Cloudfest 2025 Hackathon Developing SBOMinator for Open Source Supply Chain Security

Securing the Open Source Supply Chain: The SBOMinator Project and CloudFest Hackathon 2025

The open source software ecosystem faces increasingly sophisticated security challenges, with supply chain vulnerabilities emerging as a critical concern for WordPress site owners and developers. The recent CloudFest Hackathon 2025 brought together security experts to collaborate on innovative solutions to these threats, culminating in the development of the promising SBOMinator project. This report examines how these developments impact WordPress security and what site owners can do to protect themselves in this evolving landscape.

The Growing Challenge of Supply Chain Security

Supply chain attacks have gained tremendous attention in recent years, with numerous high-profile cases demonstrating their devastating potential. These attacks target the trust relationships between software providers and users by compromising development infrastructure, distribution channels, or third-party dependencies. For WordPress users, the risk is particularly acute, as the ecosystem's extensive use of plugins and themes creates numerous potential entry points for attackers[2].

The WordPress ecosystem has not been immune to such attacks. In 2024, attackers compromised developer accounts on WordPress.org, enabling them to inject malicious code into plugins through regular updates. This attack vector was especially dangerous because many sites have automatic updates enabled, allowing compromised code to spread rapidly across thousands of websites[9]. These incidents highlight the critical need for improved supply chain security measures within the WordPress community.

The CloudFest Hackathon 2025: Fostering Open Source Innovation

The CloudFest Hackathon, held March 15-17, 2025, at Europa-Park in Germany, has evolved significantly since its inception. Under the leadership of Carole Olinger, who became Head of CloudFest Hackathon in 2018, the event transformed from a corporate-sponsored coding sprint into a fully open-source, community-driven gathering focused on benefiting the broader web ecosystem[8].

The 2025 hackathon emphasized inclusivity and cross-disciplinary collaboration, recognizing that effective security solutions require input from not just developers, but also designers, project managers, and other specialists[8]. This collaborative approach proved particularly valuable for addressing complex challenges like supply chain security, which demands multifaceted solutions.

Among the various projects undertaken during the hackathon, one initiative stood out for its potential impact on open source security: the SBOMinator project, which aims to enhance transparency and security in software supply chains[1].

The SBOMinator Project: Enhancing Supply Chain Transparency

The SBOMinator project emerged as a response to increasing security threats and regulatory requirements for software supply chain transparency. At its core, the project addresses a fundamental challenge: how to effectively document and manage the complex web of dependencies that comprise modern software applications[1].

What Is an SBOM?

Central to the SBOMinator project is the concept of a Software Bill of Materials (SBOM). An SBOM is essentially a dependency tree that lists all libraries and their versions used in a specific application. Think of it as an ingredients list for software, providing transparency about what components are included in any given application[1].

This transparency is crucial for security because it allows developers and users to:

• Identify vulnerable components that need updating
• Assess the security posture of their software supply chain
• Respond quickly when vulnerabilities are discovered in dependencies
• Comply with emerging regulatory requirements

The SBOMinator's Technical Approach

The team behind SBOMinator devised a two-pronged approach to generating comprehensive SBOMs:

1. Infrastructure-based dependency collection: The tool gathers information from package management files like composer.json or package.json, exploring all such files within an application and merging the results[1].
2. Static Code Analysis (SCA): For areas of code that don't use package managers, SBOMinator employs static analysis to identify library inclusions directly in the code. This "brute-force" approach ensures nothing is missed[1].

The output follows standardized SBOM schemas: either SPDX (backed by the Linux Foundation) or CycloneDX (backed by the OWASP Foundation), ensuring compatibility with existing security tools and processes[1].

To make the tool widely accessible, the team developed integrations for multiple content management systems:

• A WordPress plugin connecting to "Site Health" and WP-CLI
• A TYPO3 admin extension
• A Laravel Artisan command[1]

The WordPress Vulnerability Landscape in 2025

The need for enhanced supply chain security is underscored by the current state of WordPress security. According to Patchstack's State of WordPress Security report, security researchers uncovered 7,966 new vulnerabilities in the WordPress ecosystem in 2024 – averaging 22 vulnerabilities per day[4].

Of these vulnerabilities:

• 11.6% received a high Patchstack Priority score, indicating they are either known to be exploited or highly likely to be exploited
• 18.8% received a medium score, suggesting they could be targeted in more specific attacks
• 69.6% were rated low priority, but still represent potential security risks[4]

Plugins continue to be the primary weak point in the WordPress security landscape, accounting for 96% of all reported issues. Most concerning is that 43% of these vulnerabilities required no authentication to exploit, leaving websites particularly vulnerable to automated attacks[4].

The report also debunks a common misconception: popularity does not equal security. In 2024, 1,018 vulnerabilities were found in components with at least 100,000 installs, with 153 of these receiving High or Medium priority scores. This demonstrates that even widely-used plugins can harbor serious security flaws[4].

