Khushi Trivedi·17h agoA Silent Patch Is Loud to Attackers. Why Is It Quiet to Your Scanner?Last year I was bumping a base image and, out of habit, read the release notes of a parsing library we ship. One line stood out: “Fix…
0xK1L·19h agoInside the LiteLLM 1.107.0 Compromise: How One Forgotten Key Led to a Poisoned PyPI ReleaseBlack October 2026, part 10: an admin key left in a public commit for months led, step by step, to a malicious LiteLLM release that ran a…
InReflectizbyOran F·21h agoPolymarket Hack: How a Hijacked DebugBear Script Drained $2.7MIn the Polymarket hack, the script’s URL never changed. The code behind it did. Here’s how a trusted monitoring tool drained 737 accounts…
Pooja Bolla·22h agoSoftware Supply Chain Security on Kubernetes, Part 2: SBOMs and Vulnerability Gates in GitHub…How I list what’s inside every image, stop the risky ones in CI, and attach that list to the image so it can’t be swapped later.
InAI for Backend EngineersbyNavya Devadiga·1d ago12 Editor Extension Defaults Behind the Trojanized Claude Code Build, and the Fix for EachA tampered Claude Code build ran for 11 hours and planted SSH keys. The editor defaults that let it, and the cooldown that stops it.
Karanam Shrivasta·1d agoPart 37 — Secure Software Development & Supply Chain Security# Part 37 — Secure Software Development & Supply Chain Security
Vaibhav Tiwari·1d agoBlack October 2026: PHP2Shell, Node2Shell, eMudhra — The Month Trust BrokeCritical remote code execution, compromised certificate authorities, poisoned software packages, and vulnerabilities hiding inside the…
Raghu Juluri·1d agoHow to Use NVIDIA SkillSpector: Scan an AI Agent Skill Before You Install ItA step-by-step guide to scanning agent skills: the install, your first scan, what the risk score actually means, and how to turn it into a…
0xK1L·2d agoGitHub Actions Turned Against Its Users: How GhostAction and Gheist Stole CI/CD SecretsBlack October 2026, part 4: GitHub itself was not breached. Stolen developer tokens were used to plant workflows that dumped repository…
0xK1L·2d agoThe Tensorlake npm Compromise: How the Shai-Hulud Worm Jumped Into an AI SDKBlack October 2026, part 3: a single npm install of tensorlake 0.5.144 was enough to run a credential-stealing worm, before any of your…
