned by Microsoft, Google, Apache, Cloudflare, and the Python Software...
The Hades campaign dropped a string into its payload that tells you everything about where supply chain attacks are heading: DontRevokeOrItGoesBoom.
Somewhere around late May, an attacker pointed a browser at a SimpleHelp server, submitted a self-signed JWT to the OIDC callback endpoint, and walked away...
The math on GPU ownership used to be simple.
Most supply chain attacks are fire-and-forget: plant a malicious package, wait for installs, harvest credentials. Shai-Hulud broke that model.
Cursor just proved something uncomfortable: you don't need to train a frontier model from scratch to compete with one.
The GPU market finally loosened up. H100 spot prices dropped to $1.
The next Google Pixel might ship with 12GB of RAM instead of 16.
Thirty-four packages. Three registries.
Pick up an NVIDIA B200 and trace where the roughly 6,400 manufacturing cost actually goes.
On Sunday morning, someone pushed 404 malicious package versions to npm and PyPI in under five hours.
Every npm install you ran this morning depended on infrastructure that's losing money.
Ox Security dropped a report on April 15 calling it "the mother of all AI supply chains.
Epoch AI published a manufacturing teardown of NVIDIA's B200 last month.
Sometime in February, a developer at Context.ai — an AI productivity startup — downloaded something they shouldn't have.
Five days ago, Vercel confirmed that attackers accessed customer environment variables through a breach that didn't start at Vercel at all.