News related to
cloud

SINGAPORE – Media OutReach Newswire – 26 May 2026 – ASEAN Cableship Pte Ltd (ACPL) proudly marks its 40th anniversary this year under the theme “40 Years Leading Global Connectivity — Heritage, People, Fleet and Future.” For four decades, ACPL has been at the forefront of global connectivity, delivering submarine cable installation, repair and maintenance, as well as nearshore and onshore cable projects across Southeast Asia and the Indian Ocean with reliability and resilience.

To commemorate this milestone, ACPL hosted a gala dinner on 25th of May, where it unveiled its new corporate logo, symbolising the company’s evolution and forward-looking vision. The refreshed logo reflects ACPL’s continued commitment to innovation, operational excellence, and its role in enabling the future of global digital connectivity.

ACPL’s operational strength is anchored by its fleet of purpose-built cable vessels and supporting assets. Today, the company operates three cable ships and one barge — ASEAN Restorer, ASEAN Explorer, ASEAN Protector, and its latest addition, ASEAN Challenger, which was inaugurated in 2024. With the addition of this vessel, ACPL is better positioned to deliver timely and reliable cable operations, supporting the rapidly growing demand for submarine cable infrastructure driven by the continued expansion of global data traffic, cloud services, and digital connectivity.

“Our 40th anniversary is not only a celebration of our past, but a commitment to our future,” said Mr. Yue Meng Fai, Chief Executive Officer of ASEAN Cableship Pte Ltd. “The launch of our new corporate logo reflects our evolution as a company — one that is rooted in a strong heritage while continuously advancing towards the future. We will continue to safeguard our heritage of trusted operations, empower our people as a united team with resolute commitment to quality, enhance our fleet to remain reliable and innovative, and shape our future by leading the transformation of global connectivity in a responsible and sustainable way.”

The anniversary event brought together industry partners, stakeholders and clients to commemorate ACPL’s achievements and to mark the next chapter of its journey. Throughout the year, ACPL will commemorate this milestone through various initiatives that honour its legacy while reinforcing its dedication to responsible operations and long-term value creation.

With 40 years of trusted legacy, ACPL remains committed to connecting the world — resolutely, reliably and responsibly.

Hashtag: #ACPL #ASEANCableship #submarine #marine #shipping #anniversary #logo


The issuer is solely responsible for the content of this announcement.

ASEAN Cableship Pte Ltd (ACPL)

Established in 1986, ASEAN Cableship Private Limited (ACPL) is a leading provider of submarine cable installation, repair, and maintenance services in the Asia Pacific region. Headquartered in Singapore, ACPL was formed by a consortium of six prominent telecommunications entities from the original ASEAN member countries, reflecting strong regional cooperation across Indonesia, Malaysia, the Philippines, Singapore, and Thailand. ACPL has built a strong reputation as a pioneer in submarine cable repair and maintenance, supporting critical telecommunications infrastructure under the Southeast Asia and Indian Ocean Cable Maintenance Agreement (SEAIOCMA), spanning from Djibouti to Guam and from Taiwan to Australia.

In addition to its repair and maintenance capabilities, ACPL is also an established submarine cable installer and integrator. Its services include main lay submarine cable installation and maintenance, shore-end landing and beach works, project management, offshore and diving support services, Universal Joint consumable supplies and jointing equipment, as well as engineering consultancy, site surveys, and desktop studies. ACPL remains committed to advancing submarine cable system installation and repair, delivering professional and reliable services to meet evolving customer needs and support a sustainable, connected future.

For more information, please visit: .

