CycloneDX

Good Bear 1.0 Released: Firefox-Based Browser with Isolated Russian PKI Trust Container

Good Bear 1.0 is a Russian-language browser built on Firefox 156.0 that provides an isolated container for handling Russian PKI certificates without mixing trust contexts or user data with the standard browsing session. The release includes .deb packages for Ubuntu 24.04 LTS amd64 and Windows x64 installers, using Mozilla Public License 2.0 and reproducible build processes from pinned Firefox sources. Instead of globally importing root certificates, the browser performs secondary chain validation only inside a dedicated userContextId container with strict OriginAttributes isolation for caches, storage, and connections. Password autofill and sensitive session data are disabled in the container when separation cannot be guaranteed, and POST requests trigger explicit user choice before reopening in the isolated context. The interface shows both a persistent container marker and a separate RU indicator only when Russian PKI is actively used, along with detailed security panels explaining the trust source. Updates, crash reporting, and automatic MAR mechanisms are intentionally omitted to avoid creating unverified trust chains for the distribution itself.

Sapper Revives Minefield to Deliver Accurate SBOM-Based Vulnerability Impact Reports for Cyber Resilience Act Compliance

Developer Perruer has forked the archived BitBom project Minefield into a new open-source tool called Sapper, fixing critical bugs in dependency graph construction and vulnerability matching. The original Minefield used roaring bitmaps and Tarjan's algorithm to build transitive dependency caches from SBOMs in O(n + m) time, but it incorrectly interpreted SPDX edge directions from protobom 0.6, creating false cycles and massively inflating dependent package counts. Additional fixes addressed SQLite memory database pooling issues, OSV range sorting errors with Go pseudo-versions and ECOSYSTEM ecosystems, and slow OSV ingestion by adding a package name index. Sapper now produces prioritized reports using CISA KEV and EPSS scores, showing exact shortest paths from vulnerable packages to root products while respecting OpenVEX statements. The tool maintains full air-gapped operation and supports CycloneDX 1.3–1.7 and SPDX 2.x formats. These improvements directly help organizations meet the 24-hour notification requirements under the EU Cyber Resilience Act for actively exploited vulnerabilities.

Challenges in Building Accurate SBOMs for C and C++ Projects Highlighted by CodeScoring Analysis

C and C++ ecosystems lack centralized package manifests, making SBOM generation far more complex than in Python, Java, or JavaScript. Libraries may arrive through system package managers like apt or dnf, build tools such as Conan and vcpkg, or direct source inclusion, with no single record of all components. CodeScoring’s Johnny agent uses eBPF to observe linker commands during builds and cross-references results with dpkg, RPM, and pkg-config metadata. The analysis distinguishes build-time SBOMs, which capture static libraries and compilation commands, from runtime SBOMs that reflect dynamic dependencies at execution. When version data cannot be verified, components are explicitly marked unresolved rather than guessed. The approach also addresses header-only libraries and patched artifacts that defeat simple hash matching.

NEOMSA ESB Release Strengthens Supply Chain Security Through SBOM and Dependency Hardening

Neoflex has released a new version of its NEOMSA ESB integration platform with a primary focus on cleaning up the software bill of materials and eliminating critical and high-severity vulnerabilities. The team automated SBOM generation using CycloneDX, ran SCA scans with Grype and OWASP Dependency-Check, and performed SAST and secret scanning across all build pipelines. Instead of blindly updating to the latest versions, engineers applied minimal fixed versions for each advisory while handling complex cases involving transitive dependencies, locked files, and deprecated build tools. The effort reduced the total package count from 5,872 to 1,683 after migrating the frontend build to Vite in Camel Karavan 4.18. Remaining medium and low findings were tracked in DefectDojo with clear remediation timelines. The changes deliver measurable risk reduction for on-premise deployments in critical infrastructure and financial organizations.

NEOMSA APIM 4.6.0 Eliminates All Critical and High Vulnerabilities Registered in FSTEC BDU

Neoflex has released NEOMSA APIM 4.6.0 with a primary focus on strengthening the security of the platform's supply chain. The team generated an SBOM in CycloneDX format, scanned components and dependencies using Grype, and cross-referenced findings against the FSTEC BDU database. This process reduced total registered vulnerabilities from 57 to 7, completely removing all 10 Critical and 24 High issues. The platform now meets the formal Security Gate criterion requiring zero Critical or High vulnerabilities from the FSTEC database in the final build. Remaining Medium findings are documented and tracked for future updates. The release provides customers with a verified, transparent component inventory that simplifies compliance and integration reviews.

Understanding SCA: How Software Composition Analysis Helps Manage Software Supply Chain Risks

Software Composition Analysis (SCA) has emerged as a critical tool for organizations seeking to understand and control the risks hidden within modern applications built from third-party components, open-source libraries, container images, and transitive dependencies. SCA tools scan projects to identify components, versions, dependency chains, known vulnerabilities, and license issues, providing visibility that traditional security methods often miss. The approach supports SBOM generation and integrates with standards such as SPDX, CycloneDX, and VEX to improve transparency across the software supply chain. Organizations use SCA throughout the development lifecycle—from dependency selection and build-time gating to post-release monitoring—to reduce reaction time when new vulnerabilities appear and to manage technical debt, licensing conflicts, and abandoned packages. In regulated environments, including compliance with Russian standards like GOST R 56939-2024 and FSTEC requirements, SCA helps teams demonstrate control over software composition and prepare evidence for certification. While powerful, SCA is not a silver bullet: it relies on accurate data, cannot detect zero-days, and requires careful policy tuning to avoid alert fatigue or developer workarounds.