Driven by a “Liquid Software” vision, the JFrog Software Supply Chain Platform powers organizations to build, manage, and distribute software quickly & securely
🌎
Joined May 2009
- Tweets18.5K
- Following2.3K
- Followers23.3K
- Likes6.5K
#PHP2Shell. The #LiteLLM supply chain compromise. #Brotli2Shell.
Black October has given security leaders plenty of headlines—and one urgent question: “Are we exposed?”
How quickly could your team give a confident answer?
Knowing about an incident is only the beginning. You need to know whether the affected software is in your environment, where it’s being used, whether it’s exploitable, and what needs to happen next.
JFrog Field CISO Paul Davis explores why that seemingly simple question can take so much work to answer and what security leaders can do to close the gaps.
Read “Are We Exposed?” What CISOs Need to Know About Their Software Risk:
bit.ly/4igerOQ
#Cybersecurity #SoftwareSupplyChain #CISO
🏇The race that stops a nation: Every November, Australia stops for the Melbourne Cup where the best horses, the best preparation, and the best systems are all optimized for one moment that matters.
Your CI/CD pipeline deserves the same standard!
Because the only thing slower than a horse stuck in the gates is a pipeline throttled by Docker Hub rate limits at the worst possible moment.
JFrog Cloud Pro. Unlimited Docker pulls. Zero throttling. 99.9% uptime SLA.
Built for teams that can’t afford to be stopped at the gates.
$50/month through the end of carnival season — plus $200 in AWS credits for new signups.
Back a winner today: jfrog.com/cloud-pro
#MelbourneCup #DevSecOps #SoftwareSupplyChain #AI
Your desktop apps and your pipelines are both attack surfaces.
JFrog Security Research is at @owasp Global AppSec USA with two talks on how modern software gets broken:
💥 Yuval Moravchick shows how XSS in a Tauri app, a framework with 100k+ GitHub stars, can chain into full RCE. Info here: bit.ly/4zlL83t
💥 Barak Haryati shows how RepoHunter, an AI-driven research bot built in 48 hours, helped uncover 30+ critical CI/CD vulnerabilities across major open source and enterprise projects. Info here: bit.ly/3WfVqDA
Different targets, same lesson: small misconfigurations become big compromises. Add both sessions to your schedule!
#AppSec #OWASP #SoftwareSupplyChain #VulnerabilityResearch #DevSecOps
#AppSec knows what you built and scanned. #CloudSecurity knows what’s running. But neither team has the full security picture. 📸
On Tuesday, November 10 at 10am PT, JFrog and @wiz_io are showing how to close that gap with an agentless, API-driven integration:
→ One view of what’s running, who owns it, and whether it’s secure
→ Less alert noise, with runtime context tied to binary-level lineage
→ Day-one detection of shadow deployments and pipeline bypasses
Demo included. Save your seat: bit.ly/3VZt0h4
#AppSec #CloudSecurity #SupplyChainSecurity #CNAPP
ALT Webinar announcement titled "Closing the Gap Between Runtime and Fix: How JFrog and Wiz Integrate to Keep Pace With Frontier AI." Featured speakers are a product manager from Wiz and a senior manager from JFrog. The event is on November 10th at 10am PT. Includes logos for JFrog, Wiz, and Google, and a button to save your seat.
That is a wrap on our #Securing the Agentic #SoftwareSupplyChain evening in Mumbai! 🇮🇳 ✨
Leaders from across the financial services industry joined us for a closed-door evening of candid, thoughtful conversations on keeping software delivery secure in the age of #AIagents.
The big question on the table: as AI agents start pulling code, packages, and models on their own, how do you control what enters, act on real exposure, and prove exactly what you shipped?
A heartfelt thank you to Suman Banerjee and Gajendra Kanse for sharing real-world perspectives, and to every leader who gave us an evening of their time. 💚
We look forward to continuing these conversations! 🐸
#DevSecOps #EveryOps #DevGovOps
ALT Two individuals are seated on stage, engaged in a discussion. A small round table with water bottles and flowers is between them. In the background, there are logos and the words "Kotak Mahindra Bank" and "JFrog" visible on a screen.
Agents pull in code around the clock. Who inspects the models and plugins? 🐸
That was one of the questions on our minds at #DevOps summit NSW, where we had great conversations with industry leaders about building trust into the #AI driven #softwaresupplychain.
Thank you everyone who stopped by to chat. Already looking forward to the next one!
Missed catching up with us in Sydeny? Let's connect here: bit.ly/4uUKJ5S
Until the next one 🐸
#DevOpsSummit #DevSecOps #SoftwareSupplyChain
One workflow misconfiguration can hand an attacker your repository.
Barak Haryati, Senior Director of Product Security at JFrog, built RepoHunter in 48 hours.
It’s an AI-driven research bot that pairs static analysis with #LLM reasoning to find exploitable #CICD workflows at scale. This led to responsibly disclosing 30+ critical vulnerabilities across major open-source and enterprise projects.
At @owasp Global AppSec USA, he shows how these attacks work and how you can combine static analysis with AI reasoning to catch the next CI/CD supply chain attack before it ships.
If you own a pipeline, add this session to your schedule: bit.ly/3WfVqDA
#AppSec #OWASP #SoftwareSupplyChain #DevSecOps
🏆Announcing the winners of the first-ever JFrog Software Supply Chain Excellence Awards!
From securing #AI models to consolidating global developer workflows, congrats to our 9 honorees across the Americas, EMEA, and APAC: @Ford, Schottel Group, @RakutenSymphony, NVIDIA, Husqvarna, @SingaporeAir, @SPGlobal, TSB Bank, and Iress. 🚀
See how they transformed their #SoftwareSupplyChain into competitive advantages: bit.ly/4zXU7Ys
#SSCEA #FrogStars #DevSecOps #DevGovOps
🏁 In F1, where every millisecond counts, the teams that win aren't just the fastest on the straight.