Security researchers have flagged a privacy weakness in WhatsApp’s Apple apps, warning that chat databases on macOS and iOS may sit unencrypted inside shared app group containers, creating a gap between the platform’s end-to-end encryption claims and the way messages are handled after they reach a user’s device. The concern centres on local storage, not message transmission. WhatsApp’s end-to-end encryption is designed to prevent outsiders, network operators […]

North Korea-linked hackers have upgraded the InvisibleFerret malware to bypass script-based security tools, converting its Python code into compiled modules that are harder for defenders to inspect and block. The campaign is attributed to Void Dokkaebi, also tracked as Famous Chollima, a threat group associated with operations against software developers, cryptocurrency firms and technology workers. The latest version uses Cython-compiled files, appearing as. pyd modules on Windows […]

US federal investigators have warned that a new phishing-as-a-service platform called Kali365 is enabling cybercriminals to steal Microsoft 365 access tokens and bypass multi-factor authentication without capturing victims’ passwords. The platform, first observed in April 2026 and distributed mainly through Telegram, marks a sharper turn in identity-based attacks because it abuses legitimate Microsoft authentication flows rather than relying on fake login pages alone. By capturing OAuth access […]

MTN Uganda is exploring a partnership with Starlink as the arrival of satellite broadband reshapes the country’s data market and pushes established telecom operators to treat the new entrant as a possible infrastructure ally rather than a direct threat. The talks follow Uganda’s decision to clear Starlink Services LLC for operations after a long regulatory process. The Uganda Communications Commission signed a memorandum of understanding and a […]

Jensen Huang’s arrival in Taipei ahead of Computex has put Nvidia’s next AI platform at the centre of a widening test for Taiwan’s semiconductor supply chain, as the company seeks more production capacity for Vera Rubin while riding record demand for data-centre chips.

Huang is expected to meet Taiwan Semiconductor Manufacturing Company chairman and chief executive C. C. Wei as Nvidia prepares a second-half production ramp for Vera Rubin, the next-generation platform that combines new Vera CPUs, Rubin GPUs, advanced memory and high-speed networking for rack-scale AI systems. The visit has drawn close attention because Nvidia’s product cycle is now tied more tightly than ever to Taiwan’s foundries, packaging houses, server assemblers and component suppliers.

Nvidia reported revenue of $81.6bn for the quarter ended April 26, up 85 per cent from a year earlier, with data-centre revenue reaching $75.2bn, up 92 per cent. The company also authorised an additional $80bn in share repurchases and raised its quarterly dividend to 25 cents a share from 1 cent, underscoring the scale of cash generation from the AI infrastructure boom.

Demand is being driven by cloud providers, AI model developers, enterprise customers and sovereign AI projects, all seeking clusters capable of training and running larger generative and agentic AI systems. Nvidia has described the buildout of “AI factories” as one of the largest infrastructure expansions in technology history, with its platform spanning chips, networking, systems software and reference designs for data centres.

Vera Rubin is expected to follow the Blackwell and Grace Blackwell generation, which is still being shipped in high volumes. That overlap is creating pressure across Taiwan’s supply chain because new capacity must support existing commitments while preparing for a platform with different requirements in advanced packaging, high-bandwidth memory integration, board assembly, cooling and system validation.

Huang has described Vera Rubin as potentially the biggest product ramp in Nvidia’s history and one of the largest technology manufacturing efforts Taiwan has handled. Industry estimates around the platform point to millions of parts across each system and the involvement of well over 100 Taiwan-based ecosystem partners, from chip fabrication and advanced packaging to printed circuit boards, power systems, connectors, thermal modules and final server integration.

TSMC remains central to the effort because Nvidia depends on its leading-edge process technology and advanced packaging capacity. The challenge is not limited to wafers. CoWoS and other packaging technologies have become strategic bottlenecks as AI accelerators require multiple logic dies, high-bandwidth memory stacks and dense interconnects. Any delay in packaging expansion can ripple through server production schedules, cloud deployment plans and Nvidia’s revenue timing.

Taiwan’s broader technology sector has become a critical artery for the global AI trade. TSMC, Foxconn, Quanta, Wistron, Wiwynn, Inventec and a dense network of specialist suppliers are competing to add capacity while dealing with constraints in land, power, water, skilled labour and equipment availability. The concentration gives Nvidia speed and engineering depth, but also exposes the company to geopolitical and operational risks.

China remains the clearest commercial setback. Huang has said US export controls have pushed Nvidia’s share of China’s advanced AI chip market to zero, a striking reversal for a company that once held a dominant position there. The restrictions have strengthened the opening for Huawei and other domestic suppliers, while leaving Nvidia dependent on whether Washington and Beijing allow compliant chips to be sold without triggering national-security objections.

