It Was Signed. It Was Legit. It Was Still Malware.

In 2020, SolarWinds' build system was compromised. The update that shipped was correctly signed, came from the right place, and looked completely legitimate. Around 18,000 organizations installed it anyway — because a signature only proves who signed it, not that the pipeline itself wasn't compromised. Full talk → https://youtu.be/9B7TNdiCWuU #sigstore #slsa #softwaresupplychain #devsecops #shorts