Breach Year
2019
Breach Type
Software Supply Chain Attack
TPRM Lesson
Admin software in your perimeter is supply chain risk.
What was the Webmin Source Code Backdoor breach?
The Webmin backdoor was a 2019 supply chain incident in which malicious code, present in official Webmin builds from mid-2018 to mid-2019, exposed more than one million server administration installs to a remote code execution vulnerability tracked as CVE-2019-15107, originating from a compromised build infrastructure.
Webmin is the case that showed admin software in your perimeter is supply chain risk.
Sysadmins trusted a widely used web-based Unix management panel to run their servers. The trust extended to whatever the build pipeline produced.
For over a year, that pipeline produced a backdoor.
Webmin is a widely used open-source web interface for administering Unix and Linux servers, with over a million installations worldwide.
April 2018. Malicious code introduced into official Webmin builds via compromised build infrastructure.
August 2019. Researcher Özkan Mustafa Akkuş disclosed CVE-2019-15107 at DEF CON.
Post-disclosure. Webmin project acknowledged that its build server, not source repository, had been compromised.
The incident drove adoption of reproducible builds, signed release attestations and SBOM discipline for open-source projects.
The source code was clean. Only the shipped binary was infected. Reading the code proved nothing.
A. Identity and Access. No public exposure of admin panels.
B. SaaS and API Integrations. Restrict admin-tool integrations.
C. Software Supply Chain. Require reproducible builds and SBOMs.
D. File Transfer and Data Exchange. Monitor admin-tool outbound.
E. Data Protection. Segment servers by trust zone.
F. Vendor Incident Response. Mass-patch playbooks.
G. Fourth-Party Risk. Assess open-source build infrastructure.
H. Board and Executive Reporting. Open-source risk quarterly.
"When source and binary disagree, the binary is what runs."
A 2019 supply chain compromise of Webmin's build infrastructure.
Researcher disclosure at DEF CON 2019.
CVE-2019-15107.
Over one million worldwide.
The malicious code was in official builds, not source.
Reproducible builds, SBOMs and admin panel segmentation.
Trust the pipeline, not the repo.
Webmin recovered but the incident became a canonical build-pipeline case study.
All claims in this case study are grounded in verified public reporting.
TPRM Blog
Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.
Founding SponsorAlmost every case here was findable before it happened
Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding
Most people talk about risk management. Few can prove their expertise under pressure.
Start Your Free Certification