Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

There is a hard deadline for post-quantum code signing: You sign a certificate in 2026 that may still be needed to check the certificate on a device in 2035 that you can’t re-flash. This post covers what PQC signatures are, why RSA/DSA/ECDSA doesn’t work against a CRQC, how code signing is different from SSL, and what AWS, Google, and MS shipped. Inventory paths. Select an algorithm class. Test dual-sign. Follow cert and KMS roadmaps.

The shift from the FIPS 140-2 standard is significant for organizations making use of HSMs, software-based cryptographic modules, VPN equipment, secure communications, and other items depending on validated crypto. That being said, it does not mean that the existing FIPS 140-2 modules will start malfunctioning or will become insecure. The transition has implications for how businesses will be appraising validated crypto devices, especially when purchasing or employing them in the new systems.

The significance of software supply chain security is on the rise in today’s software development practices. Organizations around the world are increasingly depending upon third-party software libraries, package managers, CI/CD pipelines, and automation for dependency management. Therefore, verifying the authenticity and integrity of software is critical. Starting September 23, 2026, Microsoft will adopt a new certificate for author-signing NuGet packages.

SLH-DSA is NIST’s standardised post-quantum digital signature algorithm (hash-based). It generates quantum-resistant signatures, ensuring signatures are not changeable and that they will not be forged, even when later superseded by schemes like RSA and ECDSA, which are susceptible to attacks by quantum computers. Organisations are studying it today because large-scale quantum computers could, in the future, crack the algorithms that currently underpin most digital trust.

Quantum computers are likely to render the current public-key cryptography used for protecting modern internet traffic, digital signatures, and encryption useless. In response, NIST has developed ML-KEM as the main post-quantum key encapsulation method. The guide below will introduce the concept of ML-KEM, how it functions, in which projects it is used, and how organisations can implement it.

Companies rush to utilise the potential of large language models; however, every new use case of generative AI introduces attack vectors previously unknown in traditional web security. The present guide provides an overview of the official OWASP GenAI LLM Top 10 2026 list and explains the appearance of each vulnerability in practice along with mitigation recommendations.

Microsoft is in the process of shaping major changes to Windows code signing that will have the effect of altering the certificate infrastructure, the cryptographic algorithms, and, in the end, how Windows applications will be protected against future quantum computing threats. The changes are of particular importance to developers, IT administrators, security teams, and organizations that are using their custom software or security tools that can do their own code signature validation.

As quantum computing develops, cybersecurity professionals are getting ready for a breakthrough in the protection of digital information. The conventional public-key cryptographic algorithms that ensure the security of digital signatures may, in the long run, be compromised by the revolutionary power of quantum computers. To minimize that risk, Google Cloud has announced general availability of the quantum-safe digital signature feature in its Google Cloud Key Management Service (Cloud KMS).

The foundation of modern-day software development relies heavily on translating requirements into products through traceability, collaboration, and reproducibility. Software artifacts are instrumental in this process, facilitating development across all areas, including application development, CI/CD pipelines, and compliance.

Globally, companies are still preparing for a quantum revolution, and the National Institute of Standards and Technology (NIST) has made significant progress on its Post-Quantum Cryptography (PQC) Standardization Program.