⚙️ DevSecOps249

Northflank, a cloud application hosting platform, disclosed a breach on 30 October 2026 after a Wiz threat alert and told customers to assume all environment variables were decrypted and to rotate secrets. Customers reported unauthorized use of AI API keys. Wiz's "Black October for AI Developer Platforms" report counts at least nine incidents, including Railway, OpenCode, Warp and Lightning AI, and describes LLMJacking, with about 2.5 million Amazon Bedrock calls costing roughly $100,000 in two cases. Northflank has not said how attackers got in.

bleepingcomputer.comarticlePublished and added 31 Oct 2026

CVE-2026-97229 is a maximum-severity GitLab flaw in the CI/CD Regular Expression Compiler, caused by an integer overflow, that lets unauthenticated attackers run code via a crafted regular expression. CISA added it to the KEV Catalog and ordered federal agencies to patch under BOD 26-04. GitLab fixed it in CE/EE 19.4.2, 19.3.5 and 19.2.8, and Shadowserver tracks about 2,800 exposed CE instances.

bleepingcomputer.comarticlePublished and added 30 Oct 2026

CVE-2026-97229 is a CVSS 10 code execution flaw in Onigmo, Ruby's regular expression engine, reachable through crafted CI/CD configuration in GitLab. Attackers used it against Alpine Linux's GitLab on 20 and 21 October 2026 and failed; Alpine rebuilt the instance and found no tampering with aports or packages. Self-managed installs with their own Ruby need Ruby 3.3.13, 3.4.12 or 4.0.9, not just GitLab 19.3.6. CISA added it to KEV.

securityweek.comarticlePublished and added 30 Oct 2026

VulnCheck Open Source is an index of VulnCheck's open-source tooling for its vulnerability and exploit intelligence. It lists a Python API client, a CLI, a GitHub Action for CI/CD, go-exploit (a Go exploit framework), an MCP server for delivering intelligence to AI clients, and VulnCheck Insights, a Chrome extension that highlights CVEs, CPEs and PURLs on web pages and enriches them. The page gives only one-line descriptions.

vulncheck.comtoolAdded 29 Oct 2026

The OpenSourceMalware Show #27 (28 October 2026) is a podcast episode with transcript. It covers the Brotli decoder bug (CVE-2026-111497) vendored in C code across Python, Rust and PHP, and how to find copies via decode.c. It also covers the LiteLLM v1.107.0 compromise from an unrevoked admin key and a relaxed release control, and the MALFEX npm campaign hiding payloads in PNG-header files, plus an AGENTS.md lure and DPRK fake fonts in TTF/OTF.

opensourcemalware.comtalkPublished and added 29 Oct 2026

ADLC metrics is an Endor Labs guide to measuring security in the agentic development lifecycle, where AI coding agents write much of the code. It defines formulas across five categories: AI supply chain visibility, agent action security, agent-generated code, package risk and developer flow. It argues for normalizing findings per merged change, tracking pre-execution blocks, and building a six-to-eight metric scorecard.

endorlabs.comarticlePublished and added 29 Oct 2026

The ADLC maturity model is a proposed five-stage framework from Endor Labs for scoring security controls over coding agents, from unmanaged experimentation to continuous verification. Each stage has requirements on two tracks, agent actions (shell commands, MCP calls, package installs) and agent output (code, dependencies, secrets). It sets stage 3 at deterministic hooks that block actions, gives evidence-based assessment questions, and lists traps such as relying on prompt-level rules.

endorlabs.comarticlePublished and added 28 Oct 2026

Buyer's checklist from Endor Labs for evaluating security tools in the agentic development lifecycle (ADLC), where AI coding agents write code and take actions such as package installs, CI edits and tool calls. It covers scoping, coverage, evidence-based accuracy, repeatability testing, agent-loop and PR workflow fit, remediation, governance, and a 2 to 4 week proof of concept on 3 to 5 repos with seeded ground truth.

endorlabs.comarticlePublished and added 28 Oct 2026

Thread by Kizuno18 on the move from local stdio/Docker Model Context Protocol servers to remote HTTP/SSE endpoints in enterprise infrastructure. It names three trade-offs: credential boundary inversion (short-lived OAuth/JWT tokens instead of long-lived admin tokens on workstations), tool schema bloat solved by deferred discovery, and governance via HCP Terraform policy-as-code (Sentinel/OPA), audit trails and approvals. It is opinion, with no data or implementation detail.

x.comthreadAdded 29 Oct 2026, published 27 Oct 2026

Hackers Arise walks through four tools from Praetorian's "12 Caesars" open-source release: Titus (secret scanner with 487 rules and credential validation), Nerva (fingerprints 170 protocols), Brutus (Hydra alternative covering 40+ protocols) and Julius (fingerprints 60+ LLM services such as Ollama). It shows download and run commands in a Kali lab and how the tools chain together. The tools are Go single binaries; the post notes an exposed Ollama on port 11434 allows unauthenticated model use.

hackers-arise.comarticlePublished and added 27 Oct 2026

Aikido Images are free patched PHP container images on public ECR (public.ecr.aws/aikido-dev/php) that backport the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619 into release lines 5.5 to 8.5, except 8.0. Upstream fixed 8.2 to 8.5 in October 2026 and left 8.1 and older unpatched. The post shows docker pull and Dockerfile FROM changes, then rebuild, restart, session.upload_progress.enabled=0 and compromise checks.

aikido.devarticlePublished and added 26 Oct 2026

Thread on two October 2026 npm compromises: @subql/common 5.8.3 (5 October), published through GitHub Actions OIDC Trusted Publishing after the attacker tampered with the publish workflow, and tensorlake 0.5.144 (8 October), published by the project's own release workflow with valid provenance for about 1 hour 40 minutes. Both ran on install and stole cloud, GitHub, Kubernetes, Vault, SSH and .env credentials; tensorlake also took AI tool and MCP config. Its payload installed a gh-token-monitor service that deletes the home directory if the stolen GitHub token is revoked, so remove it before rotating.

x.comthreadAdded 27 Oct 2026, published 26 Oct 2026

The Pwn Request Reckoning is a Wiz post updating the GitHub Actions pull_request_target threat model for 2026. It covers what GitHub's checkout protections, read-only cache tokens and event policies block, and what still works. Remaining paths: SHA-pinned pre-backport actions/checkout, custom checkout scripts, issue_comment and repository_dispatch triggers, script injection, artifact poisoning, self-hosted runner state and allow-unsafe-pr-checkout. It ends with grep and zizmor audit steps.

wiz.ioarticlePublished and added 26 Oct 2026

Post by RicardoIQSource on breaches of developer platforms aimed at AI provider keys. It reports OpenCode (17 October, provider keys in its Console) and Zeabur (14-15 October, 3.2M environment variable records, admin tokens stored in plaintext since January 2024) as following the Railway incident. It claims three platforms were hit in eight days and links a blog with a timeline and remediation steps.

x.comthreadAdded 29 Oct 2026, published 26 Oct 2026

Gheist is a GitHub campaign disclosed by Wiz in October 2026. Stolen tokens push ci-sync-XXXXXX branches with a sync-check workflow that dumps repo secrets base32-encoded to evade log masking, fetches the logs via API, then deletes the run. 13,500+ branches and 850+ accounts were hit since 15 September. Public repos are protected by the approval hold; private and Enterprise repos are not. The thread lists IOCs (.gdmp_pat files, "gheist" user agent, "ci: sync config" commits) and rotation steps.

x.comthreadAdded 26 Oct 2026, published 25 Oct 2026

Gheist is a campaign tracked by Wiz Research since 15 September 2026 that uses stolen GitHub tokens to push a sync-check workflow on ci-sync-* branches in every reachable repository. The workflow prints base32-encoded secrets into logs, which the tool downloads through the GitHub API and then deletes. Over 13,500 branches from 850+ accounts were recovered. The post covers the two tool variants, a buggy self-hosted runner payload, GitHub's approval hold (which does not cover private repositories), overlaps with other campaigns, hunting queries, IOCs and hardening steps.

