News for hackers. Stuff that matters.

A comment on Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign. Parent comment

Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by pavon on Thursday April 23, 2026 @10:47PM (#47884885)
A patch updates is a newer version, and they are just as likely to be compromised by supply chain attacks as minor or major updates.
[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by dsl on Friday April 24, 2026 @02:45AM (#47886491)
Not exactly.

Security patches aren't like bugs or features where you can just roll a new version. Often patches need to be backported to older versions allowing software and libraries to be "upgraded" in place with no other change introduced.

Say you had software that controlled the careful mix of chemicals introduced into a municipal water supply. You just don't move from version 1.4 to 3.2, you fix 1.4 in place.

[ Parent | on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha... by thfuran on Friday April 24, 2026 @03:48AM (#47887009)
No, you create version 1.4.19, which fixes a bug in 1.4.18.
[ Parent | on HN ]