Mend.io Blog

PHP2Shell: the fix is a runtime upgrade, not a code change

Alina Podoba Oct 21, 2026
Malicious Packages

Two critical PHP RCE flaws: who is exposed and how to find every runtime.

[Read More](/content/blog/php2shell-php-rce-cve-2026-109618/ "Read More"/index.html)

Compromised LiteLLM 1.107.0 on PyPI Ships a Credential Stealer and Code Loader

Alina Podoba Oct 21, 2026
Malicious Packages

LiteLLM 1.107.0 shipped a credential stealer and remote code loader on PyPI.

[Read More](/content/blog/litellm-1-107-0-compromised/ "Read More"/index.html)

Your AI agent is sandboxed. Its data still needs guardrails.

Ashley Delfonso Oct 15, 2026
AI Models Risk

Docker Sandboxes contains your agent. Mend AI Guardrails checks what it sends.

[Read More](/content/blog/docker-sandboxes-ai-guardrails/ "Read More"/index.html)

Mend.io upgrades 184 open source organizations to the Renovate Community (OSS) plan

Jamie Tanna Oct 8, 2026
Inside Mend.io

184 open source organizations now have the Renovate Community (OSS) plan.

[Read More](/content/blog/renovate-community-oss-plan-upgrades/ "Read More"/index.html)

NIST SSDF: 4 core practices for secure software development

Stephanie Broyles Oct 6, 2026
Compliance

What the NIST SSDF requires and how to implement its four practice groups.

[Read More](/content/blog/nist-ssdf-secure-software-development/ "Read More"/index.html)

What Is AI Governance? A Practical Framework for Security Teams

Tiffany Jennings Oct 1, 2026
Compliance

How security teams turn AI governance into an operational practice.

[Read More](/content/blog/what-is-ai-governance/ "Read More"/index.html)

Detection scaled. The loop did not.

Asaf Saar Sep 10, 2026
Application Security

Findings got cheap. Verified closure did not. That gap is the AppSec problem.

[Read More](/content/blog/appsec-remediation-gap-detection-scaled/ "Read More"/index.html)

Mend Renovate Enterprise: managing dependencies at agentic scale

Iris Kaminer Sep 3, 2026
Dependency Updates

How Mend Renovate Enterprise keeps dependency updates flowing at agentic scale.

[Read More](/content/blog/mend-renovate-enterprise-agentic-scale/ "Read More"/index.html)

Mini Shai-Hulud hits openapi-react-query-codegen: 10 malicious npm versions

Alina Podoba Aug 29, 2026
Malicious Packages

An npm supply chain attack published ten malicious versions.

[Read More](/content/blog/mini-shai-hulud-hits-openapi-react-query-codegen/ "Read More"/index.html)

The skill layer is a dependency problem without a lockfile: what the OWASP Agentic Skills Top 10 gets right

Asaf Saar Aug 26, 2026
AI Models Risk

Nine solved supply chain risks, one new gap: the OWASP Agentic Skills Top 10.

[Read More](/content/blog/owasp-agentic-skills-top-10-supply-chain-security/ "Read More"/index.html)

OWASP LLM Top 10 2026: the model will be fooled, the question is what breaks

Asaf Saar Aug 13, 2026
AI Models Risk

The 2026 OWASP LLM Top 10 shifts the job from prevention to containment.

[Read More](/content/blog/owasp-llm-top-10-2026/ "Read More"/index.html)

EU AI Act: risk tiers, timeline, and compliance requirements

Tiffany Jennings Aug 11, 2026
Compliance

Risk tiers, deadlines, and compliance steps under the EU AI Act.

[Read More](/content/blog/eu-ai-act/ "Read More"/index.html)

That’s a wrap: Mend.io at Black Hat USA 2026

Stephanie Broyles Aug 7, 2026
Inside Mend.io

Mend.io at Black Hat USA 2026: keynote, podcasts, awards, and a hit booth game.

[Read More](/content/blog/mend-io-black-hat-usa-2026/ "Read More"/index.html)

Patch faster isn’t the answer. Patch smarter is.

Shannon Davis Aug 4, 2026
Dependency Updates

AI killed the patch window. Smarter patch management is how teams keep up.

[Read More](/content/blog/smarter-patch-management/ "Read More"/index.html)

Mini Shai-Hulud Hits keyv: Trojanized Release Exfiltrates CI Secrets via GitHub

Alina Podoba Aug 4, 2026
Malicious Packages

Trojanized keyv@6.0.0 exfiltrates CI secrets through GitHub’s own API.

[Read More](/content/blog/keyv-malicious-packages/ "Read More"/index.html)

EU CRA explained: requirements, timeline, and compliance

Tiffany Jennings Jul 30, 2026
Compliance

What the EU CRA requires, key deadlines, penalties, and how to comply.

[Read More](/content/blog/eu-cyber-resilience-act-compliance-guide/ "Read More"/index.html)