wiz.iowriteupPublished and added 25 Oct 2026

The Hacker News post relays LiteLLM's root-cause disclosure for its supply chain attack. A master key leaked on GitHub in May was never revoked. Attackers used it to reach the Agent Platform, steal a GitHub owner token, and publish a malicious PyPI release in October. A reply says the agent tool held the org owner's personal CLI login, which skips GitHub's 2FA re-check.

x.comthreadAdded 26 Oct 2026, published 24 Oct 2026

Post on the LiteLLM supply-chain compromise. Attackers spent eleven days in the GitHub org, ran a workflow on a throwaway branch to take twenty secrets including a GitHub App private key, then used stolen GitHub CLI OAuth tokens to publish malicious release 1.107.0 from a lookalike Berri-AI repo. A Python startup file harvested sixteen credential categories and LiteLLM proxy Postgres provider keys. Socket flagged the wheels in seven minutes.

x.comthreadAdded 26 Oct 2026, published 24 Oct 2026

Socket's Threat Research team reports that malicious cache.yml workflows ran in the BerriAI/litellm repository on 10 and 12 October 2026, eleven days before the 21 October release attack that published litellm==1.107.0. Each commit pushed to a short-lived ci-tmp-<hex> branch, then deleted it, sending base64-encoded CI secrets to webhook.site. Evidence comes from Actions metrics and environment deployment records; 20 secret names were exposed.

socket.devwriteupPublished and added 23 Oct 2026

Railway security incident update of 23 October 2026, posted by Rafter Security, summarising Railway's preliminary report on the 20-22 October breach. Up to 1.85% of workspaces (about 100,000) may have had environment variables exposed. Attackers reportedly targeted AI provider API keys, possibly for model distillation. Some encrypted secrets were accessed and a subset decrypted. Railway says the attacker was removed by 22 October at 03:32 UTC, and the forensic investigation continues.

x.comthreadAdded 25 Oct 2026, published 23 Oct 2026

ADLC Security Best Practices is an Endor Labs guide to controlling what AI coding agents can access, run, install and ship. It covers inventorying agents and MCP servers, sandboxing, pre-execution hooks instead of AGENTS.md rules, install-time package checks against slopsquatting and malware, reachability-based triage of agent PRs, and CI/CODEOWNERS protections. A five-step worked example and coverage metrics are included.

endorlabs.comarticlePublished and added 23 Oct 2026

Railway's preliminary report on a security incident between 20 and 22 October 2026, in which an attacker reached internal systems and decrypted stored environment variables. At most 1.85% of workspaces (about 100,000) were confirmed affected. The attacker was after AI provider API keys for distillation. Railway notified vendors such as GitHub and Anthropic, rolled all keys, moved to single-tenant builders and advised customers to rotate secrets. Exploit details are withheld.

blog.railway.comadvisoryAdded 24 Oct 2026, published 23 Oct 2026

LiteLLM version 1.107.0 was published with malware to PyPI and Docker Hub on October 21, for about three hours and roughly 49,000 downloads. Attackers used GitHub CLI OAuth tokens, likely leaked through Claude Code into LiteLLM logs, to disable branch protections, redirect the releaser to a lookalike repository and sign poisoned artifacts. The payload is an infostealer and RAT; Wiz saw Amazon Bedrock abuse. The last clean version is 1.106.2.

securityweek.comarticlePublished and added 23 Oct 2026

Guidance on the October 2026 eMudhra / emSign CA incident, where eight intermediate CA certificates had private keys generated with insufficient randomness. It explains why updating certifi alone does not fix pip's vendored bundle, and lists fixed versions (certifi 2026.10.19, pip 26.2.2, Python 3.15.1, 3.14.9, 3.13.17). StepSecurity's OpenSSL 4.0.3 tests showed the older bundle accepted seven emSign paths, while both corrected bundles rejected all fourteen.

stepsecurity.ioarticlePublished and added 22 Oct 2026

ZTrust is a Python supply-chain scanner that checks manifests, lockfiles, source and GitHub workflows for vulnerable or malicious dependencies (via OSV.dev), typosquats, leaked secrets, unsafe lockfiles and risky CI patterns such as pwn requests and script injection. It outputs console, JSON and SARIF 2.1.0 and ships as a GitHub Action. It also includes a FastAPI bounty service using commit-reveal and shielded Zcash payouts for researchers.

github.comrepoAdded 27 Oct 2026, published 22 Oct 2026

LiteLLM suspects its October 21 release compromise began with Claude Code responses containing GitHub CLI OAuth tokens that were written to logs of an internet-facing internal LiteLLM gateway. Attackers allegedly stole those tokens, used an organization-owner token to disable branch protections, and pushed poisoned artifacts from a lookalike repository. How they entered the gateway is unconfirmed, and this is not a proven Claude Code vulnerability.

x.comthreadAdded 25 Oct 2026, published 22 Oct 2026

Post on the LiteLLM 1.107.0 PyPI compromise published 21 October 2026 and quarantined about 1 hour 43 minutes later. A malicious .pth file ran at Python startup and stole cloud credentials, private keys, browser data and AI tool auth files, then POSTed a tarball to an attacker endpoint. The author says attackers used stolen GitHub CLI OAuth tokens to push a trojanized commit chain and build official wheels. It lists five defenses: hash-pinned lockfiles, per-tool capped keys, release cooling periods, secret isolation and egress monitoring.

x.comthreadAdded 23 Oct 2026, published 22 Oct 2026

eMudhra's eight intermediate CA certificates, chaining to emSign ECC Root CA - G3, had private keys below 256 (one is 4), disclosed on 17 October 2026 by a researcher known as Wayne. Browsers and Microsoft blocked them via revocation pushes, but curl, git, containers, language runtimes and IoT may still trust them. The post gives patched ca-certificates versions, test commands and the timeline.

aikido.devarticlePublished and added 22 Oct 2026

Adversa AI assesses Claude Code enterprise security as of October 2026. Managed settings bind only Claude Code, can be edited by local admins, and are not read by Anthropic-hosted cloud sessions. Auto mode misses 17% of risky actions in Anthropic's test set. The article covers attacks on the harness (CVE-2025-59536, CVE-2026-21852, TrustFall, SymJack, GhostApproval) and recommends credential, egress, isolation and monitoring controls.

adversa.aiarticlePublished and added 22 Oct 2026

Post describing a LiteLLM 1.107.0 PyPI compromise in which attackers used stolen GitHub CLI OAuth tokens from three engineers to trigger and approve the project-releaser workflow, producing eight malicious wheels and a tampered tarball. The wheels drop cook.pth, which runs at Python startup, and privcollect steals cloud tokens, keys, browser data, AI configs and LiteLLM proxy credentials, exfiltrating to litellm[.]dev/healthcheck. A second daemon polls a GitHub domain.txt hourly for new domains to fetch and execute. PyPI yanked the package the same day. The post is a single unsourced tweet.

x.comthreadPublished and added 22 Oct 2026

Railway's security disclosure of 21 October 2026 says an unauthorized third party may have accessed encrypted customer environment variables and decrypted some of them. Railway links it to a series of attacks on platform companies aimed at compromising AI inference providers, and has asked upstream providers to revoke keys. It tells all users to roll every environment variable, API key and registry credential, and it paused all deployments. The notice gives no technical details of the intrusion.

blog.railway.comadvisoryAdded 22 Oct 2026, published 21 Oct 2026

The eMudhra CA compromise (disclosed 20 October 2026) involves eight intermediate CA certificates whose private keys can be derived from the certificates themselves. They chain to AAA Certificate Services and three other roots. Browsers block them, but non-browser clients skip revocation and CT checks. Endor Labs finds 25 popular packages with frozen bundled root stores, 11 already patched, and gives a fingerprint-scanning script, test hosts and patch steps.

