← Back to articles
Supply ChainMembers
Inside the Black Hat Briefings: The Talks That Broke the Internet
By M. Okafor · July 2, 2026 · 12 min
A recap of the Briefings sessions that dropped 0-days, embarrassed vendors, and rewrote threat models on the show floor.
Signed provenance is now table stakes for public registries, but private mirrors and internal artifact stores are lagging by 18 months.
The interesting attacks this year weren't typosquats — they were maintainer takeovers on packages with 4-figure weekly downloads and a single owner.
If your SBOM pipeline can't answer 'who signed this build, and on what runner?' in under a second, you're not ready for the next incident.