Driven by a “Liquid Software” vision, the JFrog Software Supply Chain Platform powers organizations to build, manage, and distribute software quickly & securely

🌎
Joined May 2009
Day 1 of #swampUP Europe 2026 in Barcelona was one for the books. 🐸🇪🇸 The keynotes were sharp and the sessions were packed. From closing the Shadow AI blind spot with Local Shadow AI Detection and JFrog AI Security, to ending the audit scramble with new #DevGovOps capabilities that give CISOs and R&D leaders signed compliance evidence for every release. The conversations on stage and in the hallways made one thing clear: the rules of trust in the #AI era are being rewritten right now, and this community is at the forefront of it. Barcelona is not done with swampUP yet - we'll see you for Day 2! 🐸 #DevSecOps #DevGovOps #TrustedIntelligence #SoftwareSupplyChain
2
167
🚨LiteLLM hijacked again: version 1.107.0. PHP for breakfast, Python for lunch! ☕ The JFrog Security Research team discovered a PyPI package hijack affecting LiteLLM (23M weekly downloads). All seven PyPI wheels carry files that run on package install time, steal credentials and open an hourly remote-code channel, even if your app never imports litellm. The hijack also affected LiteLLM's official Docker Hub images, with the same payload. If it's anywhere in your environment, don't start clean-up by running pip. Starting Python can re-trigger a payload that steals credentials and runs at interpreter startup. The JFrog Security Research team has detailed the attack, the indicators of compromise and the remediation steps. Read our blog for full details: jfrog.co/3TOtgPp #DevOps #PyPI #SoftwareSupplyChain #Cybersecurity
1
1
3
5
618
Are AI assets bypassing your security gates? 🚨 A ZIP file in Slack or an unvetted MCP server can introduce hidden Shadow AI risks right on your developers’ workstations. With JFrog AI Security, you can now detect skills, plugins, and MCP servers, where coding agents actually run—without slowing down your team. 🛡️ Get full visibility across managed and local AI assets! 👉🏽 Learn more: bit.ly/4yC5moy #ShadowAI #DevSecOps #AISecurity #AppSec #SoftwareSupplyChain
218
🚨 AppSec alert: SCA and SAST check code paths, but agent skills, plugins & APM packages ship INSTRUCTIONS directly to coding agents! 🤖 Blind spot: Plain-text prompt injections & credential theft can pass "safe." JFrog bridges this gap with JFrog AI Security’s intent-based semantic scanning & runtime enforcement - keeping your AI supply chain secure under one roof. 🛡️ Learn more: bit.ly/4ytEmHB #DevSecOps #AppSec #AISecurity #CyberSecurity #SoftwareSupplyChain
3
218
Live at #swampUP in Barcelona: JFrog VP of Product Eyal Dyment, Tyrone Gamby from @MorganStanley, and Oren Penso from @Broadcom are on stage showing why the traditional #DevSecOps playbook of scan, alert, and manually patch can no longer keep up. The new world requires pre- and post-release defenses anchored on a single system of record. With Frontier AI models now discovering and chaining software vulnerabilities at machine speed, attackers will have access to the same capabilities. Our speakers are sharing how they reinforce security in this new AI reality. #swampUP #SoftwareSupplyChain #TrustedIntelligence #ZeroTouchRemediation
180
🚨How to Safeguard Your Systems From PHP2Shell Impact PHP has scheduled the security release today (October 21) at 14:00 UTC ⚠️ CVE-2026-109618 and CVE-2026-109619 both score 9.2 (CVSS v4.0) and are reported to allow remote code execution. Our blog covers how to get ready: 🔍 Inventory every PHP runtime ⚙️ Line up approvals and testing 🛡️ Check vendor advisories for backports Read the full blog 👇 jfrog.co/4ieYAPq #DevSecOps #PHP #Cybersecurity
464
JFrog Co-Founder and CTO Yoav Ladman is on the #swampUP stage in Barcelona right now, showing how software now flows continuously through streams of binaries at #AI speed. Source code is no longer the center of gravity, and coding agents are assembling releases faster than human-driven governance can track. JFrog is the trust layer built for this new reality. “Today we’re going to add three new layers to the software supply chain integral to building trust” #TrustedIntelligence #DevSecOps #SoftwareSupplyChain
7
311
JFrog Co-Founder and CTO Yoav Landman is on the #swampUP Europe stage in Barcelona right now, showing how software now flows continuously through streams of binaries at #AI speed. Source code is no longer the center of gravity, and coding agents are assembling releases faster than human-driven governance can track. JFrog is the trust layer built for this new reality. “Today we’re going to add three new layers to the software supply chain integral to building trust” #TrustedIntelligence #DevSecOps #SoftwareSupplyChain
1
228
#swampUP Europe 2026 is officially underway in Barcelona. 🐸🇪🇸 JFrog Co-Founder and CEO @ShlomiBenHaim is on the swampUP Europe stage right now with Ariel Assaraf from @Coralogix, unpacking how #AI is reshaping the #softwaresupplychain. Autonomous agents have moved from assistants to builders, writing code, resolving dependencies, and producing binaries at machine speed. The rules of trust are being rewritten in real time. "In order to build speed and trust, there must be a control plane in place" #swampUP #TrustedIntelligence #DevSecOps #AI