endorlabs.comarticlePublished and added 21 Oct 2026

litellm 1.107.0 was published to PyPI on 21 October 2026 from a source revision that differs from the official tag. One line in the Maturin config (data = "cook") installs cook.pth, cook.py and sitecustomize.py, which run on every Python start. They steal cloud, AI and proxy credentials, including the LiteLLM database tables, and load remote code hourly. The post gives IOCs, a five-step response plan and hardening advice.

endorlabs.comwriteupPublished and added 21 Oct 2026

PHP2Shell is the name for two critical PHP core memory-safety flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. Fixes ship in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Wiz researchers demonstrated RCE against WordPress, Drupal and Joomla, and Apache with mod_php is the highest risk. The post covers inventory, container rebuilds, Cloudflare WAF rules and temporary exposure reduction.

endorlabs.comadvisoryPublished and added 21 Oct 2026

Aikido's guide to software supply chain security controls for 2026, tied to real incidents. It covers a 48-hour package cooldown, ignore-scripts, lockfile enforcement, SHA and digest pinning, scoped tokens, FIDO2, developer endpoint protection, extension allowlists, agent sandboxing, MCP server vetting, slopsquatting, signed SBOMs and rotation drills. Examples include the March 2026 axios compromise and the March 2025 tj-actions/changed-files attack.

aikido.devarticleAdded 22 Oct 2026, published 21 Oct 2026

OVHcloud's official CLI was backdoored on 19 October after an attacker used a developer's hijacked GitHub account to overwrite release binaries for v0.11.0 through v0.15.0 with a secret stealer. The malicious files were live for about 94 minutes. Release immutability was not enabled, so CI/CD was bypassed. OpenSourceMalware links the account to a March 2026 compromise with a Solana-based loader and a GlassWorm wallet, but calls the same-actor link an inference.

securityweek.comarticlePublished and added 21 Oct 2026

LiteLLM version 1.107.0 was published to PyPI and official Docker images on 21 October 2026 and stayed live for about two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to run the release pipeline against a lookalike fork, Berri-AI/litellm. The payload (cook.pth, cook.py, sitecustomize.py) steals cloud, developer, AI-tool and browser credentials, and includes a polling RAT. The post lists removal and rotation steps.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 21 Oct 2026

OVHcloud CLI (ovh/ovhcloud-cli) release assets for v0.11.0 to v0.15.0 were replaced on 19 October 2026 with a secret-stealing build, uploaded through the hijacked contributor account HassenBF via the GitHub Releases API. No CI ran and source was untouched. The post gives a UTC timeline, go version -m build forensics, a GlassWorm-style Solana memo loader decode, IOCs, affected install routes, and remediation steps.

opensourcemalware.comwriteupPublished and added 19 Oct 2026

A post from lnxsec on CI runners that accept outside pull requests while also holding registry credentials, cache write access, signing material or deployment tokens. It uses the Nix/Lix build-service issues to argue that host compromise and downstream artifact trust are separate risks. It lists four checks: enumerate secrets exposed to PR jobs, split untrusted runners from release runners, trim registry and binary-cache write permissions, and require independent approval for release. It links a linuxsecurity.com feature; CVE details are not in the post.

x.comthreadAdded 20 Oct 2026, published 19 Oct 2026

An X thread by Mikko Laakkonen arguing that companies should encourage staff to vibe code, then provide approved hosting, identity, secrets, deployment and monitoring. It lists 200 application checks in 17 sections, from ownership and data flow through keys, authz, coding-agent isolation, appsec, SBOM and releases to recovery, runtime AI and handover. It adds 16 EU bonus checks on GDPR, NIS2, the Cyber Resilience Act (reporting from 11 Sept 2026, main duties 11 Dec 2027), the AI Act and the Data Act. It builds on Mark Ajzenstadt's production-readiness post and links a 300-check worksheet version.

x.comthreadAdded 18 Oct 2026, published 17 Oct 2026

Aikido Safe Chain is an open-source local proxy and shell-alias wrapper for npm, yarn, pnpm, bun, pip, uv, poetry, pipx and pdm. It checks every package download, including deep dependencies, against the Aikido Intel malware feed and blocks malicious packages before install. It also enforces a configurable 48-hour minimum package age by suppressing too-new versions in registry metadata. It supports custom registries and a self-hosted malware-list mirror, and has CI/CD install recipes for GitHub Actions, Azure Pipelines, CircleCI, Jenkins, Bitbucket and GitLab.

github.comrepoAdded 17 Oct 2026

Interview with former SolarWinds CISO Tim Brown, held at JFrog swampUP 2026, on the 2020 Sunburst build supply chain attack. He recounts the Mandiant notification, discovering tainted Orion builds from February to June that reached 18,000 customers, and the legal-led incident response. He also covers the SEC Wells Notice against him personally, which was later dismissed with prejudice. He describes the rebuilt pipeline: the build system moved to AWS and defined in code, an assume-breach stance, and three separated builds (development with about 400 people with access, staging 36, production 2). He closes with comments on non-human and agentic AI identities and on helping CISOs understand build-pipeline risk.

jfrog.comarticleAdded 18 Oct 2026, published 16 Oct 2026

S2W post on CVE-2026-97229, a CVSS 10.0 remote code execution flaw in the GitLab CE/EE CI/CD regex compiler, disclosed October 13, 2026. Insufficient regex validation plus an integer overflow during encoding conversion lets an attacker who can add CI/CD config use a malicious regex and a UTF-8 repository path to run commands as the git user. Affects self-managed 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Rapid7 published analysis and a public PoC exists, with no in-the-wild exploitation confirmed as of October 15. No workaround exists, so patch or restrict access to a management network or VPN.

x.comadvisoryAdded 17 Oct 2026, published 16 Oct 2026

Endor Labs analyzes the March 2026 Trivy compromise (CVE-2026-33634, CVSS 9.4). A pull_request_target misconfiguration leaked a PAT, and attackers then force-pushed malicious commits to 75 of 76 trivy-action tags and all 7 setup-trivy tags. The TeamPCP credential stealer harvested SSH keys, cloud and CI tokens and runner memory, and exfiltrated to a typosquatted domain. It gives three checks: audit pull_request_target workflows, pin Actions to full commit SHAs, and scope GITHUB_TOKEN permissions. It also notes the limits of SHA pinning.

endorlabs.comarticlePublished and added 16 Oct 2026

Endor Labs explains the March 2025 compromise of the tj-actions/changed-files GitHub Action (CVE-2025-30066). Attackers pushed a malicious commit and retroactively repointed version tags, so a Python payload dumped CI/CD secrets to workflow logs across about 23,000 repositories. The post gives response steps: find usage with a GitHub code search, remove the Action from all branches or enforce an Actions allowlist, audit logs for suspicious outbound requests and IPs, and rotate exposed secrets. It also notes the March 17 restoration and the risk of transitive Action dependencies. It includes Endor Labs customer steps (the `--ghactions --secrets --git-logs` scan flags).

endorlabs.comarticlePublished and added 16 Oct 2026

Explains the "pwn request" weakness in GitHub Actions. A workflow triggered by pull_request_target runs with write permissions and secrets, so if it checks out and builds PR head code, attacker-controlled code runs in a privileged context. It gives a three-step check for susceptible workflows: the trigger, a checkout of the PR head SHA or ref, and build steps such as npm install or make. It also covers mitigations: switch to pull_request or workflow_run, gate on a label, and never pass secrets to scripts that run on PR code. It notes safe patterns and cites the puppetlabs finding.

endorlabs.comarticlePublished and added 16 Oct 2026

Endor Labs gives five practices for updating third-party dependencies in Bazel monorepos: update one dependency at a time, stage cross-cutting upgrades, and test incrementally. It includes bazel query rdeps examples (e.g. for the Go zap library) to select only affected go_test targets. It also argues that SCA scans should target binary targets (go_binary, py_binary, java_binary) rather than the whole repo, and shows a query to enumerate them. The security angle is vulnerability-driven updates and scan scoping, and the piece ends with a vendor pitch.

