General Discussion

And going after certificates is a boon to deploying malware in commonly used open-source software. Every company that does CI/CD without seriously checking their dependencies is at risk.

Instead of standing on the shoulders of giants, companies are going to have to start treating software they didn't write as a vulnerability.