September 23, 2026
Closing the Chain: How to reduce your risk of being SolarWinds, Log4j, or XZ Utils
A new paper by Sivana Hamer, Jacob Bowen, Md Nazmul Haque, Robert Hines, Chris Madden, and Laurie Williams, published at ICSE, analyzes the SolarWinds, Log4j, and XZ Utils supply chain attacks against ten existing security frameworks — including the SSDF — to find which mitigations matter most and where the frameworks still fall short. The gaps it identifies are exactly the kind of cross-framework blind spot P-SSCRM is meant to close.
Read the paper: arxiv.org/abs/2503.12192.