Friday, September 25, 2026
Wiz says attackers exploited three JFrog Artifactory flaws between 15 August and 8 September, chaining two of them to turn an unauthenticated request into an administrator token. All three had patches. Six weeks after one fix shipped, 59 percent of organisations were still vulnerable. Exploitation of the most serious flaw began four days after it was disclosed.
Four years after a single plant closure emptied American shelves, formula capacity is being added. The largest project by far is Mead Johnson putting several hundred million dollars and 600,000 square feet into the plant it already owns in Zeeland, Michigan. Two much smaller lines are going into Ohio.
America's solar manufacturing pipeline now holds 55.9GW of announced and in-build cell capacity and 41.4GW of modules. Wafers — the step that sits between polysilicon and cells, and without which neither is any use domestically — total 13.3GW across every stage of the pipeline combined.
The US Army's acquisition chief spent a day in August on a howitzer production line in Changwon. The more consequential arrangement is in Arkansas, where a Korean firm has a preliminary lease at a US arsenal to build a $1.3bn plant making nitrocellulose and nitroguanidine — the chemistry every artillery shell is built on, and the part America stopped making.
Eaton is putting $242m and 1,200 jobs into a million square feet in North Little Rock to make customised electrical enclosures, and says the plant will double its US capacity for them. A company does not double capacity for a product that is comfortably supplied.
A hospital can substitute a drug, a surgeon and a shift. It usually cannot substitute the single-source device a procedure was built around, and nobody notices which items those are until one of them stops arriving.
Buyers have stopped asking whether a supplier's software is secure, because they cannot find out. They have started asking who owns the supplier, where it builds, and what it would have to disclose.
The medicines that run short are almost never the expensive new ones. They are decades-old generics made on thin margins in a handful of plants, where a single inspection failure removes a meaningful share of world supply.
Procurement has learned to ask what open-source components a vendor ships. It still rarely asks what is running on the controller beneath the operating system, where the code is older, the provenance is thinner and the update path frequently does not exist.
Procurement can name every direct supplier and almost none of their suppliers. The shortages that halt production keep arriving from that second layer, where nobody was looking.
The regional suppliers that stock fasteners, bearings and safety equipment are being rolled up at a steady clip. The buyers are acquiring something the catalog does not list.
After years of supply chain speeches, the physical evidence has arrived: factory construction, border logistics investment and trade flows reorganizing around proximity.