Mat Thomas

💥 The latest thing hitting your security team: burnout We surveyed 1,300 security leaders on the impact of AI on security teams, and 64% said AI-accelerated cyberattacks contributed to their burnout over the last year. More on how burnout weakens defenses and more in The AI Exploit Gap: chainguard.dev/unchained/the…

We 💜 our partners! Earlier this month, we brought together our EMEA-based partners for an Inaugural Partner Day ahead of Assemble London. Thank you to everyone who joined us, and a huge congrats to Somerford Associates and Alan&Eve, who were recognized for their outstanding partnership and customer impact in the Enterprise and Commercial segments, respectively. We couldn't do it without you!

Two critical PHP vulnerabilities (CVSS 9.2) were disclosed today, allowing unauthenticated RCE on default configurations. To help everyone patch fast we are making images for PHP 8.2, 8.3, 8.4, and 8.5 free for anyone to use. You can access them here: images.chainguard.dev/direct… Coordinated disclosure is hard, we appreciated everyone's help as we worked through this over the last several days.

🚨ICYMI: Here’s what we announced during the #Assemble26LDN keynote 🚨 🐕‍🦺 Chainguard Harness: find and remediate vulnerabilities with Claude Mythos 5.1 before they become zero-days. Now in beta. ✅ Chainguard Checks: a new CI-less approach to securing your builds, designed for how AI-driven development has changed what teams need from CI. CI jobs turn green up to 12x faster than traditional CI runs. Now in beta.

brought nothing to London for #Assemble26LDN 💂

this could be you at #Assemble26LDN see you (at the claw machines) on October 14, and happy #WorldOctopusDay! chainguard.dev/assemble-lond…

📩 INCOMING: Your #Assemble26LDN agenda 💫 Opening keynote: Chainguard vision and roadmap with @lorenc_dan and special guests, Daniela Hurtado, Craig Rice, and Tyler Biswurm

Auditors want proof, not labels 🏷️ Chainguard's Compliance Dashboard is now GA. For every image, you get the evidence auditors ask for like hardening scan results, ready-to-share compliance reports, FIPS certificates, and signed validation receipts tied to the exact image version you're running. Learn more: chainguard.dev/unchained/ann…

One poisoned skill is all it takes for your coding agent to turn against you ☠️ Chainguard Agent Skills are scanned and hardened to keep you safe. Erika Heidi shares more 👇 Get started with your own skill hardening: youtube.com/watch?v=5Tu_XOoQ…

_______________________ | #Assemble26LDN IS | | TWO WEEKS AWAY | |______________________| (◕ᴗ◕) || (((())))// 🐙 Join us in London: chainguard.dev/assemble-lond…

Today, we're starting Athena's disclosure program. The first release is 14 vulnerabilities that were quietly fixed in open source projects but never got a CVE, so they never popped up on your scanners. Each now has an advisory on our public VEX feed, a free patch in our GitHub repo, and a remediated artifact available in Chainguard Repository. Below, we show what these silent vulnerabilities can hide. Read more about Athena's disclosure process: chainguard.dev/unchained/ath…

🤦🤦🤦

Diane Morgan, writer, actor, and director best known as Philomena Cunk, is bringing the hard-hitting questions to #Assemble26LDN on October 14. Register here: chainguard.dev/assemble-lond…

how life feels when you have nothing to patch and everything to build ✨

▶️ Now playing: what engineers actually want to hear (not emergency triage calls, PagerDuty pings, and Slack alert storms). 🧘

"When Mythos finds zero-days, the coalition coordinates, pulls the findings, verifies them, builds the mitigations, pushes them upstream, and the whole ecosystem gets stronger." Protecting open source software from AI attacks takes all of us. The @BlackDuck_SW team talks about why they're proud members of Athena: chainguard.dev/unchained/ath…

"You could have a hundred billion evals and still not reach 100% accuracy. You can get close to perfect; you cannot get to perfect." New on This Shit is Hard 👉 @VinooGanesh and Sara Kromwijk of @kepler_ai_hq share how they index 26M SEC filings and make every number that comes out clickable and traceable back to the document, formula, or computation behind it. chainguard.dev/unchained/thi…

1️⃣,0️⃣0️⃣0️⃣,0️⃣0️⃣0️⃣,0️⃣0️⃣0️⃣! Six months ago, we crossed 500 million build manifests... today, we're celebrating ONE BILLION 🎉 We're building faster than ever, and delivering a catalog broad enough to cover the artifacts teams rely on with the underlying speed to keep every container up to date. Today, that catalog includes more than 3,000 unique container images (+1,000 in the last six months) and 675,000 image variants. chainguard.dev/unchained/wha…

Three weeks ago, we announced Athena, the industry coalition to protect open source software from AI attacks. Here’s where Athena stands today: • 40,000+ vulnerabilities processed, doubled since launch • 42% are critical- or high-severity • 86% are network reachable, meaning attackers can trigger them remotely • ~7% sit in packages more than five years old Frontier models are finding these vulnerabilities faster than any single team can respond. No one company can solve this alone. Today, we’re welcoming new members to the coalition: @Akamai, @BlackDuck_SW, @CycodeHQ, @jfrog, @MorganStanley, @qualys, @upwindsecurity, and @Zafran_io. More organizations mean more findings pooled and de-duplicated, which means fewer unique flaws left for an attacker to find first. It means more protection for the critical infrastructure we all rely on. Learn more: chainguard.dev/unchained/exp…