Driven by a “Liquid Software” vision, the JFrog Software Supply Chain Platform powers organizations to build, manage, and distribute software quickly & securely
🌎
Joined May 2009
- Tweets18.5K
- Following2.3K
- Followers23.3K
- Likes6.5K
🪔 This Diwali, don’t let rate limits dim your pipeline.
JFrog Cloud Pro is giving new customers a limited time deal + $200 in #AWS credits to get started!
The Festival of Lights is a celebration of brilliance, prosperity, and new beginnings. Your CI/CD pipeline should feel the same way.
Start your new beginning today: jfrog.com/cloud-pro
#Diwali #SoftwareSupplyChain #DevSecOps
ALT A JFrog promotional graphic features the text "Light Up Your Pipeline This Diwali" and advertises world-class artifact management for $50 per month. There's an illustration of a candle integrated into a network of connected cloud and cube designs. A green "Start Building with Pro" button is at the bottom.
JFrog Security Research is heading to @owasp Foundation Global AppSec USA TOMORROW to show how trust assumptions in modern tooling can be turned against you.
☝🏼Yuval Moravchick breaks down how XSS in Tauri apps can lead to RCE: bit.ly/4zlL83t
✌🏼 Barak Haryati shows how an AI-driven bot found 30+ critical CI/CD vulnerabilities across major open source and enterprise projects: bit.ly/3WfVqDA
Whether you ship desktop apps or run pipelines, both sessions give you something to act on.
Two talks, two attack surfaces, and plenty of takeaways for your team.
#AppSec #OWASP #SoftwareSupplyChain #VulnerabilityResearch #DevSecOps
Recognized as a Leader in the Gartner® Magic Quadrant™ for Software Supply Chain Security, JFrog serves as the vital 'trust layer' for organizations navigating the AI era, proving that robust security doesn't have to slow down development.
Securing the #SoftwareSupplyChain requires a unified system of record vs. an array of disconnected tools.
Learn why JFrog was recognized with a complimentary copy of the full report: bit.ly/4agwK1Z
#DevSecOps #DevGovOps #AI #Governance
That is a wrap on our roundtable evening in Bangkok! 🇹🇭 ✨
Security leaders from banking, financial services, and the public sector across Thailand joined us for a candid, practical conversation on #securing the #softwaresupplychain.
With regulatory expectations rising and supply chain attacks growing in scale, the discussion focused on what it takes to ship software with confidence.
A heartfelt thank you to every leader who made time to join us, share their experiences, and ask the questions that made the discussion so valuable. 💚
And thank you iZeno for co-hosting this evening with us. 🐸
We look forward to continuing the conversation!
#DevSecOps #CyberSecurity #EveryOps
Attackers are using AI to find #CICD flaws. Defenders can too.
Barak Haryati, Senior Director of Product Security at JFrog, built RepoHunter to hunt exploitable workflows at scale. His research surfaced worm-like CI/CD attack patterns before they showed up in real-world incidents.
At @owasp Global AppSec USA, he walks through how these attacks work and how you can pair static analysis with #AI reasoning to stop the next one.
Add the session to your schedule:
bit.ly/3WfVqDA
#AppSec #OWASP #SoftwareSupplyChain
More code. More CVEs. More chaining. But only the same number of hours in the day.
When AI-generated code and CVE chaining outpace manual triage, “fix everything” isn’t a strategy. Runtime context tied to binary-level lineage helps you focus on what’s actually exploitable.
See how JFrog and Wiz make it work: Nov 10, 10am PT: bit.ly/3VZt0h4
#AppSec #VulnerabilityManagement #FrontierAI
The #MelbourneCup stops a nation. A Docker Hub rate limit stops your pipeline. 🏇🐸
Only one of those is acceptable.
This Spring Carnival season, JFrog Cloud Pro is giving new customers a limited time deal — plus $200 in AWS credits to get started.
Unlimited Docker pulls. Zero throttling. 99.9% uptime SLA. One system of record for every artifact, every model, every build.
Because the only race your pipeline should be running is the one to production.
Back a winner this Spring Carnival: jfrog.com/cloud-pro
#SoftwareSupplyChain #DevSecOps
The exploit window used to be weeks. Now it’s hours.
