Supply Chain Risk

Seventeen bipartisan former national security officials asked the D.C. Circuit to rehear Anthropic’s challenge to the Pentagon’s supply-chain-risk designation. The case could influence how the Defense Department applies supplier restrictions and how agencies and contractors evaluate Anthropic’s Claude models, but the filing is not a new procurement action.

CISA, the FBI, the U.S. Secret Service, and international partners report that SafePay has affected about 600 organizations worldwide since August 2024, including critical-infrastructure operators. Contractors should review the advisory’s indicators and mitigations, urgently patch cited Cisco, Veeam, and SonicWall vulnerabilities, and assess protections for remote access, networks, and backups.

On October 13, 2026, a security incident involving a compromised ConnectWise account allowed unauthorized access to 173 Microsoft 365 tenants. This breach emphasizes the critical need for enhanced security measures in the managed service provider environment, especially for government contractors relying on such services.

The UK government has seen a 20% rise in Cyber Essentials certifications, totaling 61,430 from July 2025 to June 2026. However, many certifications are recertifications, indicating limited new adoption among SMEs. As procurement requirements evolve, expect heightened demand for Cyber Essentials compliance from suppliers, especially within the small and medium enterprise sector.

The U.S. International Trade Commission has begun an investigation into certain mobile devices after GG Technologies filed a complaint against Apple. This may lead to import restrictions, affecting supply chains and compliance for vendors involved in mobile hardware and software.

The WhiteCobra malware, targeting Visual Studio Code users, poses significant cybersecurity risks to government agencies and contractors. Vulnerabilities in commonly used software development tools necessitate enhanced risk management and security assessments to safeguard sensitive data.

A security vulnerability involving **Unisoc**, **Longcheer**, and **Motorola** threatens millions of budget Android devices in Latin America. Procurement professionals need to reevaluate their supply chain security protocols to mitigate risks related to this significant compromise.

The recent compromise of the popular open-source package @asyncapi/specs through a malicious commit highlights critical vulnerabilities in software supply chains. Government agencies and contractors must urgently reassess their security strategies and adopt stringent measures to protect against similar supply chain attacks.

The U.S. International Trade Commission is investigating patent infringement in energy drink labeling following a complaint from Monster Energy Company. This may lead to significant trade implications for suppliers and manufacturers involved in these products.