# The OX Blog

April 15, 2026

## [The Mother of All AI Supply Chains: Critical, Systemic Vulnerability at the Core of Anthropic's MCP](/content/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/index.html)

- 
- 
- 
-

Moshe Siman Tov Bustan, Mustafa Naamnih, Nir Zadok, Roni Bar

- [Read More](/content/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/index.html)

### August 30, 2026 [**4 ASPM Tools to Watch in 2026: Enterprise-Grade Features and Market Insights**](/content/blog/aspm-tools/index.html)

Boaz Barzel

### August 29, 2026 [**Shai-Hulud – Trinitite: Sponsored by Preview 2 Effects**](/content/blog/shai-hulud-trinitite-sponsored-by-preview-2-effects/index.html)

Moshe Siman Tov Bustan

### August 25, 2026 [**ClickFix Phishing Pages Discovered in 24 npm Packages**](/content/blog/research-clickfix-phishing-npm-packages/index.html)

-

Moshe Siman Tov Bustan, Vitalii Chepurko

### August 19, 2026 [**PBOM vs SBOM: What’s the Difference, and Why Does It Matter in 2026?**](/content/blog/pbom-vs-sbom/index.html)

### August 18, 2026 [**Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directive**](/content/blog/gitlab-graphql-cve-2026-19478-19650/index.html)

-

Nir Zadok, Moshe Siman Tov Bustan

### August 18, 2026 [**Critical vm2 Vulnerability Allows Host DNS Hijacking and Information Disclosure**](/content/blog/critical-vm2-vulnerability-allows-host-dns-hijacking-and-information-disclosure/index.html)

-

Nir Zadok, Moshe Siman Tov Bustan

### August 9, 2026 [**Shai-Hulud Outbreak Debrief: The Worm Evolves into MCP**](/content/blog/shai-hulud-outbreak-debrief-the-worm-evolves-into-mcp/index.html)

Moshe Siman Tov Bustan

### August 6, 2026 [**Did We Just Witness Step One of the Autonomous AI Arms Race?**](/content/blog/did-we-just-witness-step-one-of-the-autonomous-ai-arms-race/index.html)

Neatsun Ziv

### August 6, 2026 [**CVE-2026-44613: Turning a CSRF into Silent Unauthorized Actions**](/content/blog/cve-2026-44613-turning-a-csrf-into-silent-unauthorized-actions/index.html)

-

Nir Zadok, Moshe Siman Tov Bustan