At #swampUP Europe, JFrog, @Broadcom, @Chainguard_dev, @Follow_our_Echo, and @RedHat agreed: organizations can no longer rely on manual vulnerability triage and patching, and you can’t patch what you cannot see.
Resilience in the #AI era starts with a single source of truth.
Learn more: bit.ly/47Sn4t0
#DevSecOps #DevGovOps
#AIagents are now writing and shipping code faster than most teams can review it. So how do you trust what ships?
#JFrogAfterHours, with @AWS, takes over a private cellar bar in Melbourne for a candid conversation with four women leading through the shift: Bernadeth Lucanas, DJ Acornley, Jeanine French and Shani Levy.
They’ll start with their paths into leadership, dig into governance, culture and resilience in the AI era, and close with advice for the next generation of leaders. Plus the latest from #swampUP2026 and a mixologist taking over for the final hour.
📅 Thus, 26 November 2026
⏰ 5:00 – 8:00 PM
📍 Death & Co., The Cellar Bar, Melbourne
Spaces are limited. Register here: bit.ly/4ijo3Hq
#AWS #CyberResilience #TrustedAI #WomenInTech #SoftwareSupplyChain #SoftwareDevelopment #AI #Melbourne
Can an XSS in a Tauri app really become RCE? Yes.
Tauri has 100k+ stars on GitHub, and developers trust its allowlist model to keep the damage contained. Yuval Moravchick, Vulnerability Research Team Leader at JFrog, shows where that trust breaks.
At @owasp Global AppSec USA, you’ll see a full exploit chain against a popular app ecosystem with 50k+ stars, plus more PoCs on widely used apps. You’ll also leave with practical ways to harden your own Tauri apps.
Save the session to your schedule:
bit.ly/4zlL83t
#AppSec #OWASP #Tauri #DesktopSecurity
Your physical #AI companion might be watching you 👁️🗨️
JFrog Security Research uncovered 5 chained CVEs in an open source AI robot.
Due to unauthenticated FastAPI daemons, wildcard CORS, and passwordless sudo, an attacker on the same LAN or via a rogue webpage can gain root, spy via mic/cam, and hijack the motors 🕹️🪛
Check out our blog for details: bit.ly/4yTTK07
#ReachyMini #RoboticsSecurity #AppSec #CyberSecurity #IoT #InfoSec #SupplyChainSecurity
That is a wrap on our roundtable evening in Singapore! 🇸🇬 ✨
Security and technology leaders from across the region joined us for an evening of practical conversations about the future of software delivery in the age of AI. ⚡️
Here’s what stood out:
🔹 Blind spots in modern #software delivery
🔹 Governing the risks of #AI-generated code and expanding agentic workflows
🔹 Building a consistent, scalable standard for software provenance
A heartfelt thank you to everyone who took the time to join us and share what they are seeing on the ground. Your perspectives made the evening worthwhile. 💚
We look forward to continuing these conversations. If you missed this one, stay tuned for what’s coming next in the region! 🐸
#DevSecOps #SoftwareSupplyChain #EveryOps #JFrogroundtable
🌟 JFrog has been named a Leader in the first Gartner® Magic Quadrant™ for Software Supply Chain Security; placed highest in Ability to Execute.
The industry is finally recognizing a hard truth:
You cannot secure the #SoftwareSupplyChain by securing one element alone or securing after the fact.
Modern software is built from thousands of components, generated by #AI, assembled by pipelines, and increasingly touched by agents. Security that starts at the end of that process starts too late.
That's why JFrog was built differently. We embed security into the core of how software is created, managed, and delivered, so protection is there at every stage.
Read the blog to learn how we are shifting the industry toward a secure, self-healing software supply chain: bit.ly/3SfWaXy
#DevSecOps #DevGovOps #Governance
📣 Attention self-managed JFrog users: Linux kernel vulnerability CVE-2026-98432 poses a critical risk to underlying host OS environments.
While JFrog products aren't vulnerable, some use MPTCP and could be affected by your host kernel vulnerability.
What to do:
🔍 Check your kernel changelog
🛡️ Patch and reboot immediately
🔒 Restrict network access if no patch exists yet
Learn how to secure your setup: bit.ly/3WJI96p
#Linux #CyberSecurity #DevOps #CVE202698432
Malicious packages and compromised build pipelines rarely announce themselves.
