Supply chains, AI, and the cloud: The biggest failures (and one success) of 2025

The Ars Technica year-in-review highlights a troubling convergence of supply chains, AI, and cloud outages as 2025’s defining security story. A cascade of supply-chain attacks and incidents—ranging from typosquatted packages in Go to the NPM flood of 126 malicious packages—showcased how a single compromised component could ripple to millions of downstream users, with some campaigns affecting more than 23,000 organisations and opening access to private keys.

The piece notes that security firm Socket suspects a backdoor campaign involved Web3.js and a malicious update, underscoring how attackers leveraged developer ecosystems to reach broad targets. In AI, long-term memory manipulation and prompt-injection exploits troubled several frameworks, including ElizaOS, Google Gemini, GitLab’s Duo, and the Gemini CLI, enabling repeated or broader misuse of trusted tools.

Cloud failures featured prominently as well, with Amazon reporting a 15 hours 32 minutes outage caused by a race condition in DNS configuration updates, while Cloudflare and Azure endured related disruptions in the same period. The review also touts a rare positive note—the Signal app’s quantum-resistant overhaul—among a sea of high-profile security mishaps.