That loss has not slowed Nvidia’s global momentum, but it has changed the composition of growth. Revenue is now increasingly concentrated in markets where hyperscale cloud companies, enterprise AI developers and governments are building large AI data centres outside China. For investors, the question is whether demand can keep absorbing each successive architecture at the scale implied by Nvidia’s guidance.

Nvidia forecast revenue of about $91bn for the current quarter, above market expectations, signalling that orders for AI infrastructure remain strong despite concerns about overcapacity, power shortages and the pace at which customers can monetise AI services. Operating expenses rose 49 per cent to $7.75bn, reflecting the growing cost of research, supply commitments and ecosystem investments needed to sustain the company’s lead.

Vibe coding has moved from a developer shortcut to a mainstream software-building habit, with non-developers now making up 63 per cent of users creating applications through natural-language prompts rather than conventional programming. The shift is drawing writers, students, founders, investors, teachers and small businesses into a field that had long required technical training. These users are building websites, internal dashboards, classroom tools, workflow apps and lightweight commercial […]

Advertisements

Chainlink has made its data standard available through AWS Marketplace, giving cloud developers and enterprise technology teams a simpler route to deploy oracle infrastructure for tokenised assets, stablecoins, decentralised finance and on-chain financial applications. The launch brings Chainlink Data Feeds, Data Streams and Proof of Reserve into the AWS procurement environment, reducing the need for institutions to build bespoke systems to connect blockchains with market data, reserve […]

Qatar has stepped up its investment campaign in China with high-level business meetings in Shanghai and Hangzhou aimed at turning long-standing trade links into deeper industrial, technology and financial partnerships.

Invest Qatar’s delegation, led by its chief executive Sheikh Ali bin Alwaleed Al-Thani, held executive-level meetings, site visits and closed-door business discussions with Chinese companies across advanced manufacturing, life sciences, industrial technologies and digital platforms. The engagements included WuXi Biologics, Shanghai SUS Environment, Cainiao Group and Ant International, placing the tour at the intersection of Qatar’s diversification agenda and China’s strengths in biotechnology, logistics, environmental services and digital finance.

The visit was designed to present Qatar as a platform for regional expansion, with Invest Qatar highlighting support for market entry, regulatory coordination, site selection, expansion planning and aftercare services. The pitch reflects Doha’s effort to move beyond energy-led ties and attract capital, technology and operational expertise into sectors linked to the Third National Development Strategy and Qatar National Vision 2030.

China already occupies a central place in Qatar’s external economic network. Bilateral cooperation spans energy, logistics, manufacturing, technology and financial services, while Qatar hosts about 520 Chinese companies. Over the 2017-2026 period, China has ranked among Qatar’s top 10 sources of foreign direct investment, with 59 projects generating more than $3bn in capital expenditure and creating more than 3,200 jobs across multiple sectors.

The Shanghai and Hangzhou programme signals a more targeted approach by Qatar’s investment promotion authorities. Rather than broad promotional activity, the delegation focused on companies that fit Qatar’s priority clusters. WuXi Biologics brings relevance to life sciences and contract research, Shanghai SUS Environment operates in waste-to-energy and environmental infrastructure, Cainiao Group is a major logistics and supply-chain player, and Ant International strengthens the digital payments and fintech dimension of the outreach.

Energy remains the anchor of Qatar-China economic relations. China is Qatar’s largest trading partner, with bilateral trade reaching $24.22bn in 2024. China exported goods worth about $4.17bn to Qatar and imported about $20.05bn, led by liquefied natural gas and industrial helium. Qatar is also China’s second-largest source of LNG imports, reinforcing the strategic weight of the relationship at a time when Asian demand remains central to global gas markets.

