Why software supply chain security is the next accountability challenge for channel partners

itpro.com Aug 19, 2026

Why software supply chain security is the next accountability challenge for channel partners

Curated by Shubham · TechCapsules · Aug 19, 2026

AI-summarised brief · reviewed before publication

Modern applications increasingly rely on open-source packages and third-party dependencies, shifting accountability for security breaches to channel partners who manage these environments. Despite public disclosures, organizations often delay remediation, running vulnerable dependencies long after Common Vulnerabilities and Exposures (CVEs) are published. CVE volume has surged 263% since 2020, with a further 33% increase projected for 2026, overwhelming security teams. Managed Service Providers frequently inherit complex environments they did not architect, complicating mitigation efforts. AI-assisted development accelerates code creation but increases third-party dependency volume. Limited adoption of Software Bills of Materials and inaccurate severity scoring hinder effective triage. Consequently, attackers target shared tooling and open-source repositories, exploiting trusted components. This shift renders traditional perimeter security obsolete, as nation-state actors and cybercriminals leverage compromised dependencies to simultaneously breach multiple customer environments at unprecedented speed and scale.

💡 Why It Matters

· Channel partners face unprecedented liability as they become the primary line of defense against sophisticated supply chain attacks.
· This shift forces a fundamental reevaluation of risk management strategies beyond traditional infrastructure security.

Capsules Cybersecurity

Read full article on itpro.com

The Pokémon Company Cancels 30th Anniversary Card Orders Following ‘Cyber Incident,’ Warns…

The Pokémon Company has cancelled all 30th Anniversary Card orders linked to a cyber incident that exposed customer data. The breach involved CEVA, the logistics partner handling European shipments, and may have compromised names, addresses, phone numbers, emails, and order contents. Pokémon Center staff notified affected customers via email, explaining the data exposure. The company has not clarified why orders were cancelled or the extent of the impact, leaving many pre‑orders voided. The incident adds to ongoing concerns over card scarcity and scalping.

💡 The cancellation signals a severe breach of consumer trust, potentially eroding confidence in Pokémon’s digital sales channels. It also underscores the vulnerability of third‑party logistics in protecting personal data.

infosecurity-magazine.com · Aug 19

European Space Agency Confirms Server Breach

Europe’s space agency confirmed that hackers accessed servers outside its corporate network last month, compromising data used for unclassified collaborative engineering. ESA said a forensic analysis is underway and only a small number of external servers appear affected. The breach was first hinted at in a BreachForums post on Dec. 18, where a threat actor claimed to have exfiltrated over 200 GB, including private Bitbucket repositories, source code, CI/CD pipelines, API tokens, configuration files and hard‑coded credentials. ESA has informed stakeholders, secured potentially affected devices and will issue updates. Experts warn the stolen information could enable supply‑chain attacks, underscoring the growing attack surface of distributed space‑technology collaborations and the sector’s struggle to meet EU cybersecurity mandates and to protect future mission data.

💡 The incident proves that seemingly low‑value engineering data can serve as a gateway for deeper supply‑chain sabotage, compelling space agencies to tighten security around open‑collaboration frameworks.

prnewswire.co.uk · Aug 19

Bybit Strengthens Security Defences Against Evolving Crypto Threats, Intercepting $700 Million in…

Bybit, the world’s second‑largest crypto exchange, released its H1 2026 Risk & Security Report detailing a multi‑layered defense upgrade after a February 2025 hack that stole roughly $1.46 billion. The new system combines user‑account safeguards, full‑coverage on‑chain monitoring and AI‑assisted threat detection to shorten detection‑to‑response times. In the first half of 2026 the platform blocked over 30,000 dubious withdrawal attempts, shielding nearly 20,000 users from more than $700 million in potential losses, with an average initial review of 4.7 minutes and 95 % completed within ten minutes. Bybit also flagged $212 million in suspicious on‑chain funds, blacklisted over 10,000 malicious addresses, and handled ten token‑project security incidents without any platform losses, often acting faster than rival exchanges.

💡 Bybit’s rapid, AI‑driven interception demonstrates that real‑time, data‑centric security can materially protect users and curb fraud in a market where billions are routinely targeted.

thehackernews.com · Aug 19

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal…

Check Point Research has uncovered a global cybercrime operation dubbed StopAndProtect that hijacks nearly 2,000 WordPress sites to deliver a multi‑component malware toolkit. The campaign begins with a ClickFix‑style social‑engineering prompt that triggers a PowerShell command, launching .NET downloaders and loaders which install ransomware, a SMB/USB worm, lock‑screen modules, a VBS spreader, a chat utility and credential stealers. The actors also exfiltrate files, screenshots and WhatsApp data, using a custom WordPress MU plugin that permits arbitrary file uploads and remote code execution. Researchers observed operational‑security mistakes that exposed infection logs and over 700 data archives, including internal development tools. Most compromised sites run outdated WordPress versions with dozens of known vulnerabilities, facilitating the fake CAPTCHA injection against unsuspecting visitors worldwide.

💡 By turning compromised blogs into a distributed malware delivery network, the attackers bypass traditional defenses and reach victims directly through trusted web traffic, dramatically widening the attack surface.

infosecurity-magazine.com · Aug 19

Web3 Platform Mixin Network Hit by $200m Crypto Hack

Hong Kong‑based decentralized finance project Mixin Network disclosed a cyber‑attack that compromised its cloud service provider’s database on September 23, 2023, resulting in the loss of roughly $200 million in cryptocurrency. The breach forced the platform to suspend deposit and withdrawal services while transfers remained operational, and Mixin enlisted Google and blockchain security firm SlowMist to investigate. Founder Feng Xiaodon addressed users in a live Mandarin briefing on September 25, outlining remediation steps, and the project later reported a $30 million drop in total value locked, according to DeFi Llama. Launched in 2017, Mixin’s XIN token supports cross‑chain transactions for about 10,000 DApps. The incident ranks as the fifth‑largest crypto hack outside exchanges, trailing incidents such as Ronin, Poly Network, BNB Bridge and Wormhole.

💡 The hack exposes the vulnerability of “decentralized” platforms that still depend on centralized cloud infrastructure, challenging the core security premise of Web3.

arcamax.com · Aug 19

Jim Rossman: Spam activity is picking up

Journalist Jim Rossman reports a noticeable increase in sophisticated spam emails bypassing standard Google filters. These messages, often appearing to come from generic personal addresses like Hotmail, utilize full-screen graphics rather than text to evade detection. Recent examples include fake notifications claiming cloud storage subscriptions from Apple, Google, or Microsoft have expired, warning users of permanent data deletion. Another variant falsely states Amazon Prime Video memberships have lapsed. The emails contain malicious links disguised as renewal buttons. When hovered over, browsers often flag these links as insecure or potential scams. Rossman advises readers to report such messages as spam immediately. He emphasizes the importance of verifying account statuses through official login portals rather than clicking email links. Users should never provide login credentials or payment information via unsolicited emails. This surge in graphic-based phishing attempts highlights evolving tactics used by cybercriminals to trick recipients into revealing sensitive personal and financial data.

💡 Attackers are exploiting visual content to bypass text-based security filters, forcing users to rely on manual verification rather than automated protection.