Open Source Strikes Back: The $600K Supply Chain Ransom | Pressure Zone ft. Caroline Wong
Source: YouTube · Hack The Box · published Jul 22, 2026 · 31:29
This Pressure Zone podcast episode puts Caroline Wong, Chief Strategy Officer, through a simulated supply chain crisis where a burnt-out open-source maintainer withholds a patch for a critical RCE vulnerability until a $600,000 sustainability fund is raised 0:25.
Key Takeaways:
• Visibility requires multiple approaches: Wong advocates combining SBOM delta inventory, runtime profiling, and WAF signatures while rejecting options that compromise availability 4:11
• Resist premature SEC disclosure: She chooses defensive non-disclosure, insisting on confirmed material impact before any regulatory filing 8:52
• Flexible narrative over data manipulation: When pressured to alter dashboards, she favors accurately relabeling metrics or pivoting to containment data rather than lying 13:15
• Incident command trumps cultural debates: During an engineering mutiny, she prioritizes active mitigation over retrospective accountability discussions 17:47
• Amputate to survive: For the final decision, she chooses removing the vulnerable logging module entirely to protect core databases, accepting degraded functionality over data corruption risk 22:22
Wong scores 88/100 as a "strategic architect" and closes with her key insight: "The humans are always the least predictable and all the biggest problems come from the people and the decisions that they make" 29:19.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] Welcome to the Pressure Zone, a podcast where we push the world's top security leaders past their comfort zone. Today we are stepping into the ultimate supply chain deadlock and we are joined by Caroline Wong, chief strategy officer. Welcome. >> Thank you. >> Okay, let's dive in. Your global enterprise platform relies heavily on Logback extension, an open-source utility [music] buried thousands of levels deep within your production cloud microervices. 3 hours ago, the solo open-source maintainer, [music] deeply burnt out and frustrated by tech giants profiting off of his his unpaid labor, posted a stunning announcement on GitHub. He has discovered a critical unauthenticated revoke code execution rce vulnerability affecting all current versions of the library. He has not released a …