2026 brought a wave of supply chain attacks that exposed how deeply modern software relies on trust, automation, and third-party code. This session looks back at the year’s most important incidents, the patterns they revealed, and the defensive lessons teams can take forward.

We’ll look at TeamPCP, Shai-Hulud, GitHub’s reported VS Code extension compromise, and other real-world incidents to understand how attackers compromised dependencies, maintainers, and CI/CD pipelines, then turn those lessons into practical strategies for prevention, detection, and response.