Nearly 2m malicious packages total. In Q3, 74% of overtly malicious packages involved droppers, secrets exfiltration, or both. Stopping malicious components at the source matters because once they’re inside development, the cleanup gets a lot harder. www.sonatype.com/blog/q3-2026...

Maven Central publishing limits are now in effect. Most community open source publishers can continue publishing for free. Check your organization’s usage, and share feedback as you have it. Usage: central.sonatype.com/publishing/u... Limits and guidance: central.sonatype.org/publish/mave...

New vulnerability? Malicious package making the rounds? We’re keeping the latest major security events, affected components, and what developers need to know here: guide.sonatype.com/security-eve...

91 Spring CVEs → 209,569 affected components. That’s a lot more than 91 things to check. Guide turned a massive coordinated disclosure into something developers can act on, with the affected components, versions, and vulnerability context in one place ↓ guide.sonatype.com/security-eve...

For all the new AI security problems, one of Black Hat's loudest messages was remarkably old-school: assume something will get fooled and design so it can't do much damage when it does. Field notes from Vegas: www.sonatype.com/blog/major-t...

Major Themes at Black Hat 2026

Black Hat explored AI's growing security impact, from vulnerability discovery and prompt injection to why least privilege and security basics still matter.

sonatype.com

The @sdtimes.bsky.social Editorial Board captured that shift in this year's SD Times 100, recognizing Sonatype alongside other organizations helping development and security teams build with greater confidence. Read the full list: 🔗 sdtimes.com/security/sec...

Every AI system has a supply chain and models are only part of the picture. Datasets, open source components, APIs, and agents all shape how AI behaves and where risk can emerge. Great insights from Kate O'Flaherty and Ilkka Turunen: 🔗 insight.scmagazineuk.com/what-is-an-a...

We promise not to post "We're excited to announce..." We'd rather show you how attackers are changing software development, what AI means for open source, and the research behind it, drawing on insights from Maven Central, Nexus Repository, and our security research. Welcome to Sonatype.