Regulatory Drivers for Enhanced Supply Chain Security

The European Union's Cyber Resilience Act (CRA), which entered into force in early 2025, represents a significant regulatory push for enhanced software security. As the first European regulation to establish minimum cybersecurity requirements for connected products sold in the EU market, the CRA has far-reaching implications for WordPress developers and site owners[3].

The regulation applies to all products with "digital elements," including both hardware with networked functions and pure software products. While non-commercial open source software is exempt, commercial WordPress themes, plugins, and services fall under its purview[3].

Key requirements under the CRA include:

• Ensuring access to security updates
• Maintaining separate security and feature update channels
• Implementing vulnerability disclosure programs
• Providing transparency through Software Bill of Materials (SBOM)[1]

Products newly placed on the market must meet all requirements by the end of 2027, giving developers a limited window to achieve compliance[3]. This regulatory pressure, combined with increasing security threats, creates a compelling case for addressing supply chain security proactively.

The Limitations of Current Security Approaches

Traditional security approaches are increasingly inadequate for protecting against modern supply chain attacks. The Patchstack report highlights a concerning reality: all popular WAF (Web Application Firewall) solutions used by hosting companies failed to prevent attacks targeting a critical vulnerability in the Bricks Builder plugin[4].

This failure stems from fundamental limitations:

• Network-level firewalls (like Cloudflare) lack visibility into WordPress application components and sessions
• Server-level WAF solutions (like ModSec) can't see into WordPress sessions, leading to high false-positive rates
• Most solutions rely on generic pattern-based rulesets that aren't optimized for WordPress-specific threats[4]

Perhaps most concerning is that 33% of reported vulnerabilities have no official patches available when they're publicly disclosed, leaving many sites vulnerable even when administrators attempt to stay updated[4].

Tools and Techniques for Securing the WordPress Supply Chain

To address these challenges, WordPress developers and site owners need a multi-layered approach to security:

1. Implement Software Bill of Materials (SBOM)

The SBOMinator project makes SBOM generation accessible for WordPress developers, providing critical visibility into the components that make up plugins and themes. This transparency is the first step toward effective supply chain security, allowing for better risk assessment and vulnerability management[1].

2. Adopt Specialized Security Solutions

Application-aware security solutions like the Patchstack virtual patching system offer protection against known vulnerabilities, even when official patches aren't available. Unlike generic WAFs, these WordPress-specific solutions can accurately detect and block exploitation attempts without false positives[4].

3. Practice Regular Auditing and Monitoring

Systematically reviewing installed plugins and themes, monitoring for suspicious activity, and implementing logging are essential practices for early detection of potential security breaches. This is particularly important given the prevalence of supply chain attacks targeting WordPress components[2].

4. Participate in Community Security Initiatives

The WordPress security community, including organizations like the WordPress Security Team led by John Blackbourn, plays a vital role in identifying and addressing vulnerabilities. Contributing to or following these initiatives helps sites stay informed about emerging threats[14].

The Future of WordPress Supply Chain Security

Looking ahead, several trends will shape the evolution of WordPress supply chain security:

The Rise of AI-Powered Attacks

Security experts predict that AI tools will accelerate the exploitation of vulnerabilities by enabling faster development of attack scripts and more advanced malware. This could make even low-priority vulnerabilities attractive targets, as the cost of exploitation decreases[4].

Increasing Regulatory Pressure

As the EU Cyber Resilience Act and similar regulations come into full effect, WordPress developers will face growing pressure to formalize their security practices. This regulatory environment may drive adoption of tools like SBOMinator that facilitate compliance[3].

Community-Driven Security Initiatives

The collaborative approach demonstrated at the CloudFest Hackathon exemplifies how the open source community can come together to address security challenges. Future initiatives will likely build on this foundation, creating more robust tools and frameworks for supply chain security[8].

Conclusion: Building a More Secure WordPress Ecosystem

The SBOMinator project and CloudFest Hackathon 2025 represent significant steps toward addressing the complex challenge of supply chain security in the WordPress ecosystem. By enhancing transparency, standardizing security practices, and fostering community collaboration, these initiatives contribute to a more secure foundation for WordPress sites worldwide.

For WordPress site owners, the message is clear: traditional security measures are no longer sufficient. Protecting against supply chain attacks requires a comprehensive approach that includes visibility into software components, specialized security solutions, and participation in the broader WordPress security community.

As regulatory requirements like the EU Cyber Resilience Act come into effect, proactively addressing these security challenges will become not just a best practice, but a business necessity. The collaborative nature of the WordPress community remains one of its greatest strengths in facing these evolving threats.

For immediate protection against supply chain vulnerabilities and other WordPress security threats, consider implementing WP-Firewall's comprehensive security solution. With features designed to detect and block exploitation attempts, WP-Firewall provides essential protection while the broader ecosystem works toward more secure supply chains.

Visit https://wp-firewall.com to learn more about securing your WordPress site against today's advanced security threats and sign up for our newsletter to stay informed about the latest WordPress security developments and protection strategies.