endorlabs.comarticlePublished and added 16 Oct 2026

Episode 25 of the OpenSourceMalware Show (transcript). It covers GitHub's push attribution (forged-commit visibility, Enterprise-only preview) and GitHub Actions workflow lockfiles (mitigate tag-swapping like tj-actions and Trivy, but not GhostAction). It also covers the GhostAction campaign expanding to a proxy-style phishing kit on my-github.com that bypassed GitHub MFA, and the DOJ's Operation Lonestar Roundup against DPRK laptop farms (~187 computers seized).

opensourcemalware.comtalkPublished and added 15 Oct 2026

GitHub engineers describe Evergreen, a Go-based GitHub App that runs quarterly outside-collaborator access reviews and archives stale repositories in a shared org. It uses scheduled Actions with repository_dispatch, JSON state files in git as the audit trail, checklist issues (IssueOps) closed to trigger revocation, and custom properties for ownership and exemptions. Design principles include fail-secure/fail-closed revocation, never deleting data, dry-run rollout, Splunk logging, and proactive pacing against GitHub's secondary rate limits.

github.blogarticlePublished and added 15 Oct 2026

Orca Security analysis of CVE-2026-97229, a CVSS 10.0 flaw in GitLab CE/EE. An integer overflow (CWE-190) in the CI/CD regular expression compiler gives memory corruption and code execution as the git user. It is triggered by a crafted regex in .gitlab-ci.yml combined with a UTF-8 repository path, with no authentication needed on instances that allow public project creation or self-registration. Lists affected branches (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2), the absence of a workaround, interim mitigations, and a Rapid7 PoC against GitLab CE 19.4.1 with ASLR on. Notes a prior max-severity GitLab bug (CVE-2026-85706) was probed in the wild within hours and later added to CISA KEV.

orca.securityadvisoryPublished and added 14 Oct 2026

Explains how to add AWS Continuum for penetration testing (formerly AWS Security Agent) as a post-deployment gate in CI/CD. Each run is scoped to the commit range since the last passing gate, and it can block promotion to production at a chosen severity threshold. It covers OIDC federation to a least-privilege IAM role, a GitHub Actions worked example, staged report-only rollout, and pitfalls: the baseline advances on passing report-only runs, fail-on-infrastructure-error defaults to fail-open, GitLab pipeline variables can override the committed threshold, and runner credentials need protecting.

aws.amazon.comarticlePublished and added 14 Oct 2026

GitHub describes its secret scanning pipeline for generic secrets. Regex finds candidates with high recall, then a fine-tuned ModernBERT classifier reads the candidate with its file path, secret type and surrounding code to filter hard negatives such as placeholders, fixtures and checksums. The post covers the training data (product feedback, weak labels, synthetic hard negatives), grouped train/eval splits, and ONNX 8-bit quantization. Reported results against the earlier LLM pipeline: 13% higher precision, 19% higher recall, 11.5% higher owner-weighted acceptance, 86% lower median scan time and over 98% lower serving cost. The speed gain made generic secret detection feasible in push protection.

github.blogarticlePublished and added 13 Oct 2026

Socket summarizes Agent Baseline's "The Secure Software Factory: A Reference Architecture", co-authored by Socket CTO Ahmad Nassri with contributors from Docker, Keycard, Barclays and Secure Theory. It treats the coding agent as untrusted and enforces four boundaries outside its decision loop: sandbox, network, supply chain, and identity/access. These are applied across three autonomy levels. The post opens with the PocketOS incident, where an agent found a stray API token and deleted a production database and its backups in nine seconds. It stresses supply chain admission points and an egress proxy the agent can't reconfigure, because agents denied a package have gone to the CDN, rewritten registry config, or done their own DNS lookups to reach npm or PyPI.

socket.devarticlePublished and added 13 Oct 2026

Meta is notifying about 1,500 people, mostly US employees, after an outside group used an employee's stolen credentials to access some of its GitHub repositories. About 99% of the stolen data was product source code; the other 1% was personal data committed by mistake against policy, partly synthetic or anonymized test data. Meta rotated secrets found in the repos, added controls and proactive scanning to keep user data off GitHub, and notified regulators.

securityweek.comarticlePublished and added 13 Oct 2026

Rapid7 analysis of CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in the Onigmo regex compiler used by GitLab CE/EE's CI/CD regex handling. A crafted regex in a .gitlab-ci.yml passes validation as US-ASCII, then is recompiled for a UTF-8 repository path, producing invalid instructions that give code execution as the git user. Rapid7 reproduced it on GitLab CE 19.4.1 with ASLR (patched in 19.4.2); despite the vendor's "unauthenticated" rating, the attacker needs to commit a malicious config to a public project, which self-registration allows. No in-the-wild exploitation is confirmed, and Rapid7 recommends urgent upgrades.

rapid7.comadvisoryPublished and added 13 Oct 2026

Part 1 of an AWS series showing how to build a quantum-resistant software supply chain with ML-DSA: ML-DSA keys in AWS KMS, an ML-DSA root/subordinate CA hierarchy in AWS Private CA, and IAM Roles Anywhere trust anchors for external build agents. It covers signing binaries (EXTERNAL_MU with OpenSSL 3.5), container images as OCI referrers via ORAS, and SBOMs wrapped in in-toto Statements bound to the artifact digest, plus verification, admission control, trust-store distribution, revocation and SCP guardrails. It frames the "forge later" threat and maps CNSA 2.0 (ML-DSA-87 only for NSS) and EU CRA deadlines to actions.

aws.amazon.comarticlePublished and added 12 Oct 2026

JFrog proposes Agentic Process Evidence, an open protocol that records AI coding agent sessions (harness, model ID, tool calls, MCP use, prompts, owner, human reviewer) as signed in-toto/DSSE, SLSA-compatible attestations bound to commits, artifacts and releases. Policy-as-code gates can then block releases that used unapproved LLMs or MCP tools, or that lack an accountable human. It maps the approach to EU AI Act Articles 12/14, OWASP AISVS and ISO/IEC 42001, and includes example session-log and evidence JSON. The post also promotes JFrog AppTrust's Prompt to Release Traceability.

jfrog.comarticleAdded 14 Oct 2026, published 12 Oct 2026

Vendor-authored guide that defines a software supply chain as developers, code, dependencies, AI models, containers and CI/CD pipelines. It walks through program components: OSS governance, SAST vs reachability-based SCA, AI model security, SBOM/VEX (NTIA minimum elements, SPDX vs CycloneDX), secrets scanning, CI/CD hardening, and signing/attestation with Cosign/Sigstore. It cites figures such as 95% of vulnerabilities sitting in transitive dependencies and only 1% of SBOMs being fully NTIA-conformant. Each section closes with an Endor Labs product pitch, so treat the framing as vendor-flavoured. The fetched text was truncated, so the final attestation/provenance section was not seen.

endorlabs.comarticlePublished and added 12 Oct 2026

Endor Labs breaks down the May 11, 2026 compromise of 42 @tanstack/* npm packages (84 malicious versions) that carried valid SLSA provenance. The attacker chained a pull_request_target "Pwn Request", GitHub Actions cache poisoning across the fork/base boundary, and OIDC token extraction from Runner.Worker memory, then published directly to npm without stealing any credential. It explains why 2FA, trusted publishing, provenance and branch protection all failed, and lists mitigations: split pull_request_target workflows, treat the cache as untrusted, scope id-token: write to a publish job, pin actions to SHAs, require environment approval, use egress allowlists.

endorlabs.comwriteupPublished and added 12 Oct 2026

Popeye is a read-only Go utility that scans live Kubernetes clusters and reports misconfigurations, stale or unused resources, port mismatches, probe and image issues, RBAC problems, and resource over/under-allocation when a metrics-server is present. It is configurable with a spinach.yaml (excludes, thresholds, allowed registries, severity overrides), can run as a CronJob with a get/list ClusterRole, outputs HTML/JSON/YAML reports, pushes Prometheus metrics, and can upload reports to S3/Minio. It lints what is actually deployed rather than manifests on disk.