@nullcon Berlin on 5 to 6 November brings #softwaresupplychain research, from dependency compromise to CI/CD attacks, together with the people who uncover these threats.
Come meet the JFrog team to compare notes on securing what you build and ship.
Schedule a meeting with us: bit.ly/4zdSANY
#NullconBerlin2026 #AppSec #DevSecOps
#PHP2Shell. The #LiteLLM supply chain compromise. #Brotli2Shell.
Black October has given security leaders plenty of headlines—and one urgent question: “Are we exposed?”
How quickly could your team give a confident answer?
Knowing about an incident is only the beginning. You need to know whether the affected software is in your environment, where it’s being used, whether it’s exploitable, and what needs to happen next.
JFrog Field CISO Paul Davis explores why that seemingly simple question can take so much work to answer and what security leaders can do to close the gaps.
Read “Are We Exposed?” What CISOs Need to Know About Their Software Risk:
bit.ly/4igerOQ
#Cybersecurity #SoftwareSupplyChain #CISO
🏇The race that stops a nation: Every November, Australia stops for the Melbourne Cup where the best horses, the best preparation, and the best systems are all optimized for one moment that matters.
Your CI/CD pipeline deserves the same standard!
Because the only thing slower than a horse stuck in the gates is a pipeline throttled by Docker Hub rate limits at the worst possible moment.
JFrog Cloud Pro. Unlimited Docker pulls. Zero throttling. 99.9% uptime SLA.
Built for teams that can’t afford to be stopped at the gates.
$50/month through the end of carnival season — plus $200 in AWS credits for new signups.
Back a winner today: jfrog.com/cloud-pro
#MelbourneCup #DevSecOps #SoftwareSupplyChain #AI
Your desktop apps and your pipelines are both attack surfaces.
JFrog Security Research is at @owasp Global AppSec USA with two talks on how modern software gets broken:
💥 Yuval Moravchick shows how XSS in a Tauri app, a framework with 100k+ GitHub stars, can chain into full RCE. Info here: bit.ly/4zlL83t
💥 Barak Haryati shows how RepoHunter, an AI-driven research bot built in 48 hours, helped uncover 30+ critical CI/CD vulnerabilities across major open source and enterprise projects. Info here: bit.ly/3WfVqDA
Different targets, same lesson: small misconfigurations become big compromises. Add both sessions to your schedule!
#AppSec #OWASP #SoftwareSupplyChain #VulnerabilityResearch #DevSecOps
#AppSec knows what you built and scanned. #CloudSecurity knows what’s running. But neither team has the full security picture. 📸
On Tuesday, November 10 at 10am PT, JFrog and @wiz_io are showing how to close that gap with an agentless, API-driven integration:
→ One view of what’s running, who owns it, and whether it’s secure
→ Less alert noise, with runtime context tied to binary-level lineage
→ Day-one detection of shadow deployments and pipeline bypasses
Demo included. Save your seat: bit.ly/3VZt0h4
#AppSec #CloudSecurity #SupplyChainSecurity #CNAPP
ALT Webinar announcement titled "Closing the Gap Between Runtime and Fix: How JFrog and Wiz Integrate to Keep Pace With Frontier AI." Featured speakers are a product manager from Wiz and a senior manager from JFrog. The event is on November 10th at 10am PT. Includes logos for JFrog, Wiz, and Google, and a button to save your seat.
That is a wrap on our #Securing the Agentic #SoftwareSupplyChain evening in Mumbai! 🇮🇳 ✨
Leaders from across the financial services industry joined us for a closed-door evening of candid, thoughtful conversations on keeping software delivery secure in the age of #AIagents.
The big question on the table: as AI agents start pulling code, packages, and models on their own, how do you control what enters, act on real exposure, and prove exactly what you shipped?
A heartfelt thank you to Suman Banerjee and Gajendra Kanse for sharing real-world perspectives, and to every leader who gave us an evening of their time. 💚
We look forward to continuing these conversations! 🐸
#DevSecOps #EveryOps #DevGovOps
ALT Two individuals are seated on stage, engaged in a discussion. A small round table with water bottles and flowers is between them. In the background, there are logos and the words "Kotak Mahindra Bank" and "JFrog" visible on a screen.
