supply-chain

Bug bounty platform HackerOne confirms 287 employees had Social Security numbers and personal data exposed through a BOLA vulnerability at benefits administrator Navia, part of a broader breach affecting 2.7 million people.

CVE-2026-33017, a CVSS 9.3 unauthenticated RCE in the open-source AI framework Langflow, was weaponized within 20 hours of its March 17 advisory with no public exploit code available.

DHL Supply Chain and Locus Robotics completed their one billionth autonomous warehouse pick, while DHL's new SOFTBOT platform enables robotic integration 12 times faster across 30 sites with plans to expand to 100.

A security researcher's disclosure of a prompt injection flaw in Cline's AI-powered GitHub issue bot was weaponized eight days later to steal npm publish tokens and install unauthorized software on developer machines.

Researchers say Git-sourced dependencies can re-enable code execution paths even when npm is run with --ignore-scripts, undermining a widely recommended mitigation after 2025’s Shai-Hulud worm.

A new class of high-entropy boride magnets made from earth-abundant metals achieves magnetic properties approaching rare-earth levels, offering a potential path to breaking dependence on Chinese-controlled supply chains for EVs, wind turbines, and electronics.