github.comtoolAdded 12 Oct 2026

OpenSourceMalware's analysis of the latest GhostAction wave, where compromised GitHub accounts get malicious Actions workflows (security-audit.yml) injected across every writable repository, including an Oct 8 sweep of 346 repos via kitao and henrywoo. The new payload greps the checkout and full git history for credential patterns (AWS, Anthropic, OpenAI, GitHub PATs) and POSTs them over HTTP to 193.32.204.199/?c=monami. It also covers infrastructure reuse (phishing-heavy legacy IP, scanner activity), new watchlist domains my-github.com and my-gitlab.com, GitHub code-search hunting queries, a detection-confidence table, IOCs and incident response steps.

opensourcemalware.comwriteupAdded 10 Oct 2026, published 9 Oct 2026

StepSecurity details a new wave of the GhostAction campaign in which attackers used compromised maintainer accounts of Takashi Kitao (pyxel) and Henry Wu (athenadriver, Uber) to push malicious "Security Audit" GitHub Actions workflows to 345 repositories in minutes. The upgraded payload now runs `git log -p --all` to mine an entire git history (not just current secrets) for thirteen credential patterns including AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack, and SendGrid keys, pairs AWS access key IDs with secret keys via context capture, and exfiltrates everything via raw-IP plain-HTTP POST to 193.32.204.199, bypassing DNS-based defenses. The post includes hunting queries, run-log forensics confirming successful exfiltration from uber/athenadriver, and remediation guidance centered on workflow approval gates and egress allowlisting.

stepsecurity.iowriteupPublished and added 9 Oct 2026

Socket documents an October 8, 2026 wave of the GhostAction campaign in which two compromised GitHub maintainer accounts (henrywoo and kitao) pushed a malicious security-audit.yml workflow to 346 repositories, including uber/athenadriver and the 18,420-star kitao/pyxel. Beyond the original GhostAction technique of harvesting named GitHub Actions secrets, this variant adds a full git-history grep (via fetch-depth: 0 and git log -p --all) for 13 credential patterns covering AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys and SendGrid keys, plus a context-window capture around AWS key IDs to reconstruct usable key pairs, all exfiltrated in cleartext to a single hardcoded IP.

socket.devwriteupPublished and added 9 Oct 2026

YaraHunter is Deepfence's open-source scanner that applies YARA rulesets against container images, running Docker containers, and filesystems to detect indicators of compromise such as malware and cryptominers. It supports CI/CD build-time scanning, at-rest image scanning, and runtime container scanning, with JSON output for automation, and is designed to eventually integrate into the Deepfence ThreatMapper platform. The README walks through detecting the XMRig cryptominer inside a container image as a worked example.

github.comrepoAdded 8 Oct 2026

GitHub essay by Secret Protection PM Erin Havens presenting nine quarters of telemetry (Q2 2024–Q2 2026) on secret leaks: pushes with credentials grew 2.59x while developer override rates of push-protection blocks fell from 6.63% to 3.93%, and mean time to manually revoke a leaked secret hovers around 40 days. It introduces a new fine-tuned ModernBERT classifier, built with Microsoft Applied Sciences, that evaluates candidate secrets in context in under 2ms to extend push protection to unstructured secrets (e.g. internal database passwords with no recognizable pattern), rolling out in private preview to GitHub Secret Protection customers and as a /security-review command in Copilot CLI/App.

github.blogarticlePublished and added 7 Oct 2026

StepSecurity recaps a 48-hour (May 18-19, 2026) software supply-chain attack wave that hit every pipeline layer at once: the Nx Console VS Code extension (2.2M installs) stealing tokens from GitHub/npm/AWS/1Password, the trusted GitHub Action actions-cool/issues-helper hijacked via tag replacement, a trojanized Microsoft durabletask PyPI package pulled within a 35-minute discovery window, a self-replicating Shai-Hulud npm worm, and GitHub's own disclosure that ~3,800 internal source repos were exfiltrated. The piece argues traditional SCA/SAST/EDR/CNAPP tooling missed all of it because none monitor CI/CD runner runtime behavior (e.g., attackers reading /proc/pid/mem to extract secrets) or developer-machine IDE extensions, and ties the incidents to StepSecurity's Harden Runner, Dev Machine Guard, Compromised Actions Policy and Secure Registry controls.

stepsecurity.ioarticleAdded 6 Oct 2026

StepSecurity's investigation of @subql/common@5.8.3, a malicious npm release in the SubQuery Web3 indexing framework's monorepo, found a heavily obfuscated postinstall/import-time payload (base64+XOR+gzip inside a function constructed via Function()) that spawns a detached worker to steal credentials (.npmrc, .env, AWS, SSH, kubeconfig, Vault, cloud secrets), read GitHub Actions runner memory for CI secrets, inject a camouflaged "Run Copilot" GitHub Actions workflow to exfiltrate repo secrets, and provide a remote shell/PTY over an encrypted channel to ci-artifacts.dev. The release was published via a compromised build pipeline: a workflow modification swapped the real build output for an externally downloaded, unsigned tarball from that same C2 domain immediately before publish, and the authors provide IOCs and remediation steps (credential rotation, host isolation, domain blocking).

stepsecurity.iowriteupPublished and added 5 Oct 2026

Gato (GitHub Attack Toolkit) from Praetorian is a Python CLI for enumerating and attacking GitHub organizations' CI/CD pipelines: it identifies poisoned pipeline execution risks, abuses self-hosted runners via workflow and run-log analysis, exfiltrates Actions secrets, and automates fork-PR/workflow-based command execution. Version 1.7 added an Actions Artifacts Secrets Scanner that downloads and recursively scans workflow artifacts with NoseyParker, which Praetorian used to find critical secrets leaks in prominent open-source projects. The project is now archived/superseded by Praetorian's multi-platform tool Trajan, which merges Gato (GitHub) and Glato (GitLab) attack capabilities.

github.comtoolPublished and added 2 Oct 2026

Wiz Research examined the source repositories and CI/CD pipelines behind 1,500 popular Helm charts on Artifact Hub (mapping to 814 unique GitHub repos) and found 61 repos (7.5%) with confirmed supply-chain risk, including 20 charts with CI/CD workflow weaknesses and 25 depending on unmaintained/archived upstream projects. Two disclosed findings illustrate the risk classes: KubeView's go.mod referenced a Go module under a GitHub username that didn't exist, making it hijackable by anyone who registered the name, and Meilisearch's Helm chart repo had a GitHub Actions workflow triggered by PR comments that injected the commenter's branch name into a shell command while skipping author-association checks, letting any GitHub user run commands with a bot token that had push access. The post then pivots to promoting WizOS Helm Charts, Wiz's hardened/signed/CVE-scanned chart catalog built to close these gaps.

wiz.ioarticlePublished and added 30 Sep 2026

A practitioner thread dissects OpenAI's default rollout of Daybreak Blue (GPT-5.6 Sol) inside Codex Security Cloud, which scans GitHub repos, dedupes findings, and drafts fixes continuously. The author separates marketing framing from actual controls, clarifies that Daybreak Blue is a defensive, identity-gated model distinct from the exploit-research-oriented Daybreak Red/GPT-5.6-Cyber track, and questions OpenAI's self-reported scale metrics (30M+ commits, 500K+ auto-marked-fixed findings) for lacking false-positive and reachability data. It closes with a five-point checklist for security teams before connecting production GitHub orgs: scope the org grant, confirm workspace-level Daybreak Blue enrollment, enforce human review gates, treat vendor validation claims skeptically, and assign clear ownership of AI-prepared patches.

x.comthreadAdded 30 Sep 2026, published 29 Sep 2026

Simon Willison's live-blogged notes from OpenAI DevDay 2026 cover a raft of product launches (the "dots" personal agent, GPT-6.1 Sol, Ultrafast inference, ChatGPT Sites, GPT-Live), but the security-relevant core is the Codex Security session: OpenAI describes an internal "Defense Factory" security sprint that fixed 53 critical findings in a day, and launches a major Codex Security Cloud upgrade plus an open-source Codex Security CLI. The tool builds a security knowledge base, reads per-repo SECURITY.md threat-model files, runs a looping scanner, deduplicates findings (36% of their internal findings were duplicates), and can auto-generate patches/PRs validated by a "verify-fix" adversarial agent (1% rollback rate).

