A couple of weeks ago we lived through one of those black days in security, the kind that keep getting more common. Two PHP CVEs showed up, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell, which went as far as allowing remote control of the servers where the instances were running.The tricky thing about this kind of vulnerability is that it’s not our fault. When we’re talking about vulnerabilities that we ourselves introduced into our code, fine; we know we made an omission or a mistake and we have to fix it. But what happens when we think everything is fine and the next day we wake up to find that something we don’t control has been compromised? And that, in some cases, there’s not much we can do, because we don’t control all the direct or indirect impacts that remediating the vulnerability might have.Ever since the pandemic, the supply chain has been a hot topic. On one hand, because in the physical world the supply chain became critical to keeping companies of every kind running around the globe; but also in the digital world, where the entire industry had to be digitized in a hurry, and that meant developing faster and faster. Building from scratch was a luxury we could no longer afford, and we had to reuse a huge number of components just to keep up.But the pandemic was a long time ago. Why do we still have so many problems, and why do they seem to keep growing? And no, today we’re not going to talk about AI; we’re going to take a different road.Let’s look at a few cases.Case 1: From the security advisory to the unexpected question.The PHP CVEs drop, and everyone on Twitter, Discord and Telegram is talking about them. The hacking and bug bounty groups are showing off their detection scripts and their agents, and some are already reporting vulnerabilities to collect bounties, or to hack organizations. But on the other side, the affected companies, and worse still, their cybersecurity vendors, don’t seem to be moving at the same pace. The former are having a coffee while they go through the day’s Excel report, and the latter are busy talking about the risks of AI.Hours later, someone sends out an alert notification: CISA has flagged them as actively exploited vulnerabilities. The SOC quickly notifies everyone, which is to say, it copies and pastes CISA’s text and sends it internally, asking the developers to confirm whether or not they’re exposed. The developers see the link, read “CV…” and have no idea what they’re looking at. A few weeks later, the whole thing has turned into an endless email thread and several Teams chats… and the PHP versions are still there, unpatched.This is not a hypothetical dramatization. This is what happened to thousands of companies around the world, and what happens every single day. A company with no real security controls, a vendor whose only job is to think up buzzwords to drum up more business by recording TikToks, developers who don’t understand what lands in their inbox, and a SOC whose job is to raise alerts without ever trying to act proactively.Case 2: “Clean report”There are organizations with vast technology resources: DAST, SAST, SCA, everything automated from the pipeline, and reports that come back at zero every day. “Everything is perfect,” they think, convinced those metrics are the product of their excellent maturity. But then… one day, someone picks up a report, looks at it and says, wait a minute, “why is the DAST only scanning / and then sending everything to a 302?” And in the SCA, “why do all the scans have dependency resolution errors?”That’s right. Most tools today may be a matter of hitting Play and you’re done, but sometimes you do have to configure a little; and when we’re talking about SCA scans, dependency resolution can be a complicated business. Why? Because while the developers have an environment set up with everything they need to do their jobs, those of us on the security side have to spend hours fighting with dependencies, versions, and sometimes configurations nobody understands: virtual repositories, proxies, strange config files; and most of the time with zero feedback from the development team.Case 3: “I only look at the CVEs”Vulnerabilities are not the only risk when we talk about dependencies. One of the problems affecting many dependencies is that not all of them are maintained by an active, well-funded development team. Some of them, and unfortunately many extremely important ones, are maintained by a