Security
Patch Tuesday Triage: How to Handle 1,411 Fixes in One Month
Microsoft's October release fixed a record number of flaws, including three zero-days. Here is a repeatable way to sort a patch flood before the next one lands.
Security
13 articlesSupply chain, secrets, and the vulnerability classes that keep resurfacing in real codebases.
13 articles
-
-
SecurityHow to Check Your Repos for the GhostAction Workflow and Lock Down Actions
A fake security-audit workflow is stealing secrets from GitHub repositories. Here are the searches, the cleanup order, and the settings that stop it.
-
Securitynpm SlugFest Explained: How Trusted Publishing Let Attackers Hijack 1,500 Packages
A naming flaw in npm Trusted Publishing exposed more than 1,500 packages to takeover with no stolen credentials. Here is how SlugFest worked and what to audit now.
-
SecurityGitSpawn Explained: How a Hostile .git/config Runs Code Through AI Coding Agents
Eight flaws across seven coding agents let a repository run code before any approval prompt. Here is how GitSpawn works and how to protect your machine.
-
SecurityHow to Patch PHP2Shell (CVE-2026-109618 and CVE-2026-109619) Today
Two critical PHP flaws let an unauthenticated attacker reach remote code execution. Here is the patch order, the stopgap settings, and the checks to run afterward.
-
SecurityLiteLLM 1.107.0 Compromise Explained: How a .pth File Ran on Every Python Start
A poisoned LiteLLM release on PyPI and Docker stole cloud and AI credentials without ever being imported. Here is the mechanism, the timeline, and the cleanup.
-
SecurityShai-Hulud Hit Tensorlake's npm Package: How to Check Your Builds and Rotate Secrets Safely
A poisoned release of an AI sandbox SDK was live for hours. Here is how to find out whether it touched your machines, and why the order of your cleanup matters.
-
SecuritySoftware Supply Chain Attacks, Explained for Engineering Teams
Tyrell Banks on software supply chain attacks: what actually matters for engineering teams making this call.
-
SecuritySecrets Scanning Tools Compared: Which One Catches What
Tyrell Banks on secrets scanning tools: what actually matters for engineering teams making this call.
-
SecuritySBOM Generation How-To: Build a Software Bill of Materials Without Slowing Down Releases
Tyrell Banks on software bill of materials SBOM: what actually matters for engineering teams making this call.
-
SecuritySAST vs. DAST vs. SCA: What Each Security Scan Actually Catches
Kelsey Mabry on SAST vs DAST vs SCA: what actually matters for engineering teams making this call.
-
SecurityLeast Privilege Access: A Practical Starting Point for Cloud Engineering Teams
Jordan Pike on least privilege access cloud: what actually matters for engineering teams making this call.