Sonatype

Nearly 86% of open source vulnerabilities tracked by Sonatype last week weren't scored by the NVD. When Sonatype Research Labs reviewed 1.6K, it rated almost half Critical or High severity. Developers and AI agents need timely intelligence to make safer dependency decisions. Not just what's in public databases.

What does Ethereum have to do with an npm package? In six submitted AdminIDE Stack releases, a concealed loader queried transaction data to find its next JavaScript stage. The blockchain was part of the delivery mechanism. Sonatype’s findings: guide.sonatype.com/security-event…

How does Maven Central handle malicious packages, and where do the registry’s responsibilities end? We’re discussing it on r/MavenCentral, where the Central team is active and can join the conversation.

reddit.com/r/MavenCentral…

A certificate compromise can leave trust behind in places developers may not think to check. We published script to help audit developer environments for eMudhra certificates. It’s read-only by default, with optional fixes. Review the safety notes before using fix mode: github.com/sonatype-nexus…

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated remote code execution.

Inventory PHP across your services and products. Prioritize internet-facing systems, assign remediation owners, and patch promptly. For older versions, check with your vendor for backported fixes.

Details: guide.sonatype.com/security-event…