QatarEnergy’s expansion strategy has further tightened industrial links with China. Long-term LNG supply arrangements linked to the Chinese market, together with major vessel orders placed with Chinese shipbuilders, have created a broader commercial ecosystem around the North Field expansion. Qatar aims to raise LNG production capacity from 77mn tonnes a year to 142mn tonnes by 2030, a target that will require shipping, engineering, financing and downstream partnerships across Asia.

The investment outreach comes as Gulf states increasingly seek to use energy relationships as a foundation for wider economic cooperation with Asia. For Qatar, China offers scale, capital depth and technology capacity. For Chinese groups, Qatar provides political stability, strong transport connectivity, free-zone infrastructure and access to Gulf, African and South Asian markets.

Doha is also seeking to position itself as a business base for companies navigating a more fragmented global trade environment. Regulatory certainty, a relatively high-income market, advanced digital infrastructure and a sovereign investment ecosystem give Qatar tools to compete for regional headquarters, specialised manufacturing and services projects. The challenge will be converting exploratory meetings into project commitments in sectors where regional competition is intense, particularly from Saudi Arabia and the UAE.

Financial services form another important strand of the relationship. Qatar Investment Authority’s moves in China’s asset management sector and broader Gulf interest in Asian financial markets point to a shift from passive portfolio exposure towards more strategic investment channels. That trend could support new capital-market links, fintech partnerships and investment vehicles connecting Doha and Chinese financial centres.

The latest Invest Qatar tour also reflects a diplomatic-economic strategy that has become more visible across Asia. Qatar has sought to deepen ties with major economies while keeping its partnerships diversified across the United States, Europe, China and other Asian markets. This balancing approach allows Doha to pursue commercial opportunities while avoiding excessive dependence on any single investment corridor.

For Chinese companies, Qatar’s offer is strongest where national development goals align with corporate expansion plans. Life sciences companies can tap healthcare investment and research partnerships, logistics operators can link into Hamad Port, Hamad International Airport and regional re-export networks, and digital platforms can benefit from a market that has been investing in cashless payments, cloud services and smart-city infrastructure.

Gold prices advanced by more than 1 per cent on Monday as a weaker dollar and a sharp fall in crude oil prices strengthened demand for bullion, with investors reassessing inflation risks and the likely course of US monetary policy amid signs of progress in Washington’s talks with Tehran. Spot gold traded near $4,560 an ounce, extending gains after the dollar slipped against major currencies and oil […]

Anthropic’s Claude Mythos Preview has identified more than 10,000 high- or critical-severity software vulnerabilities through Project Glasswing, intensifying debate over whether frontier AI is becoming a defensive breakthrough or a new accelerant for cyber risk. The findings, disclosed after the initiative’s first month of operation, mark a sharp escalation in AI-assisted vulnerability discovery across software used in operating systems, browsers, cloud platforms, open-source projects and financial infrastructure. […]

Hackers have compromised the Laravel-Lang open-source ecosystem, turning trusted PHP localisation packages into a vehicle for credential theft and remote code execution across developer machines and build systems. The attack, detected on May 22, targeted packages used by Laravel applications to manage translations, attributes and HTTP status messages. Security teams tracking the incident identified malicious activity across laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes and laravel-lang/actions, with more than 700 historical […]

Cybercriminals are exploiting demand for AI coding tools by pushing fake Gemini CLI and Claude Code installation pages into search results, using the sites to deliver a fileless PowerShell infostealer aimed at developer workstations. The campaign, active since early March 2026, marks a sharper turn in financially motivated attacks against software teams as AI assistants become embedded in daily coding workflows. The attackers are not merely imitating […]

Huawei has deepened its Saudi Arabia cloud strategy through a distribution partnership with Gulf Applications, widening enterprise access to cloud infrastructure, artificial intelligence tools and disaster recovery services as the kingdom pushes ahead with its Vision 2030 digital agenda. The agreement appoints GAPP as Huawei Cloud’s official cloud solutions distributor in Saudi Arabia, placing the company at the centre of Huawei’s channel expansion in one of the […]

Texas has sued Meta Platforms and WhatsApp, accusing the messaging service of misleading users over the strength of its encryption and privacy protections, opening a fresh legal front in the global debate over encrypted communications, consumer rights and platform accountability. The lawsuit, filed in Harrison County, alleges that WhatsApp has assured users their messages are protected by end-to-end encryption while Meta and WhatsApp retain access to “virtually […]