lone programmer who lives paycheck to paycheck and keeps the project going as a hobby, and who may one day go two or three years without a single commit, simply because they haven’t had the time.Lack of support, abandoned components, and good practices that aren’t vulnerabilities (yet) are factors that also need to be taken into account in the remediation strategy.Case 4: “We’re not affected”There are development teams that deliberately shirk their responsibility and don’t carry out the required remediations.And there are more of these cases than you’d think. Security sends over the report or the notifications with the vulnerabilities; the development team receives them, hundreds or maybe thousands of them; and in under two minutes Development replies: “we’re not affected,” “those libraries are only used for testing,” “that’s not in production,” “it’s a false positive”; or, in the best case, a hopeful “we won’t fix it for now, we’ll do it in the next release.” A year later, the vulnerabilities just keep piling up and up.The experts have coined a term for this: technical debt. In security, we call it excuses.Case 5: “Yes, I see this is relevant, but I don’t see anything that stops us from moving forward.”As an offensive security consultant, I’ve spent my life listening to countless CSOs say “the business comes first,” “security can’t get in the way of the business,” “testing can’t affect the business”; and the supply chain was never going to be the exception.You can show up with the report in red, and not strawberry red, blood red; the risk map at critical; problems everywhere; and an analysis of the enormous losses the company would face if any of those risks materialized. And the funny thing is that someone will probably grasp the gravity of the problem, but once it reaches the person who has to make the decisions, that person will sidestep the problem and let everything carry on, risks and all.I want to dig a little deeper into this point, because it’s something I was discussing a few weeks ago with a colleague. A decade ago, CSOs were generally IT people who had been moved into the role when security started to become a priority, before information security was rebranded as cybersecurity, and before buzzwords like resilience took to the streets. And while it was common for those CSOs not to understand security, there was a tipping point where their experience and knowledge of technology led them to understand where they stood, and how they needed to respond. Today’s CSOs are people trained in information security from the very start; and their lack of technical knowledge leads them to not understand what they’re managing.So what can we do? The answer isn’t simple, but there are a few small rules we can start with.Validate your tools. It’s not just a matter of having a scanner; you have to configure it, monitor the results, check the logs and whatever errors there may be, configure exceptions and excluded paths, verify that the dependencies flagged as testing really are testing, and verify that the production dependencies don’t include those supposedly excluded paths.Verify that all your dependencies have been resolved. The number may not always be exact; even the FDA maintains benchmarks on the different tools and examples of how many packages each one resolves, and they usually differ on transitive dependencies. But if your IDE shows 1,000 packages and you’ve got a fantastic 10, you have a problem.Protect your pipeline. Fine, that package only affects testing and it’s not in production; but that doesn’t mean everything is sunshine and rainbows. Have you heard about a crypto hack worth several billion dollars? Right. Protect your pipeline.Forget about technical debt. Technical debt, like your credit card debt, doesn’t get better the longer you leave it alone; everything gets worse. Act!