Patchstack

EmDash hit 1.0 this week. Cloudflare's open source CMS for Astro. It's a lovely bit of work. Congrats Matt Kane and Matt Taylor They launched it as "the spiritual successor to WordPress that solves plugin security," citing our research twice to make the case. 96% of WordPress security issues start in plugins. They're right. Every plugin runs in its own sandbox and can only do what it declared it needs, which is exactly how it should have worked all along. So I built something with Em. One prompt. "Create a simple todo list site with em dash" 744 packages. One reachable, exploitable vulnerability sat there on day one. An XSS in dompurify, disclosed back in March. Zero plugins installed. Plugin security: solved. The other door was never locked. Thats not a dig at EmDash. Its the whole point. Sandboxing shuts the plugin vector and npm strolls in through the dependency tree, and no framework, CMS or AI builder on earth opts out of that. Same 6 month old advisory, brand new stack. And the industrys answer is still shift left. Scan the repo, raise a pull request, feel productive. Meanwhile the thing actually exposed is in production and time to exploit is down to hours. Patchstack for JavaScript starts where the danger is. Build with EmDash, build with Lovable, build with whatever launches next month. You stay protected on the live app while the vulnerable package is still sat there, and you update when youre ready rather than when the shit hits the fan. Safe the same way you when using Patchstack for WordPress Early access is open. Works just as well on EmDash as anything else in this new wave. 🔗 https://lnkd.in/ebsXcXtz

Most security tools available for the Javascript (and for most AI generated apps) are either built for software engineers or security teams. Today, we'll change that. We're opening early access to Patchstack for Lovable, Replit, Base44 and for any hosted NodeJS applications. Patchstack monitors the codebase for security vulnerabilities in real-time, performs reachability analysis and automatically mitigates exploitable security vulnerabilities without the need to upgrade packages, make any of the changes to the codebase and without having to rebuild the application. Without the fear of breaking the app. Additionally, it comes with Patchstack Live Hardening, which restricts the app from leaking out secrets, API keys and other sensitive information. Security must be easy not to be ignored, so you can use and control Patchstack directly where you're building your app - inside Lovable, Replit, Base44 and other AI builder workspace. For professionals, you get the security overview and full control over every application within the single dashboard, regardless where the app is built or hosted. We've been using this by ourself for a while, as like most companies today, our team too has has built many internal dashboards and apps to automate the day to day work. Patchstack is the user of Patchstack, and it has given us full visibility over what our team has built and confidence that it's all under control. Apply for early access here:

Weeks. Then days. Then five hours. That's how fast a WordPress vulnerability has gone from "discovered" to "actively exploited," according to Patchstack's own numbers, and it's still getting faster. In today's episode of Community + Code, Maciek Palmowski explains why — and what happens when your bug bounty program gets flooded with AI-generated reports faster than your team can read them. Check out the episode here: https://lnkd.in/gntQVMMq

Today, EU Cyber Resilience Act Article 14 came into full power. Digital products (and software like WordPress plugins, etc.) that are made available to EU users must report known exploited vulnerabilities and severe security incidents to EU within 24 hours. Since at Patchstack we have coordinated 10K+ CVE's and already act as a security point of contact for over 1000 open source products - we decided to take a step further and entirely manage the CRA Article 14 for them. Due to our partnerships with the leading web hosting companies in the world and the accuracy and scale of Patchstack RapidMitigate – we are actually uniquely positioned to provide the fastest and most detailed known exploited vulnerabilities (KEVs) detection on the market. So, I'm excited to announce that open source maintainers who need to comply with the Article 14 can now user Patchstack to: - Get automatic vulnerability exploitation monitoring, evidence reporting and real-time alerts. - Completely automate Article 14 reporting where Patchstack acts as the Assigned Representative (AR) and submits the reports in time for compliance. - Next year, CRA will also require VDPs and a single-channel vulnerability reporting. That's already available as well. Oh, and it's all free. 🫡 https://lnkd.in/daG3Wb_3