Hosting providers using LiteSpeed’s user-end cPanel plugin are confronting an actively exploited privilege-escalation flaw that can allow any authenticated cPanel account to run scripts as root and take control of affected Linux servers. The vulnerability, tracked as CVE-2026-48172, has been rated at the maximum severity level by security trackers and affects LiteSpeed cPanel user-end plugin versions from 2.3 through 2.4.4. LiteSpeed patched the initial flaw in version […]

Hackers are exploiting unsupported F5 BIG-IP appliances to gain SSH access to enterprise Linux systems, turning trusted edge infrastructure into entry points for deeper attacks on identity systems and internal applications. A May 22 threat intelligence disclosure detailed a multi-stage intrusion that began with an exposed F5 BIG-IP load balancer and moved through Linux infrastructure, an internal Atlassian Confluence server and eventually Active Directory. The case underlines […]

Google’s publication of exploit code for an unresolved Chromium security flaw has intensified scrutiny of how browser vulnerabilities are handled when technical details surface before a patch is ready. The issue affects the Chromium codebase that underpins Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi and several other browsers used across desktop and mobile environments. Security researchers say the flaw can be abused through the Background Fetch API […]

Anthropic PBC is moving towards closing a funding round that could exceed $30 billion at a valuation above $900 billion, a transaction that would place the Claude maker among the world’s most valuable private companies and intensify the capital race reshaping artificial intelligence. The San Francisco-based company is expected to complete the round as soon as next week, though final terms could still change. The deal, if […]

Hackers are turning Middle East telecoms and hosting networks into a major command-and-control layer, exposing a regional cyber risk that now extends beyond compromised devices to the infrastructure patterns that sustain attacks. A three-month mapping of malicious activity between 1 February and 1 May identified more than 1,350 active C2 servers across 98 infrastructure providers in 14 countries, including Saudi Arabia, the UAE, Turkey, Israel, Iraq, Iran, […]

Revenue Up 35.4% Year-on-Year API Token Call Volume Surges Nearly 6 Times

HONG KONG SAR – Media OutReach Newswire – 22 May 2026 – Phancy Group Co., Ltd. (“Phancy” or “The Company”, stock code: 6682.HK), a leading general artificial intelligence company, today announced its unaudited consolidated results for the first quarter ended 31 March 2026.

During the period, Phancy achieved revenue of approximately RMB1.458 billion, representing a 35.4% year-on-year increase. Gross profit margin remained at 35.1%. Phancy leveraged its deep expertise in full-stack AI cloud services, to capitalize on the accelerating adoption of localized computing power and strong enterprise demand for AI solutions. The Company achieved robust growth in its core businesses, accelerated product innovation, and secured several major partnerships, sustaining strong operational momentum.

2026 First Quarter Business Highlights:

Unified Enterprise AI Platform Drives Explosive Core Business Growth

Global computing resources remain constrained, while demand for both private enterprise AI deployments and API-based model calls continues to grow rapidly. Phancy’s enterprise-grade AI platform is built on a unified core architecture that seamlessly supports both API calling scenarios and dedicated private deployments. This significantly boosts AI application efficiency and resource utilization. Supported by a mature computing power supply chain developed over many years, Phancy’s deployable computing power resources have increased by over 200%. This enables the Company to effectively meet surging Token demand and consistently deliver stable, high-quality AI services to its customers.

In the first quarter of 2026, API Token call volume surged nearly 6 times compared to the same period in 2025, and already accounted for nearly 40% of the full-year 2025 total. Meanwhile, the Agentic AI business expanded rapidly, with deepening commercial adoption. Orders on hand grew nearly 100% compared to the end of 2025, emerging as a major growth driver for the Company.

AI Technology Iteration Accelerates, Commercialization Beats Expectations

Building on its continued push into digital employee applications and AI empowerment across business units, Phancy has significantly shortened the product development cycle from R&D to commercialization, enhancing overall operational efficiency and customer satisfaction.

