CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Supply Chain Risk in Advanced Installer Update Tool

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A supply chain risk in the Advanced Installer tool, used to create software installers, has been identified. The risk allows attackers to manipulate software updates, potentially affecting downstream customers. The issue is not a vulnerability but a design choice that allows unsigned updates. The tool is widely used by major software vendors, including Microsoft, Apple, and Dell. The risk involves attackers breaching a software developer and injecting malicious updates through the Advanced Installer's update tool, which does not require digital signatures by default. This could lead to widespread malware distribution. Cybersecurity provider Cyderes has highlighted the risk and recommended that vendors enforce digital signatures for updates to mitigate the threat.

Timeline

  1. 05.11.2025 16:00 1 articles · 5d ago

    Supply Chain Risk Identified in Advanced Installer Update Tool

    Cybersecurity provider Cyderes has identified a 'bring your own update' (BYOU) risk in the Advanced Installer tool. The risk allows attackers to manipulate software updates, potentially affecting downstream customers. The issue is not a vulnerability but a design choice that allows unsigned updates. Cyderes has recommended that vendors enforce digital signatures for updates to mitigate the threat. The risk is comparable in scope to the SolarWinds supply chain attack.

    Show sources
    Open in new tab

Information Snippets