---
title: "#Supply Chain Security - AFeng Blog"
url: "https://afengblog.com/en/tag/supply-chain-security"
language: "en"
total: 2
---

# Tags: Supply Chain Security

- [When Google Certification Shields a Firmware Backdoor — Inside Videostrong's 1.47-Million-Device Android TV Betrayal](https://afengblog.com/en/blog/google-certified-xcpe-botnet-videostrong-android-tv.html) (2026-11-03 · Security & Privacy): Google, Japan's National Police Agency, and five security partners dismantled the XCPE firmware backdoor preloaded onto 1,472,554 Android TV devices, taking the rare step of naming and permanently banning licensed certification partner Videostrong Technology (parent of MECOOL) while severing access to over 10 million downstream bots. By delaying payload execution until first internet boot to slip past factory testing, the vendor turned eFuse-locked bootloaders into a trap that blocks legitimate buyers from flashing clean open-source firmware.
- [Black October 2026 — How PHP2Shell and LiteLLM Exposed the AI Open-Source Crisis](https://afengblog.com/en/blog/black-october-2026-php2shell-litellm-ai-open-source.html) (2026-11-03 · Security & Privacy): Between October 17 and 30, 2026, 14-year-old PHP2Shell RCEs, Google Brotli out-of-bounds writes, TianoCore UEFI flaws, eMudhra's single-byte CA key, and the 101-minute LiteLLM supply-chain attack detonated concurrently. Here is how frontier AI models compressed decade-old bug hunting into a single week—and pushed a 13-developer open-source foundation to the brink.