On Friday at 4:00 p.m., a Grype scan identified 1,759 CVEs in a python:3.9-buster image, including 311 High-severity and 15 Critical ones. In recent supply chain attacks, two patterns frequently emerge: attackers exploit trust and target the build process rather than the source code. With AI causing the volume of code and dependencies to skyrocket, the problem is only getting worse.
A 10-minute live demo on a Python application:

● Image scan with Grype (and SBOM inventory with Syft)
● Actual exploitation: reading /app/.env and /etc/passwd via an ImageMagick CVE, followed by an aiohttp path traversal
● Remediation using a multi-stage Dockerfile on a minimal image built from Wolfi, apko, and melange. We rescan with Grype and retry the exploits, which fail this time
● Integrity verification: Cosign / Sigstore signatures and SLSA Level 3 provenance