Developer Workstations Are Now Part of the Software Supply Chain

A wave of high‑impact supply‑chain and infrastructure incidents: attackers are increasingly targeting developer workstations, CI/CD pipelines and package ecosystems to harvest secrets and inject malware. Multiple high‑severity and actively exploited flaws were reported this week — notably a Cisco Catalyst SD‑WAN authentication‑bypass (CVE-2026-20182) added to CISA KEV, an Ivanti Xtraction critical info‑disclosure flaw (CVE-2026-8043), an NGINX heap overflow leading to possible RCE (CVE-2026-42945) being exploited in the wild, and an Exchange spoofing/XSS exploit (CVE-2026-42897). Other notable