PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Supply Chain Security: The Ultimate Guide to Software Composition Analysis (SCA) Tools

aikido.dev | blog | #supply-chain | #open-source | #cve | #guide | #sca | #dependencies
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Guide to Software Composition Analysis: with 70–90% of app code from open source, SCA scans direct and transitive dependencies against CVE databases to prioritize real risks over noisy alerts.
Published
Collected

Related coverage

blog · aikido.dev
SCA Everywhere: Scan and Fix Open-Source Dependencies in Your IDE
Aikido's IDE extension now runs the full SCA workflow: scan manifests and lockfiles for CVEs with safe upgrade ranges, fix via AutoFix, and auto-refresh as lockfiles change.
blog · aikido.dev
Why Securing Bazel Builds is So Hard (And How to Make It Easier)
Bazel lacks standard lockfiles and manifests, making security scanning painful; Aikido now scans Bazel projects automatically and flags risky dependencies, replacing custom scripts and CI hacks.
blog · bugbunny.ai
Open Source Vulnerability Management: Fixing Dependency Risk Without Alert Fatigue
Open-source vulnerability management without alert fatigue: build a dependency inventory from manifests, lockfiles and images, then prioritize by reachability and exposure instead of chasing every CVE.
blog · bugbunny.ai
Software Composition Analysis: Beyond Dependency CVE Lists
Software composition analysis beyond CVE lists: build an accurate SBOM, tie dependencies to services and owners, prioritize by reachability, and watch build-time tools and package scripts too.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
blog · aikido.dev
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
Back