An SBOM is not a malware scanner and does not prove a binary is clean. Here is how software inventory helps you scope a supply-chain attack, and why coverage and artifact traceability decide whether it helps.

Receiving an SBOM is not the same as trustworthy software transparency. Here are the three levels of SBOM trust, five checks for a supplier SBOM, and how to score quality with sbomqs without overstating what a score proves.

PHP2Shell explained: what CVE-2026-109618 and CVE-2026-109619 are, how two PHP engine memory-safety flaws enable unauthenticated RCE and memory disclosure, how the coordinated disclosure fell apart, affected and fixed versions, and how to respond.

The CRA's harmonised standards are running late and none is cited in the Official Journal yet. Here is what the delay changes, what it does not, and why your SBOM and vulnerability-handling work should continue now.

What VEX is, the four status values, the format landscape (CSAF, OpenVEX, CycloneDX, SPDX 3.0), and how to operationalize VEX to reduce SBOM vulnerability noise and support CRA and FDA reporting.

The Linux Foundation's OpenChain Automotive SBOM Framework 1.0 defines a common set of information for automotive supplier handoffs. Here is what the framework requires, what it leaves open, and why accurate generation still matters.

Why firmware SBOMs disagree: source scanning sees what is present, binary analysis sees the image but infers identity, and build-aware generation reads the real build. How to tell which is accurate and prove what actually shipped.

CMake added experimental native SBOM generation in a 2026 release (SPDX 3.0.1, DARPA-funded). Here is how to turn it on, exactly what it records, and where it still needs a build-aware layer for embedded firmware.

How to generate an SBOM from a CMake build in 2026 - CMake's new native SBOM support, open-source modules, binary analysis, and build-aware generation compared, with what each one captures and misses.

A vendor-neutral comparison of the best SBOM tools in 2026 across generation, management, and compliance, with side-by-side tables to match each tool to your use case.

We generated an SBOM for Meta's MUSE AI-agent VM and ran a vulnerability review in Interlynk: 279 findings, 14 critical. Here's how to inspect your own.

Lessons from 50+ embedded SBOM proofs of concept, with practical guidelines for engineers evaluating commercial and open-source SBOM generators.

A cryptographic bill of materials (CBOM) inventories the algorithms, keys, and certificates in your software, and supports post-quantum migration readiness.

The CRA's vulnerability reporting starts 11 September 2026: a 24-hour early warning, 72-hour notification, and 14-day or one-month final report. What to file, when, and where.

CISA's 2026 SBOM Minimum Elements raise the baseline, but compliance alone does not make an SBOM useful. The four tests that determine SBOM quality.

FDA 524B SBOM requirements for medical devices under Section 524B: what a cyber device is, refuse-to-accept rules, what the SBOM must contain, and postmarket duties.

A practical Q&A on generating accurate SBOMs for embedded C/C++ and IoT firmware, including STM32, NXP, Nordic, RTOS, binary blobs, linker maps, variants, and the EU Cyber Resilience Act.

How to generate a CycloneDX SBOM with cdxgen: install, per-language commands, GitHub Actions and Azure CI, evidence, signing, and depth pitfalls.

Generating accurate CycloneDX SBOMs for a Trusted Firmware-M build on STM32H5 using lynkctl — driven by the CMake build and linker maps, not source scanning

Enterprise SBOM management breaks at scale for five predictable reasons. Why generating SBOMs is the easy part, and managing them is where programs fail.

CycloneDX vs SPDX compared side by side: current versions, ISO and ECMA certification, tooling support, and which SBOM format fits your compliance needs.

CRA SBOM requirements, explained: what the EU Cyber Resilience Act and BSI TR-03183 mandate for your SBOMs, from data fields and formats to September 2026.

How open-source projects build an SBOM strategy and attestation model: formats, CI automation, signing, VEX, and CRA/FDA/NIS2 mapping. 2024-2026 best practices.

Your SCA tool already builds an SBOM, then locks it in a console. A practical guide to migrating to an open, SBOM-first workflow with no coverage gap.

Recent quantum computing breakthroughs have moved the PQC deadline earlier. What financial services, critical infrastructure, and medical device leaders need to do now.

A breakdown of MITRE's 2026 medical device cybersecurity findings: the biggest gaps in device security programs and what manufacturers should fix first.

After the 2025 chalk/debug npm compromise, "cooldowns" delay adopting brand-new package versions. How SBOMs let you enforce and monitor dependency cooldowns.

Why SBOM generation for C/C++ is hard: vendored code, static linking, and build systems like CMake and Conan break most tools. The 2026 state of the art.

What Astral's security playbook reveals about SBOMs — practical lessons any software team can apply to strengthen supply-chain security and transparency.

How a 100-million-download npm package became the latest victim of an accelerating software supply chain playbook - and what to do about it.

The FDA now requires software support status in medical device SBOMs. Learn what this means for manufacturers and how to demonstrate ongoing support compliance.

