InfoQ - Software Supply Chain - News

Leading Open Source Author Calls for Verification over Trust in Software Supply Chains

Matt Saunders — Thu, 07 May 2026 07:00:00 GMT

In a blog post published in March 2026, Daniel Stenberg, creator and lead developer of curl, makes the case that the software industry's default position of trusting well-known components is no longer adequate. Stenberg argues that users and organisations should actively verify the software they consume, and he uses curl's own practices as a concrete example of how that can be done.

By Matt Saunders

Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them

Steef-Jan Wiggers — Wed, 06 May 2026 10:00:00 GMT

An attacker purchased 30+ WordPress plugins on Flippa for six figures, planted a PHP deserialization backdoor in the first commit, and waited eight months before activating it across 400,000 installations. The attack used Ethereum smart contracts to resolve C2. WordPress.org has no mechanism for reviewing plugin ownership transfers, a gap that npm and PyPI addressed years ago.

By Steef-Jan Wiggers