5 commercial software attacks — and what you can learn from them

This report reviews five major commercial software supply-chain incidents — Sisense (mass credential exposure via a hard-coded token), JetBrains TeamCity (multiple critical CVEs exploited by state-aligned actors), CrowdStrike (widespread outage from a faulty update), Okta (service-account credential compromise via malware on an employee laptop), and XZ Utils (maintainer-introduced backdoor) — drawing lessons on credential hygiene, CI/CD hardening, SBOMs, least-privilege/service account management, and the fragility of the open-source maintainer model.