Introducing Lynk MCP: a conversational interface to query your software supply chain data. Ask questions about SBOMs, vulnerabilities, and compliance naturally.

What OTS, SOUP, and COTS software mean for medical devices, what FDA 524B and IEC 62304 require, and how to document third-party code in your SBOM.

Publishing SBOMs to GitHub Releases isn't enough — they go stale fast. Why static release SBOMs fail and how continuous SBOM management keeps them current.

The updated EU Product Liability Directive treats software as a product. How SBOMs help manufacturers manage defect liability and prove due diligence.

Technical guidance on SBOM adoption in India. Learn about emerging regulatory requirements and best practices for software supply chain transparency.

What's new in CISA's third-edition SBOM Framing Document — updated minimum elements and guidance shaping how organizations produce and consume SBOMs.

How to upload files to a GraphQL endpoint using Hurl. Step-by-step technical tutorial with code examples for API testing and file upload automation.

Interlynk launches a free tier for its SBOM automation platform. Get started with SBOM management, quality scoring, and vulnerability scanning at no cost.

How SBOMs underpin EO 14028, EU CRA, FDA, NIS2, DORA, and PCI DSS compliance — one software inventory mapped to every major cybersecurity mandate.

Biotronik selects Interlynk to support FDA cybersecurity compliance for its medical devices with automated SBOM management and vulnerability analysis.

How SBOMs help you meet the EU NIS2 Directive — what NIS2 requires for supply-chain security and why a software bill of materials is central to compliance.

Interlynk partners with Tumeryk to bring AI transparency and security through SBOM and software supply chain visibility for AI/ML applications.

How SBOMs support PCI DSS 4.0: use a software bill of materials to inventory components, track vulnerabilities, and meet payment-security requirements.

Analysis of the OpenChain Telco SBOM Guide. Key takeaways for telecommunications operators managing complex software supply chains and SBOM programs.

Everything about CycloneDX 1.6: new features, improvements, and what the latest SBOM standard version means for your software supply chain security program.

Five critical lessons from the XZ Utils backdoor incident. How SBOM and software supply chain security practices could help prevent similar attacks.

A guide to the CISA Secure Software Development Attestation Form (formerly M-22-18) — what federal software suppliers must attest to, and how SBOMs help.

SBOM in action: analyzing Ivanti Pulse firmware. A real-world case study showing how SBOM reveals hidden components and vulnerabilities in network devices.

How to assemble product-level SBOMs for a group of products using sbomasm. Best practices for aggregating, merging, and distributing composite SBOMs.

Five key insights from the latest SBOM adoption research. Data on industry trends, adoption rates, challenges, and best practices for SBOM implementation.

The 5 most common SBOM problems — incomplete components, weak metadata, version drift, format issues, and stale data — plus how to fix each one.

How to comply with NSA SBOM recommendations. Practical guidance on meeting national security requirements for software supply chain transparency.

A practical guide to CISA's minimum requirements for VEX: the required data fields, status justifications, and how to generate and share VEX at scale.

Federal Acquisition Regulation cyber compliance proposal: requirements, implications, and how SBOM helps contractors meet federal cybersecurity mandates.

SEC cybersecurity disclosure requirements explained. How public companies can use SBOM and software transparency to strengthen incident reporting processes.

Everything about SPDX 3.0: new features, profile model, improvements over SPDX 2.3, and what the latest version means for your SBOM and compliance workflow.

Frequently asked questions about SBOM compliance. Covers regulations, formats, implementation, tools, and best practices for software supply chain security.

How to use sbomasm for SBOM assembly in software products. Open source tool for merging, editing, and distributing Software Bills of Materials.

What the White House National Cybersecurity Strategy Implementation Plan means for software makers — key initiatives, timelines, and the growing role of SBOMs.

Everything about CycloneDX 1.5: new features, attestation support, and how this SBOM standard version advances software supply chain security practices.

Why your organization needs SBOM, part 2: regulatory drivers, supply chain attacks, and the business case for software transparency and risk management.

How to handle open source licenses in SBOMs. Guide to license identification, compliance tracking, and risk assessment for open source components.

Understanding VDR, VEX, OpenVEX, and CSAF: a guide to vulnerability disclosure formats and how they complement SBOM for supply chain security.

Guide to self-attestation for OMB Memorandum M-22-18. How software producers can meet federal secure development requirements and SBOM mandates.

Key updates from SBOM-a-Rama 2023. Summary of industry discussions, CISA guidance, tooling developments, and the future of SBOM adoption.

Why your organization needs SBOM, part 1: understanding software supply chain risks, visibility gaps, and how SBOMs provide transparency for security.

A roadmap towards cybersecure medical devices. How SBOM, FDA guidance, and supply chain security practices protect connected healthcare technology.

Why software disclosures matter for security and compliance. The growing demand for transparency in software supply chains and how SBOM enables it.