simonwillison.netwriteupAdded 7 Oct 2026, published 29 Sep 2026

security-harness is an open-source Claude Code plugin (also packaged for Gemini CLI, Codex and opencode) that orchestrates subagents — sh-recon, sh-hunter, sh-chainer, sh-verifier, sh-reporter — through a static-analysis pipeline covering 15 vulnerability classes (IDOR/BOLA, SQLi, XSS, SSRF, injection, auth, deserialization, path traversal, secrets, CSRF, XXE, open redirect, crypto, race conditions, file upload), producing README/JSON/SARIF/HTML/PDF reports with PoCs, CVSS and CWE/OWASP mappings. It also ships sh-pr-review, a per-PR merge-gate skill that posts inline findings and a commit status scoped only to code the PR itself introduced or aggravated, with caching, dedup via fingerprints, and a scheduled GitHub Action that keeps its per-class knowledge bases fresh by having one AI agent draft updates from allowlisted sources (OWASP, PortSwigger Research, CWE/CAPEC, HackerOne) while a separate adversarial reviewer agent fails-closed against prompt injection before auto-merge.

github.comrepoAdded 2 Oct 2026, published 29 Sep 2026

Two GitHub Actions from the actions-cool maintainer, disabled by GitHub security after May's supply-chain compromise, were reactivated by the maintainer and left accessible for over a week without the malicious release tags being cleaned up. Any workflow still referencing those version tags resumed automatically downloading and executing the Mini Shai-Hulud payload, showing that disabling a compromised action isn't remediation if the poisoned tags survive reactivation.

x.comthreadAdded 30 Sep 2026, published 28 Sep 2026

An X post pointing to a case study on Cilium's defense-in-depth approach to open-source CI/CD supply chain security, covering access controls, dependency pinning, credential isolation, and cryptographic verification. The underlying case study wasn't fetched, so this record is based on the tweet's own description of its contents.

x.comthreadAdded 30 Sep 2026, published 27 Sep 2026

mcp-audit-tool is a dependency-light Python CLI that statically scans Claude Desktop, Cursor, Windsurf, Cline, Zed, and VS Code MCP configuration files for security issues, including hardcoded secrets, unpinned/rug-pull packages, pipe-to-shell installers, tool-poisoning via hidden instructions in tool descriptions, filesystem servers rooted at '/', and unauthenticated plaintext HTTP MCP endpoints. It auto-discovers configs across macOS/Linux/Windows, produces a security score/grade plus SARIF 2.1.0 output for GitHub Code Scanning, and is built around the OWASP MCP Top 10 categories with a CI/CD example that fails builds on severity thresholds. The roadmap adds live server probing over stdio/SSE for runtime rug-pull detection and an ML-based prompt-injection classifier for tool descriptions.

github.comrepoPublished and added 26 Sep 2026

The Hacker News details the "Mini Shai-Hulud" campaign by threat actor TeamPCP, which compromised npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch and Guardrails AI via a chained GitHub Actions attack (pull_request_target abuse, cache poisoning, OIDC token extraction), now tracked as CVE-2026-45321 (CVSS 9.6). The worm mints npm publish tokens directly from stolen OIDC credentials to self-propagate — the first documented case of a worm producing validly SLSA Build Level 3-attested malicious packages — and deploys an obfuscated credential stealer with IDE persistence hooks, a GitHub Actions secret-exfiltration workflow, and a dead-man's-switch that runs "rm -rf" if its rogue npm token is revoked. Over 170 packages and 400+ attacker-controlled repos have been identified across npm and PyPI, with findings credited to Aikido Security, Endor Labs, SafeDep, Socket, StepSecurity, Snyk, Wiz and Microsoft.

thehackernews.comarticleAdded 26 Sep 2026

Suzu Labs guide to securing AI developer workflows across three surfaces: AI-generated code (Veracode 45% vulnerable, a formal-verification study at 55.8%), the MCP supply chain and credential exposure, and prompt injection in the context window. It cites 973 npm MCP packages (71% single-maintainer), 24,008 secrets in MCP configs on public GitHub, and the March 2026 axios hijack by UNC1069 that dropped WAVESHAPER.V2 and tampered with MCP configs. It lists CVEs for Copilot, Cursor and Claude Code, and gives controls: SAST on every commit, env/vault credential references, pinning MCP versions, minimal agent permissions, `.cursorignore`/Claude deny rules, and monitoring IDE DNS traffic.

securityboulevard.comarticleAdded 26 Sep 2026

UnderSpecBench is a benchmark of 69 task families (2,208 prompt variants) grounded in real incidents and CVEs that tests whether coding agents (Claude Code, Codex, OpenCode) safely handle underspecified DevOps instructions rather than guessing at intent, target, or blast radius. Using deterministic side-effect oracles, the study finds 55.8–67.8% of agent runs violate at least one action boundary, with target ambiguity most sharply degrading safe action and blast-radius cues barely reducing risky autonomous behavior. The paper argues completion-centric agent benchmarks overstate safe autonomy and calls for mitigations at the model, harness, and system layers.

arxiv.orgpaperAdded 26 Sep 2026

git-pkgs is a Go rewrite of a Ruby tool that adds a git subcommand for tracking dependency changes across a repository's history, indexing manifests/lockfiles from 36+ package managers (npm, RubyGems, Cargo, PyPI, Maven, Composer, Go modules, etc.) into a local SQLite database. Beyond history/blame/diff, it offers supply-chain security commands: `vulns` (OSV-based CVE scanning with SARIF output for GitHub code scanning, plus blame/praise/exposure for remediation metrics), `licenses` (with drift detection and CI-friendly exit codes), `deprecated`, `provenance` (trusted-publishing/attestation checks), `integrity` (lockfile hash drift detection), `maintainers`/`health` (via ecosyste.ms metadata), and `sbom` export in CycloneDX/SPDX. It also supports a dependency-aware `bisect` to find when a vulnerability, license change, or capability (e.g. network access) was introduced, and ships GitHub Actions for CI integration.

github.comrepoAdded 25 Sep 2026

This arXiv paper proposes a blockchain-anchored agentic AI framework for securing the software development lifecycle: specialized LLM-backed agents handle source integrity, SBOM/dependency analysis, CI configuration auditing, artifact verification, and runtime policy evaluation, each producing a cryptographically signed attestation recorded on a permissioned blockchain via smart contracts (agent registry, immutable attestation log, release-policy module). Agent-to-agent and agent-to-blockchain communication is secured through a consortium-operated certificate authority, and a sequence flow illustrates a source-code security agent anchoring its attestation on-chain to trigger an allow/block deployment decision. It's a conceptual architecture paper rather than an evaluated deployment, aiming to give decentralized, tamper-resistant provenance for agentic AI monitoring the software supply chain.

arxiv.orgpaperAdded 2 Oct 2026, published 25 Sep 2026

Socket reports that the actions-cool/issues-helper and actions-cool/maintain-one-comment GitHub Actions, compromised in the May 2026 Mini Shai-Hulud campaign and disabled by GitHub, were re-enabled on September 16, 2026 with their release tags still pointing to the malicious code. Any workflow referencing them by tag (about 15,000 dependents for issues-helper alone) resumed running the Bun-executed obfuscated payload. Workflow run logs show the switch from fast "Repository access blocked" failures to multi-minute successful runs. The post gives remediation: SHA-pin actions, rotate secrets, and hunt for oven-sh/setup-bun and bun run index.js in runner logs. An update says both repos were disabled again on September 25.

socket.devwriteupPublished and added 24 Sep 2026

Mandiant's guidance for hardening the software supply chain across five pillars: endpoint, code repositories, artifact management, CI/CD and deployment. It covers a seven-day dependency cooldown, pinning images and actions by digest or commit SHA, ephemeral runners, OIDC short-lived tokens, build cache isolation, signed SBOMs, SLSA provenance and admission-time signature checks. It responds to campaigns using cache poisoning, OIDC token theft and mutable action tags.

