Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2026-34265 is a memory corruption vulnerability in the Application Server ABAP component of SAP NetWeaver and the ABAP Platform. The flaw stems from logical errors in how the SAP kernel parses DIAG protocol messages, the proprietary protocol that carries traffic between the SAP GUI presentation layer and the application server. Malformed input reaching the parser leads to an out-of-bounds write, classified as CWE-787. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

The end of an era is upon us, as SAP has announced the end of life for their identity governance and administration (IGA) platform — a platform that supported several SAP products. Without this pivotal identity management tool, where are customers to go to protect the digital identities of their organization? And how can they know that any new platform will be trustworthy? SAP hasn’t left their customers in a lurch.

A new npm supply-chain compromise is targeting the SAP developer ecosystem. The affected packages we are tracking so far are: The pattern is familiar but also a bit different: a trusted package receives a new preinstall hook, the hook runs a new setup.mjs file, and that loader downloads the Bun JavaScript runtime to execute a large obfuscated payload named execution.js. The payload is an 11.7 MB credential stealer and propagation framework.

7 stolen GitHub tokens. 971 repositories. A self-replicating supply chain attack targeting SAP's Node.js packages — and it's still active. Here's what GitGuardian found.

This post covers a supply chain attack introducing a capability not seen before: using an AI coding assistant’s own GitHub access to commit malicious code to a corporate repository.

SAP environments, especially in the age of cloud work and hybrid infrastructures, are ripe with security complications. But SAP support and security is nothing to scoff at. Access controls alone in SAP environments require compliance capabilities for ultimate security, regardless of the security solution or deployment scenario.

DLP and Secude solutions work together to protect your IP data from creation to deletion - no matter where it travels. Here’s how. Engineering simulations. Machinery instructions. Prototype designs. CAD software is essential across the modern manufacturing production chain and contains manufacturers’ most confidential intellectual property (IP). Yet, much of the manufacturing industry still relies on Data Loss Prevention (DLP) tools to protect its CAD data.

DLP and Secude solutions protect your IP data from generation to storage to deletion - no matter where it travels. Here’s how. Building designs, mechanical drawings, structural plans. CAD software is the backbone of modern AECO projects and contains some of AECO’s most confidential intellectual property (IP). But most architects, engineers, construction firms and operations companies still rely on Data Loss Prevention (DLP) tools to protect their CAD data.

DLP and Secude solutions work alongside each other to protect your IP data from generation to storage and in transit. Here’s how. Submarine motors. Aircraft engines. Spatial systems. Command platforms. No matter the product, CAD software underpins the modern Defense production chain and contains Defense contractors’ most confidential intellectual property (IP).

To protect your IP, your CAD files need file-level security, unencrypted labelling, digital supply chain security and CAD file data governance. How seriously do you take IP protection? Architecture, Engineering, Construction and Operations (AECO) companies that treat IP protection as an afterthought are sleepwalking into disaster.