162
AI agents are shipping code faster than any compliance team can review it. JFrog AppTrust just changed that. 🐸 New at #swampUP Europe in Barcelona: out-of-the-box #DORA Compliance Framework, Repo-Level Policies, and #AI Verification Policies that evaluate every release against plain-language rules and generate signed proof of compliance automatically. No more scrambling when the auditor calls. Learn more: bit.ly/4eFr2J2 #DevGovOps #CRA #Compliance #SoftwareSupplyChain #TrustedIntelligence
2
2
199
JFrog’s new Local Shadow AI Detection extends visibility to where developers actually work: detecting #AI assets as they land on the developer’s machine, scanning on the local device, and cross-referencing every asset against what is approved in the JFrog Platform. If your security coverage starts at the repository, you are already too late. Get full visibility from laptop to production. Learn more: bit.ly/4BeKKVN #AISecurity #AgentSecOps #DevSecOps #SoftwareSupplyChain #AIGovernance #swampUP
1
159
Can you trace a production alert back to the build, the artifact, and the owner in minutes? JFrog’s David Dewaele and @wiz_io’s Annam Iyer will show you how. Nov 10, 10am PT. What you’ll see: 🔹 What’s running, who owns it, is it secure, in one view 🔹 Less alert noise with runtime context tied to binary-level lineage 🔹 Shadow deployments and pipeline bypasses caught on day one Plus a look at the path to a self-healing supply chain with JFrog AppTrust. Save your seat: bit.ly/3VZt0h4
2
320
Broad permissions and messy access controls put your delivery pipeline at risk. Centralized, structured control gives you precise access without slowing developers down. Learn about platform security and access control with our JFrog Security & Permission Management course: ⚡️Security Basics (Beginner) Establish a strong defensive foundation by mastering central security settings and core platform access principles. ⚡️ Permission Management (Beginner+) Eliminate access chaos by creating users, structuring groups, and assigning precise permission targets to enforce least-privilege control. Stop guessing access levels and start securing your DevOps environment with confidence. Get started today: academy.jfrog.com/jfrog-arti…
1
200
Take a look at #swampUP Europe 2026's Training Day in Barcelona! 🤩 Engineers and security teams went hands-on with JFrog experts, building the skills to transform their #softwaresupplychains into a system of record for trusted, secure software delivery in the #AI era. Now it's time to get ready for the keynotes. See you all tomorrow at 9am! 🐸 #DevSecOps #DevGovOps #TrustedIntelligence
1
4
229
Trust shouldn’t slow your agents down. At GitHub Universe on October 28-29, JFrog will show how you can secure what your #AI agents consume, control how they build and deploy, and remediate risks before software ships. Stop by the booth for a live demo, meet our experts, and create your own exclusive JFrog T-shirt. Book a meeting with the JFrog team → events.jfrog.com/github-univ… 📍See you at the Fort Mason Pavilion in San Francisco! #GitHubUniverse #SoftwareSupplyChain #AIAgents #DevSecOps
1
166
Training Day at #swampUP 2026 in Barcelona has officially wrapped. 🐸🇪🇸 Engineers, developers, and security teams spent the day with JFrog experts, diving deep into the tools and techniques that power trusted, secure software delivery in the #AI era. The energy in the room was incredible and we’re excited to keep the good vibes rolling for tomorrow’s keynotes! #DevSecOps #DevGovOps #TrustedIntelligence
2
3
260
We're proud to sponsor @JFrog swampUP in Barcelona! Visit us at the CloudBees booth to learn how we can help make sure the code you write delivers the business impact you want — safely and securely. See the CloudBees events calendar for details: cloudbees.com/events?Product…
1
1
345
What does it take to rebuild trust after one of the most infamous #SoftwareSupplyChain attacks in history? Former SolarWinds CISO Tim Brown sat down with JFrog Field CISO Paul Davis at #swampUP 2026 to share how his team responded to Sunburst, fought SEC charges for years, and rebuilt their pipeline with a three-stage build process where only 2 people can access production. This #CyberSecurityAwarenessMonth, his lessons on assuming breach, securing non-human identities, and partnering with your security team are a must-read for every #developer, #DevOps, and #DevSecOps leader. Get the full conversation here: bit.ly/3UD9h6q
251
🚀 Models, datasets + AI-generated code are now dependencies too. You can't secure what you can't see. That's the thinking behind the Treasury Board's new SPIN on cyber security readiness in the frontier AI era. It says federal departments must maintain an SBOM for department-developed software that supports critical services. Built for Canadian government + public sector teams: join JFrog Field CISO Paul Davis + Lester Wong, Cybersecurity/AI Specialist at DCI, on October 20 at 8am PT / 11am ET for "From Inventory to Action: Putting SBOMs to Work." If you're in #AISecurity, #PublicSector, or #SoftwareSupplyChain, tune in. 🔗 Register now: bit.ly/4hLFTSW
1
6
314