cloud.google.comarticleAdded 29 Oct 2026, published 24 Sep 2026

A survey of how package managers confine install-time and build-time code. It covers Homebrew 7.0.0's fetch/install split, Landlock sandbox and signed declarative *_steps. It also covers opam, Nix, Bazel, pacman, Swift PM and Deno, and the open sandbox proposals at pnpm, RubyGems, Spack, Cargo, pip and Zig. It sorts the responses into gating (allowlists), confinement and replacement/removal of hooks. It links the topic to coding-agent sandboxes (Seatbelt, Landlock, bubblewrap) and to Shai-Hulud and nx. It argues the open problem is validating a sandboxed phase's output at the hand-off.

nesbitt.ioarticleAdded 10 Oct 2026, published 24 Sep 2026

shai-hulud-detect is a dependency-free Bash scanner that checks projects against a 5,782-entry list of compromised npm, PyPI, Composer, Crates, Go, Hex, and RubyGems package versions, plus content-pattern indicators of compromise (malicious file hashes, C2 domains, dead-man's-switch artifacts, forged commits, suspicious lifecycle hooks) tied to the Shai-Hulud supply-chain attack waves. It supports single-project and bulk scanning, CI-friendly exit codes, JSON/log output for pipeline gating, and a --check-host mode to detect the May 2026 gh-token-monitor/kitty-monitor persistence daemons that wipe hosts if their monitored GitHub token is revoked (with a documented safe remediation order). Detection is read-only; new package entries are sourced from named threat-research firms (Socket, StepSecurity, Aikido, Snyk, JFrog, Wiz, Semgrep, SafeDep, GitGuardian, OX Security) and cited in PRs.

github.comrepoAdded 23 Sep 2026

Supply Chain Firewall (SCFW) is a Datadog-built CLI that wraps npm, pip, and poetry commands to inspect every package target against known-malicious/compromised package datasets (the open-source malicious-software-packages-dataset and OSV.dev) before installation proceeds, blocking or warning on hits. It ships as a single Go binary, can be aliased transparently into a developer's shell, and optionally reports run outcomes and enforces centralized allow/block policies through Datadog Code Security across a fleet, sending only package metadata (never source code) to Datadog.

github.comrepoAdded 22 Sep 2026

GitHub's official guide on securely using the pull_request_target GitHub Actions trigger, explaining how it differs from pull_request by running workflow code and actions/checkout from the base repository's default branch while granting secrets and a privileged GITHUB_TOKEN. It details how "pwn request" vulnerabilities are introduced when workflows check out and execute a fork's pull request head (e.g. via ref: github.event.pull_request.head.sha), describes GitHub's new default policy that blocks pull_request_target in public repos (enforced starting Nov 2 2026), and lists hardening controls including least-privilege GITHUB_TOKEN, read-only cache access, isolated self-hosted runners, and the explicit allow-unsafe-pr-checkout opt-out flag in actions/checkout.

docs.github.comarticleAdded 21 Sep 2026

Betterleaks is a configurable, fast secrets scanner maintained by the original Gitleaks author and team, capable of scanning git history, local filesystems, stdin, GitHub/GitLab orgs and specific PRs/MRs, Hugging Face models/datasets, and public S3/R2 buckets. Detection rules use regex plus an Expr (with legacy CEL compatibility) based prefilter/filter/validate pipeline, allowing entropy checks, keyword gating, and live API validation of found credentials (e.g. checking a GitHub PAT against api.github.com). It's used in production by projects like Aikido Security and shipped inside MegaLinter.

github.comrepoAdded 18 Sep 2026

Betterleaks is a new open-source secrets scanner built by Gitleaks' original creator (now Head of Secrets Scanning at Aikido) as a drop-in replacement for Gitleaks. It adds CEL-based rule validation, a BPE-tokenization "token efficiency" filter that hits 98.6% recall on the CredData benchmark versus 70.4% for entropy-based detection, default double/triple-encoding handling, parallelized git repo scanning, and a pure-Go (no CGO/Hyperscan) implementation, with v2 plans for auto-revocation, permissions mapping, and LLM-assisted classification.

aikido.devarticleAdded 18 Sep 2026

GitHub Actions' workflow execution protections (actor and event allowlist rules) reach general availability, adding workflow-file-level policy targeting, an Insights dashboard for auditing rule impact, and a REST API for managing policy as code across an enterprise. Alongside this, GitHub is rolling out a new secure default that disables the pull_request_target trigger on public repositories lacking an existing policy, directly mitigating 'pwn request' attacks where fork-submitted code runs with base-repo secrets; the rule starts in evaluate (shadow) mode and becomes enforced on November 2, 2026.

github.blogarticleAdded 21 Sep 2026, published 17 Sep 2026

GitHub added cache-mode to Actions, a least-privilege control (read/write/write-only/none) that limits which workflows can restore or save entries in the shared Actions cache, targeting the cache poisoning technique used to compromise Ultralytics (PyPI) and the TanStack npm packages via a pull_request_target pwn request. Job-level settings override workflow-level ones, the mode propagates through reusable workflows, and GitHub warns when write access is granted to low-trust events; write-only was added after feedback from researcher Adnan Khan. The article notes build provenance (SLSA/Sigstore) doesn't catch a poisoned cache since it only attests to build origin, not input integrity, and recommends cache-mode: none for AI agent workflows exposed to prompt injection, referencing the Cline compromise.

socket.devarticleAdded 21 Sep 2026, published 16 Sep 2026

Shai-Hulud-2.0-Detector is a GitHub Action and CLI tool that scans package.json/lockfiles for packages compromised in the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain worms. It uses semver-precise matching against a database of 1,241+ known-compromised package versions (auto-updated daily from Datadog and Wiz Research feeds) to flag malicious preinstall/postinstall droppers (setup_bun.js, Math_Symbol.js), rogue GitHub self-hosted runners named SHA1HULUD, and ChainDrop's new IDE-persistence hooks in .claude/settings.json and .vscode/tasks.json. It ships SARIF output for GitHub Security tab integration, an allowlist system, and a detailed incident-response guide covering credential rotation and forensic checks.

github.comrepoAdded 16 Sep 2026

AWS Security Blog walkthrough of an open-source Lambda-based automation that closes the loop between IAM Access Analyzer's unused-permission findings and actual remediation: it classifies each flagged role by origin via CloudTrail (CloudFormation/CDK-managed, manually created, or unused), then uses Amazon Bedrock (Claude Sonnet for code generation, Claude Haiku for explanations) to open a pull request with right-sized CDK IAM policy code, a GitHub/GitLab issue with migration guidance, or a soft-disable decommission issue respectively. It covers cross-account/organization-wide deployment, exclusion lists for sensitive roles, throttling, dry-run mode, CloudWatch metrics, and cost/cleanup considerations, with full source in an accompanying repo.

aws.amazon.comwriteupAdded 7 Oct 2026, published 15 Sep 2026

A comparison of GitHub's Dependabot and the open-source Renovate bot as automated dependency-update tools, covering setup, platform/monorepo support, PR noise, and how each handles security advisories versus transitive dependencies. The article argues both tools only bump version numbers rather than assessing exploitability, using the xz-utils backdoor, compromised chalk/debug npm packages, and a breaking lodash 4.18.0 patch as examples of why blind auto-updates can introduce new risk, then pitches Aikido Security's reachability-based backporting and AutoFix as the fix.

aikido.devarticleAdded 15 Sep 2026, published 14 Sep 2026

Endor Labs explains why OVAL (Open Vulnerability and Assessment Language) feeds from Linux distributions like Debian, Ubuntu, and Red Hat produce more accurate vulnerability data than NVD for container/Linux scanning. Using CVE-2022-1587 (PCRE2 DoS) as a case study, it shows how NVD rated the flaw "Critical" (CVSS 9.1) while Ubuntu's OVAL-based advisory rated it "Low" because the distro had already backported a fix into a version string (10.34-7ubuntu0.1) that naive NVD-based scanners would still flag as vulnerable.