{“path”:{“baseUrl”:”\/”,”scriptPath”:null,”pathPrefix”:””,”currentPath”:”node\/66308″,”currentPathIsAdmin”:false,”isFront”:false,”currentLanguage”:”en”},”pluralDelimiter”:”\u0003″,”suppressDeprecationErrors”:true,”sharebardata”:{“buttons”:”\u003Cul class=\u0022social-sharebar\u0022\u003E\u003Cli\u003E\u003Cscript src=\u0022\/\/platform.linkedin.com\/in.js\u0022 type=\u0022text\/javascript\u0022\u003E\r\n lang: en_US\u003C\/script\u003E\u003Cscript type=\u0022IN\/Share\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022 data-counter=\u0022top\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\r\n\u003Cdiv class=\u0022g-plusone\u0022 data-size=\u0022tall\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022\u003E\u003C\/div\u003E\r\n\u003Cscript type=\u0022text\/javascript\u0022\u003E(function() {var po = document.createElement(\u0027script\u0027); po.type = \u0027text\/javascript\u0027; po.async = true;po.src = \u0027https:\/\/apis.google.com\/js\/plusone.js\u0027;var s = document.getElementsByTagName(\u0027script\u0027)[0]; s.parentNode.insertBefore(po, s);})();\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022http:\/\/twitter.com\/share\u0022 class=\u0022twitter-share-button\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022 data-count=\u0022vertical\u0022 data-via=\u0022The Supply Chain: Why Can\u0026#039;t We Fix Our Security Problems?\u0022\u003ETweet\u003C\/a\u003E\u003Cscript type=\u0022text\/javascript\u0022 src=\u0022http:\/\/platform.twitter.com\/widgets.js\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv id=\u0022fb-root\u0022\u003E\u003C\/div\u003E \u003Cscript\u003E(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) return; js = d.createElement(s); js.id = id; js.src = \u0022\/\/connect.facebook.net\/en_US\/all.js#xfbml=1\u0022; fjs.parentNode.insertBefore(js, fjs); }(document, \u0027script\u0027, \u0027facebook-jssdk\u0027));\u003C\/script\u003E \u003Chtml fb=\u0022http:\/\/ogp.me\/ns\/fb#\u0022\u003E\r\n\u003Cdiv class=\u0022fb-like\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022 data-layout=\u0022box_count\u0022 data-action=\u0022like\u0022 data-size=\u0022small\u0022 data-show-faces=\u0022true\u0022 data-share=\u0022true\u0022\u003E\u003C\/div\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022mailto:?subject=https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022 class=\u0022sharebar-button email\u0022\u003EEmail\u003C\/a\u003E\u003C\/li\u003E\u003C\/ul\u003E”,”buttons_small”:”\u003Cul class=\u0022mobile-social-sharebar\u0022\u003E\u003Cli\u003E\u003Cscript src=\u0022\/\/platform.linkedin.com\/in.js\u0022 type=\u0022text\/javascript\u0022\u003E\r\n lang: en_US\u003C\/script\u003E\u003Cscript type=\u0022IN\/Share\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022 data-counter=\u0022right\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv class=\u0022g-plusone\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022\u003E\u003C\/div\u003E\u003Cscript type=\u0022text\/javascript\u0022\u003E(function() {var po = document.createElement(\u0027script\u0027); po.type = \u0027text\/javascript\u0027; po.async = true;po.src = \u0027https:\/\/apis.google.com\/js\/plusone.js\u0027;var s = document.getElementsByTagName(\u0027script\u0027)[0]; s.parentNode.insertBefore(po, s);})();\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022http:\/\/twitter.com\/share\u0022 class=\u0022twitter-share-button\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022 data-count=\u0022horizontal\u0022 data-via=\u0022The Supply Chain: Why Can\u0026#039;t We Fix Our Security Problems?\u0022\u003ETweet\u003C\/a\u003E\u003Cscript type=\u0022text\/javascript\u0022 src=\u0022http:\/\/platform.twitter.com\/widgets.js\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv id=\u0022fb-root\u0022\u003E\u003C\/div\u003E \u003Cscript\u003E(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) return; js = d.createElement(s); js.id = id; js.src = \u0022\/\/connect.facebook.net\/en_US\/all.js#xfbml=1\u0022; fjs.parentNode.insertBefore(js, fjs); }(document, \u0027script\u0027, \u0027facebook-jssdk\u0027));\u003C\/script\u003E \u003Chtml fb=\u0022http:\/\/ogp.me\/ns\/fb#\u0022\u003E\r\n\u003Cdiv class=\u0022fb-like\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022 data-layout=\u0022box_count\u0022 data-action=\u0022like\u0022 data-size=\u0022small\u0022 data-show-faces=\u0022true\u0022 data-share=\u0022true\u0022\u003E\u003C\/div\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022mailto:?subject=https:\/\/mexicobusiness.news\/cybersecurity\/news\/supply-chain-why-cant-we-fix-our-security-problems\u0022 class=\u0022sharebar-button email\u0022\u003EEmail\u003C\/a\u003E\u003C\/li\u003E\u003C\/ul\u003E”,”width”:”85″,”position”:”left”,”top_offset”:”200″,”left_offset”:”5″,”right_offset”:”0″},”statistics”:{“data”:{“nid”:”66308″},”url”:”\/core\/modules\/statistics\/statistics.php”},”user”:{“uid”:0,”permissionsHash”:”d5cfe5151b3ffc53c5d130d9e05e2100e43cfffcac57d2afbf37c73af1c6771d”}}
——————————————————-
Click Here For The Original Source.