They're the ones who eliminated every unnecessary slowdown before race day.
Rate limits, throttling, and downtime are the pit stops your pipeline never scheduled.
JFrog Cloud Pro: Zero pit stops, zero rate limits, and unlimited Docker pulls all with a 99.9% uptime SLA.
$50/month through the end of race season — plus $200 in AWS credits for new signups.
Sign up today: jfrog.com/cloud-pro
#F1 #DevSecOps #CI/CD #SoftwareSupplyChain
Nullcon Berlin brings researchers, hackers, and defenders together on November 5 to 6, and the JFrog team will be there!
Bring your toughest questions about #softwaresupplychain risk, open source packages, and securing what you ship.
Let’s talk about what’s actually working in the real world.
Schedule a meeting with the JFrog team at Nullcon Berlin: bit.ly/4zdSANY
#Nullcon #SoftwareSupplyChain #AppSec
Missed #swampUP Europe in Barcelona? Everything that happened on stage is coming to you. 🐸
Join us on 24 November for a virtual deep dive into the biggest announcements in #softwaresupplychain security, from #AI Security and #AgentSecOps to zero-touch remediation, self-healing SSC, and #DevGovOps at scale.
Register now: bit.ly/4ilX5ip
#swampUP #DevSecOps #TrustedIntelligence
#AI has broken the vulnerability research ecosystem.
While AI helps find complex zero-days faster, it is also flooding maintainers with low-effort "slop" and fabricated advisories. 📉
Key takeaways from JFrog's latest research include the effect on bug bounty programs, severity score inflation, NVD backlogs, the patching gap and more.
Read Part 1 of the series here: jfrog.co/4A1bCHD
#CyberSecurityAwarenessMonth #AppSec #AI #CVE #DevSecOps #OpenSource
🏆 We named the global winners of our inaugural Software Supply Chain Excellence Awards at #swampUP Europe…
Congratulations to @Ford, @NVIDIA, @SPGlobal, Iress, @RakutenSymphony, @SingaporeAir, @HusqvarnaGroup, @SCHOTTEL, and @TSBBank — the organizations proving that a trusted, governed #SoftwareSupplyChain is a competitive advantage in the #AI era. ✨
“The companies that pull ahead in the AI era will be those going beyond simply automating for speed and scale. They will be the ones who can see exactly what’s shipping, and why, they bring trust, control and adaptability. This year’s winners didn’t just add tools; they established a single source of truth where developers, security, and compliance teams can operate using the same data and the same rules. We’re very proud of all of them and thrilled to be part of their journey.”
🐸 Nine organizations. Three categories. Learn more: bit.ly/3WtkbfC
#DevSecOps #DevGovOps #AIGovernance #swampUP
How does a bank gatekeep software at scale? Today at "Securing the agentic SSC, Mumbai 2026" - Kotak Mahindra Bank tells the story.
Suman Banerjee, Executive Vice President, Engineering at Kotak Mahindra Bank and Sudhir Narla, VP Customer Success & GM India at JFrog, unpack Kotak’s journey to a cloud-native, curated supply chain, and what the agentic era means for trusted software in BFSI.
You’ll hear what it takes to build and release trusted software in a regulated, high-velocity environment, and how the agentic software supply chain changes the rules.
📅 27th October 2026
📍 Jio Convention Centre, BKC, Mumbai
Learn more: bit.ly/4jIvXMU
#SoftwareSupplyChain #DevSecOps #BFSI
Your code is moving at #agentic speed. So are the threats against it.
Today in Mumbai, Gajendra Kanse, AVP - Cyber & Information Security at NSE Clearing, joins Sidhesh Iyer Business Head - India, SEA & UAE at JFrog, for a fireside chat on #Securing the #SoftwareSupplyChain in Financial Markets.
You’ll learn how to protect the systems that keep markets running with trust, traceability, and control, and what changes when AI agents enter the software supply chain.
📅 27th October 2026
📍 Jio Convention Centre, BKC, Mumbai
#DevSecOps #BFSI #FinancialServices #CyberSecurity
Your Rust backend is memory-safe. Your XSS can still be an RCE.
Tauri has 100k+ stars on GitHub, and its allowlist model looks airtight on paper. But the model is only as strong as the config behind it.
At @owasp Global AppSec USA, Yuval Moravchick, Vulnerability Research Team Leader at JFrog, shows how a full RCE chain broke a popular app ecosystem with 50k+ stars, and how you can write safer Tauri apps.
If you build or audit desktop apps, save this session to your schedule: bit.ly/4zlL83t
#AppSec #OWASP #Tauri #VulnerabilityResearch
Your #developers are using #AI agents to ship code. Attackers are using AI to break it.
Ronen Lewit, VP Strategics and Field CTO at JFrog, will break down how to stay in control of both at GitHub Universe.
You’ll see how the JFrog and @github integration helps you protect, remediate, and govern the agentic software supply chain, so you can move at agentic speed with trust.
Save your spot: bit.ly/4jdb9g9
#GitHubUniverse #SoftwareSupplyChain #AIAgents #DevSecOps
ALT This image is a promotional graphic for a talk at JFrog's Universe 2026 event. It features a person identified as Ronen Lewit, VP Strategics and Field CTO of JFrog. The talk's topic is "How JFrog Protects, Remediates, & Governs the Agentic Software Supply Chain," scheduled for October 28 at 11:50am at Gateway Pavilion. The background includes a city skyline with a bridge.