en.Wedoany.com Reported - South Korea's Ministry of Science and ICT, in collaboration with the National Intelligence Service, has jointly released the "Phased Implementation Plan (Roadmap) for Software Supply Chain Security in the Era of AI Daily Life," aiming to strengthen the cyber resilience of the software supply chain across all stages from development to post-sale management, in response to the increasingly complex cyber threats of the artificial intelligence era.

The roadmap was officially announced on the 24th at the "2026 Supply Chain Security Seminar." The government believes that the proliferation of high-performance AI has led to a sharp increase in the speed and scale of cyber attacks, making it difficult for traditional security systems to prevent cascading software supply chain damage that spreads to multiple organizations. To this end, the government will promote a supply chain security management model based on the Software Bill of Materials (SBOM), expand threat detection pathways using bug bounty programs and the Coordinated Vulnerability Disclosure/Vulnerability Disclosure Program (CVD/VDP) system, and build an AI-based supply chain defense system to minimize accident damage.

The government will also form a cross-departmental software supply chain security consultative body and operate a supply chain security forum to support private-sector autonomous activities. Additionally, it will develop security threat verification plans for products supplied to the public sector and push to expand the scope of products subject to security compliance systems.

For small and medium-sized enterprises (SMEs) with weak security conditions, the Ministry of Science and ICT launched the "SME Security Foundation Establishment Intensive Support Project" on the 26th. This project will provide comprehensive technical support ranging from asset identification to simulated hacker attacks. Key components include: providing network-based security investment guidelines tailored to corporate budgets; inspecting external hacker attack surfaces; diagnosing open-source software and assisting in implementing secure coding through software supply chain security system diagnostics.

The Korea Internet & Security Agency (KISA) will prioritize providing information security consulting and IT security packages to 100 SMEs in regions that have experienced intrusion incidents or detected threats, and will prioritize providing Security as a Service (SECaaS) packages to 400 SMEs. Starting in July this year, it plans to open infrastructure to all SMEs, enabling them to use cutting-edge AI models to freely inspect their own products for security vulnerabilities.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding zero-day vulnerability exploitation cases in Lantronix EDS5000 series devices, primarily used in operational technology (OT) environments. The vulnerability, designated CVE-2025-67038 (CVSS score 9.8), is a code injection flaw caused by missing input validation during HTTP RPC module logging when authentication fails. Attackers can exploit this vulnerability to inject malicious code and execute arbitrary operating system commands with the highest privileges (Root).

CISA disclosed this information on the 23rd (local time) through its Known Exploited Vulnerabilities (KEV) catalog. Analysis by security firm Forescout indicates that a threat group named "Chaya_006" launched zero-day attacks against specific honeypots starting approximately two weeks before the vulnerability was publicly disclosed (April 5th). In addition to exploiting this device vulnerability, attackers concurrently conducted over 4,100 brute-force attacks against web interface environments of open-source router firmware exposed to the internet.

U.S. federal agencies are typically required to patch security vulnerabilities listed in the KEV catalog within three weeks. Experts recommend changing default credentials, restricting administrator interface access, and implementing network isolation to prevent damage to industrial control environments.

This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com