As of mid-May 2026, ModelHub XC has completed adaptation and optimization for over 70,000 AI models on domestic chips, achieving more than 70% of its full-year target – well ahead of schedule.

In May, Phancy launched PhanthyMovie, a professional-grade AI video generation platform designed to enhance creativity, control, and stability in video production, enabling standardized and large-scale content creation for the industry.

Leveraging its advanced technology and proven execution capabilities, PhanthyMovie achieved rapid commercial traction. Just days after launch, the Company entered into a strategic cooperation agreement with Huanxi Media, covering approximately US$200 million in AI Token usage. The two parties will also collaborate on the development of a next-generation AI-powered film and television content production platform, further strengthening Phancy’s position in the AI-driven cultural and creative sector.

Core Products Align Closely with Policy Trends, Strengthening Compute-Model Integration

Since May 2026, China’s AI sector has seen a series of positive policy developments focused on computing infrastructure, data element circulation, and open-source compliance governance. Phancy’s core products, including HAMi vGPU and ModelHub XC, are well-aligned with national policy directions and mainstream industry trends.

In terms of computing resource allocation, policies emphasize cross-regional collaboration and broader access to computing power. Phancy’s HAMi vGPU offers unified scheduling and fine-grained resource partitioning, effectively improving utilization rates, optimizing data center energy efficiency, and supporting unified management across multiple chips to boost single-card efficiency.

In data and model governance, the government continues to promote high-quality dataset development and compliance management. ModelHub XC supports multi-model adaptation and optimization, incorporates data traceability and security certification features to help enterprises reduce compliance risks, and uses the EngineX engine for batch adaptation of domestic chips and models. This significantly improves compatibility while enhancing Token output efficiency through targeted model tuning.

Through deep integration of its computing and model layers, Phancy has built a comprehensive “Compute–Model” integrated solution. This addresses key industry needs such as efficient computing utilization, secure data supply, enterprise compliance, and domestic substitution, while strengthening its technological moat. The Company is well positioned to capture policy dividends and industry opportunities, supporting enterprises in their digital and intelligent transformation.

Hashtag: #PhancyGroup

The issuer is solely responsible for the content of this announcement.

About Phancy Group

Phancy Group (6682.HK) is a leading full-stack AI cloud services platform, providing comprehensive solutions for the AI 2.0 era. Our offerings include SageAIOS, HAMi vGPU and ModelHub XC, delivering efficient and scalable AI infrastructure with end-to-end capabilities. We provide a complete solution from heterogeneous compute resource management and optimization to the deployment of intelligent agent models. These solutions empower digital transformation across a wide range of industries, supporting our vision of building a large-scale and efficient “Token Factory.”

Guided by the mission of “AI for Everyone” and positioned as the “Navigator of AI,” Phancy Group is committed to becoming a global leader in Artificial General Intelligence.

Google and Blackstone have agreed to create a $5 billion TPU-powered cloud company, widening the battle for artificial intelligence infrastructure as enterprises seek alternatives to graphics processing units that dominate AI training and inference. The US-based venture will offer data centre capacity, operations, networking and Google Cloud’s Tensor Processing Units through a compute-as-a-service model. Blackstone is making the initial equity commitment, with the first 500 megawatts of […]

Companies are pushing vulnerable software into production even as artificial intelligence expands the speed, volume and complexity of application development across global supply chains. New industry findings show 75% of organisations often or sometimes deploy code they already know contains security weaknesses, underscoring a persistent gap between software delivery targets and risk controls. The figure marks only a limited improvement from last year’s 81%, suggesting that boards […]

India’s rapid AI adoption is exposing weak points in software supply chain security, with enterprises expanding automated development faster than their ability to detect compromised packages, unsafe containers and unverified AI components.

A 2026 software supply chain security assessment shows that about 65 per cent of organisations in India cannot detect malicious packages, while 71 per cent do not use container security tools. The findings underline a widening gap between the speed of AI-led software development and the controls needed to secure code, dependencies, models and deployment pipelines before they reach production systems.

