A coordinated botnet of compromised GitHub accounts launched a widespread attack, opening seemingly harmless pull requests before pushing a malicious shell script directly to default branches. The ...

An APT verification bypass can let an attacker replace a package and run code as root. Learn how to patch CI/CD runners and container images, and use Harden-Runner to find HTTP package downloads and ...

We reproduced the *sshole OpenSSH authentication bypass on Alpine Linux. See the exact exposure conditions, lab results, patched versions, and mitigations for musl-based hosts and containers.

A compromised release of @ethersphere/bee-js executes malicious code during installation. The payloads target Swarm Desktop wallet data and attempt to establish persistent access on affected systems.

On October 29, 2026, trojanized builds (2.1.312 and 2.1.313) of the official Claude Code VS Code extension were published to Cursor's VS Code Extension Marketplace for macOS and Windows.

The rule list shows every rule's campaign, severity, revision, and how many of its checks are required. Coverage spans the campaigns that have hit GitHub repositories hardest, including Miasma, Mini ...

2. Know where a package landed When a package turns out to be malicious, teams need to know where it was installed. Secure Registry logs every request and, with source attribution set up, links each ...

Use Harden-Runner to investigate workflow activity and enforce network policies, alongside a review of build access and OIDC trust.

An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence. We rebuilt the exact attacker build, recovered the GlassWorm loader from an ...

Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual ...

Binance’s November 3 findings trace the attack from a malicious interview assignment through developer tools, an internal AI tool, and stolen deployment credentials to wallet signing. We examine the ...