November 2025 Summaries

Integrating the JFrog Platform with Databricks provides organizations with a robust solution for transitioning machine learning models from experimentation to production while ensuring security and governance. This process involves a five-step approach that includes safely downloading models using JFrog Artifactory to mitigate security risks, storing proprietary models in a centralized and secure registry, and packaging them for deployment using JFrog ML to create standardized container images. JFrog Xray provides automated security scanning of these images, ensuring vulnerabilities are identified and managed before deployment. The final step involves deploying the model as a scalable API, either through existing infrastructure or using JFrog ML's hosting solutions, which offer advanced deployment strategies and autoscaling capabilities. This integration enables data science teams to maintain their workflow in Databricks while providing MLOps and security teams with the necessary tools for secure, traceable, and efficient model deployment.

JFrog has announced the next evolution of its AI Catalog, aiming to provide comprehensive, centralized governance over the entire AI ecosystem. Initially introduced to offer a system of record for managing internal, open-source, and external AI models, the updated platform now addresses emerging challenges such as Shadow AI and the security risks posed by Model Context Protocol (MCP) servers. Shadow AI refers to the unchecked and unmanaged use of external APIs and model packages, creating security and compliance risks, while MCP servers represent a new risk vector with their powerful automation capabilities. The enhanced AI Catalog introduces features for automatic discovery and cataloging of unmanaged AI resources, asset vetting, policy enforcement, and a centralized AI Gateway to mitigate these risks. Additionally, the platform will soon extend its governance framework to MCP servers, providing a unified registry and enabling organizations to secure their AI infrastructure fully. This development positions JFrog's platform as a trusted source for managing the entire AI supply chain, from code to advanced AI agents.

A significant transformation in software development is underway, with Gartner forecasting that 75% of enterprise software engineers will employ AI code assistants by 2028, up from less than 10% in early 2023, creating both competitive advantages and new security challenges. Traditional Software Composition Analysis (SCA) tools are limited in detecting risks from AI-generated code or copy-pasted snippets, leading to vulnerabilities such as viral licenses, hidden vulnerabilities, and broken audit trails. JFrog addresses these issues with its AI-Generated Code Validation, which employs semantic matching to analyze the logic and function of code beyond mere text matching. This solution integrates directly into developer workflows, blocking pull requests that violate security or license policies, thus ensuring proactive protection of intellectual property and compliance, real-time vulnerability prevention, and an enforced audit trail. The JFrog Platform aims to transform code provenance from a blind spot into a verifiable strength, offering a robust safeguard against potential threats in the software supply chain.

As software supply chain attacks grow increasingly complex, the tension between speed and security becomes more pronounced, emphasizing the need for a comprehensive security approach. The Israeli National Cyber Directorate's report highlights significant threats existing beyond first-party code, necessitating an end-to-end, natively integrated, and binary-focused security strategy. JFrog advocates for a multifaceted approach, ensuring security spans the entire software lifecycle, is integrated within the delivery process, and focuses on the final compiled artifacts. This strategy addresses challenges like implicit trust in package managers and the limitations of traditional security tools, while also recognizing the potential of AI-powered tools for enhancing first-party code security. However, these tools alone are insufficient for systemic supply chain protection, underscoring the need for a centralized platform that offers governance and control throughout the software supply chain.

A critical security vulnerability, CVE-2025-11953, was discovered by the JFrog Security Research team in the @react-native-community/cli NPM package, widely used for developing React Native mobile applications, with around 2 million weekly downloads. This vulnerability allows remote unauthenticated attackers to execute arbitrary OS commands on the machine running the React Native development server, posing significant risks to developers. While the vulnerability is primarily associated with the @react-native-community/cli-server-api package, it affects versions 4.8.0 to 20.0.0-alpha.2 and is resolved in version 20.0.0. The vulnerability is particularly severe because the development server is exposed to external network attacks, allowing attackers to exploit the /open-url endpoint to execute arbitrary shell commands. To mitigate this, developers are advised to update the affected package or bind the server to the localhost interface. The issue highlights the importance of secure coding practices and the need for automated security scanning, with tools like JFrog's SAST facilitating the early detection and fixing of such vulnerabilities in the development process.