Security teams are facing a more complex threat environment as AI coding assistants, model registries, agent frameworks and machine-learning libraries become embedded in day-to-day software engineering. AI is no longer confined to application features or analytics layers. It is becoming part of the software supply chain itself, influencing how code is written, tested, packaged and deployed.

Enterprises in India have been quick to adopt AI tools to improve developer productivity, reduce repetitive work and accelerate product releases. Yet the same shift has increased reliance on open-source packages, pre-trained models, plug-ins and automated build systems. Each of these components can introduce hidden risks if provenance, integrity and behaviour are not continuously verified.

Global software repositories are now attracting sustained attacks because they provide a direct route into enterprise development environments. Malicious npm packages rose by 451 per cent during 2025, while more than 48,000 new Common Vulnerabilities and Exposures were disclosed worldwide, a rise of about 20 per cent from the previous year.

The pressure on security teams is being amplified by the volume of AI-generated code. Developers in India are spending about 51 per cent of their time reviewing, validating and hardening code produced by AI tools. About 53 per cent treat such output only as a starting point and review every line before use, while 11 per cent rewrite AI-generated fixes from scratch.

This shift has altered the economics of software engineering. AI may reduce the time needed to draft code, but it can also transfer effort to verification, testing and security review. Weaknesses such as cross-site scripting, SQL injection and missing authorisation checks can still be reproduced by automated tools, particularly when developers rely on generated code without adequate scrutiny.

Governance is emerging as another area of concern. Nearly 97 per cent of organisations surveyed said they had certified AI model governance programmes, but only 59 per cent claimed full provenance visibility across production environments. About 48 per cent still needed a week or longer to produce audit-ready compliance evidence.

That gap points to a difference between policy and enforceable control. Many enterprises have AI governance frameworks on paper, but fewer can prove where every model, library, container image and software artefact came from, how it changed, who approved it and whether it complies with internal policy.

CERT-In has also warned that software supply chain compromises are increasingly targeting developer tools and trusted repositories. Its April 2026 activity note referred to attacks affecting npm, PyPI, GitHub Actions and container registries, including incidents involving Checkmarx, Trivy, LiteLLM, Axios, Telnyx and npm packages linked to the CanisterWorm campaign. The payloads observed in these attacks included credential harvesting, data exfiltration, remote execution and persistence within developer systems.

Model registries have added another layer to the risk. Around 1.4 million new AI artefacts were published on Hugging Face during 2025, representing 58 per cent of all new software packages tracked in one assessment. Researchers identified 495 malicious AI models in public repositories with active payloads capable of credential theft, command execution and reverse-shell activity, along with 969 malicious AI-agent skills designed to exploit developer environments and automation workflows.

For enterprises in India, the challenge is sharpened by the country’s role as a major software engineering and global capability centre hub. Bengaluru, Hyderabad, Pune, Chennai and Gurugram host large engineering teams serving banking, retail, telecoms, manufacturing and cloud services. These centres are increasingly responsible not only for maintenance work but also for product development, AI integration and security-sensitive digital platforms.

Regulatory and customer expectations are also tightening. Buyers are asking for software bills of materials, vulnerability disclosure processes, provenance records and proof that build pipelines are protected. CERT-In’s technical guidance on SBOM, QBOM, CBOM, AIBOM and HBOM has emphasised regular updates, vulnerability exploitability exchange documents and staff training around software supply chain visibility.

Security leaders are therefore moving towards stronger controls across development pipelines. These include automated malicious package detection, container image scanning, secrets detection, signed artefacts, dependency pinning, model provenance checks, policy enforcement in CI/CD systems and continuous monitoring of developer environments.

The investment case is becoming harder to ignore. Software supply chain attacks can bypass perimeter defences because they enter through trusted development channels. Once inside, malicious packages can steal credentials, alter builds, move into cloud environments or compromise downstream customers. AI raises the stakes because it can accelerate both legitimate development and attacker experimentation.

VISHNU RAJA
RYO YAMADA
HITORI GOTOH
IKUYO KITA