PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Themes from PyCon US 2022

blog.trailofbits.com | blog | #supply-chain | #open-source | #conference | #pypi | #python | #supply-chain-security | #pycon
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Takeaways from PyCon US 2022 in Salt Lake City, including PyPI's supply chain security improvements, pattern matching adoption, annotations, and a thriving post-pandemic Python community.
Published
Collected

Related coverage

blog · aikido.dev
Introducing Aikido Package Health: a Better Way to Trust Your Dependencies
Aikido Package Health surfaces the true health of an open source package with a single score. It helps devs understand stability, maintenance quality, and supply-chain risk before installing a dependency.
blog · netspi.com
Top Security Takeaways from Black Hat USA 2022 and DEF CON 30
Recap of Black Hat USA 2022 and DEF CON 30: Kerberos local privilege escalation research, the new open-source PowerHuntShares and PowerHunt tools, and notable trends from this year's shows.
blog · netspi.com
Greatest Moments from Black Hat 2021 and DEF CON 29
NetSPI recap of Black Hat 2021 and DEF CON 29: CISA's new Joint Cyber Defense Collaborative, warnings about escalating software supply chain attacks, and a notably thinner hybrid-event crowd.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
research · certik.com
Skill Scanning Is Not a Security Boundary
This article argues that scanning third-party OpenClaw skills (e.g. Clawhub's VirusTotal and AI review pipeline) is not a security boundary, since skills execute with full privileged-runtime access.
blog · blog.trailofbits.com
Package managers have an integrity problem
# Package managers have an integrity problem Keegan Ryan October 14, 2026 supply-chain, cryptography, ecosystem-security Page content * Simulating malicious package repositories * HTTPS is...
Back