What Happened
Security research and incident response teams report a clear shift in attacker focus: instead of primarily exploiting production application code, adversaries increasingly target the software development lifecycle (SDLC) — CI/CD pipelines, developer tools, artifact registries, and model training pipelines. Compromises in these areas let attackers insert malicious dependencies, steal secrets, backdoor models, or…