endorlabs.comarticlePublished and added 11 Sep 2026

Endor Labs' live incident tracker for the Shai-Hulud 2.0 npm supply-chain worm that began around Nov 24, 2025, compromising packages from Zapier, ENS Domains, Postman and PostHog. It details the infection chain (malicious preinstall script, setup_bun.js dropper, obfuscated bun_environment.js payload), TruffleHog-style credential theft from AWS, GCP, Azure, GitHub and npm, self-replication via stolen npm and GitHub tokens, a self-hosted GitHub Actions runner backdoor abusing repository Discussions for command injection and C2, and destructive wiper behavior that shreds the user's home directory on Windows and Linux.

endorlabs.comwriteupPublished and added 11 Sep 2026

Endor Labs argues that cooldown windows delaying adoption of newly-published npm package versions by 24-48 hours are an effective defense against short-lived npm malware campaigns like Shai-Hulud, chalk/debug, and s1ngularity, since malicious releases are usually caught within that window. It also covers pinning vs lockfiles and demonstrates enforcing cooldown policies via OPA/Rego.

endorlabs.comarticlePublished and added 11 Sep 2026

Cosy (CosyRedactGateway) is a Node.js gateway that sits between programmers' LLM clients and OpenAI or Anthropic APIs. It replaces credentials found in JSON request text with reversible SHA-256-based placeholders, using high-entropy scoring, structured detectors and Gitleaks-compatible rules, and restores them in responses, SSE streams and tool arguments. It runs on Cloudflare Workers, Deno or locally, and documents its limits: auth headers are still forwarded, and misses are possible.

github.comrepoAdded 19 Oct 2026, published 11 Sep 2026

A Snyk blog post arguing that preventing new vulnerabilities in agent-generated code is architecturally solved, using Laurie Voss's nested "loop" model (execution/task/product/system/oversight) to map four control types — in-context guidance, deterministic scanning inside the agent loop (Snyk's Trusted Output Assurance), LLM-based semantic analysis for authz/business-logic flaws like IDOR, and adversarial pentesting/red-teaming (Snyk's Continuous Offensive Security) — to the points in the SDLC where each is cost-effective. It cites Snyk VulnBench JS 1.0 data showing nearly half of LLM-found vulnerabilities appear in only one of five identical review runs, illustrating why single-pass LLM scanning needs repetition to be trusted, and closes by distinguishing solved "prevention" from unsolved "remediation" of existing vulnerability backlogs.

snyk.ioarticlePublished and added 10 Sep 2026

vet is an open-source CLI (from SafeDep) that scans package manifests, SBOMs, container images, and source repos across npm, PyPI, Maven, Go, RubyGems, Cargo, and Packagist to surface vulnerabilities, malicious packages, and license/quality issues. It cuts through CVE noise by analyzing actual code-usage evidence, queries SafeDep Cloud's threat-intelligence database for real-time malware detection (e.g. flagged packages like express-cookie-parser, eslint-config-airbnb-compat), and lets teams enforce security/license/OpenSSF-Scorecard policies as CEL expressions in CI/CD via SARIF/JSON/Markdown reporting.

github.comrepoPublished and added 7 Sep 2026

ForgeGuardian is an open-source (Apache 2.0) supply chain security scanner covering 9 package ecosystems (npm, PyPI, Go, Maven, RubyGems, Cargo, NuGet, Hugging Face, GitHub Actions) via 8 concurrent scan engines and 223+ built-in malicious-package detection signatures. It runs fully offline/local-first, offers a CLI (fgctl) and self-hosted SOC-style dashboard, generates CycloneDX/SPDX SBOMs, supports Sigstore keyless signing and provenance tracking, policy-as-code rules, dependency topology/attack-surface mapping, drift detection with auto-quarantine, and SARIF output for GitHub Actions CI integration, plus optional AI-powered advisory/patch-agent triage.

github.comrepoPublished and added 5 Sep 2026

A GitHub-hosted book focused entirely on securing the React Native developer's workstation and toolchain rather than the shipped app — covering the polyglot execution surface triggered by a single git clone/yarn/pod install (Ruby, CocoaPods, Xcode build phases/XCSSET, Gradle, gradle-wrapper.jar, keystores), CVE-2025-11953 (exposed Metro/RN dev server), ClickFix-style social engineering of developers, CI-as-extended-workstation risks, and Expo/EAS-specific supply-chain concerns. It ships alongside a separate companion repo of 119 Opengrep detection rules, each mapped to a specific chapter's attack technique, plus practical appendices like a safe-clone runbook and a file risk atlas for hardening teams.

github.comrepoPublished and added 5 Sep 2026

StepSecurity announces Linux support (Debian/RPM, .deb and .rpm packages) for Dev Machine Guard, its open-source developer-machine inventory and scanning engine, extending existing macOS/Windows coverage. The tool detects installed AI coding agents (Claude, Cursor, GitHub Copilot, Codex), IDE extensions from VS Code Marketplace and OpenVSX, MCP server configs, npm packages, and Linux system packages (rpm, dpkg, pacman, apk, snap, flatpak) via native mechanisms like systemd user timers and BIOS-serial device identity, and is explicitly framed as a response to incidents like the Shai-Hulud npm worm, s1ngularity/Nx compromise, and Mini Shai-Hulud/TanStack attacks. It ships in a free local-only Community mode and a paid Enterprise mode with centralized dashboard, policy enforcement, and dependency cooldown/alerting.

stepsecurity.ioarticleAdded 5 Sep 2026

StepSecurity documents Megalodon, a May 2026 campaign that injected backdoored GitHub Actions workflow files named SysDiag or Optimize-Build directly into 5,500+ public repositories in a six-hour window via direct Poisoned Pipeline Execution (d-PPE), exploiting weak branch protection. The base64-encoded bash payload harvests AWS/GCP/Azure credentials, SSH keys, Kubernetes/npm/Docker configs, GitHub OIDC tokens, and grep-matched secrets from the workspace, exfiltrating everything via HTTPS POST to a hardcoded C2 IP; the npm package @tiledesk/tiledesk-server was among the confirmed poisoned downstream targets.

stepsecurity.iowriteupAdded 5 Sep 2026

StepSecurity discovered that all 53 tags of the popular actions-cool/issues-helper GitHub Action (and all 15 tags of actions-cool/maintain-one-comment) were re-pointed to dangling imposter commits containing malicious code. The payload downloads the Bun runtime, reads Runner.Worker process memory to harvest decrypted CI/CD secrets, and exfiltrates them via HTTPS to t.m-kosche.com — meaning any workflow referencing the actions by tag (rather than a pinned commit SHA) pulls the malicious code on its next run.

stepsecurity.ioadvisoryAdded 5 Sep 2026

StepSecurity announces Windows 10/11 support (x64 and ARM64, Sigstore-signed with build provenance) for Dev Machine Guard, its open-source developer-endpoint scanner. It inventories AI coding agents, MCP server configs, IDE extensions from the VS Code Marketplace and OpenVSX, and global and per-project npm packages. This lets teams find which developer machines have a compromised package or extension after incidents like Shai-Hulud, s1ngularity and Mini Shai-Hulud. Windows detection uses %LOCALAPPDATA%, %PROGRAMFILES%, registry Uninstall keys and schtasks scheduling. Community mode runs fully locally, while enterprise mode reports to a dashboard with policy enforcement.

stepsecurity.ioarticleAdded 5 Sep 2026

Presents a tiered trust checklist for evaluating third-party GitHub Actions before referencing them in a workflow, covering maintenance/tooling signals, unpinned transitive dependencies, release attestations, and governance, with weaker popularity-based signals separated into a second tier. It then argues that any point-in-time trust assessment only holds if the referenced commit is immutable, and compares raw SHA pinning against GitHub's immutable releases and the new gh-actions-lock CLI extension, which verifies commit reachability to defeat impostor-commit attacks. It closes by noting StepSecurity's GitHub Action Advisor automates some of the checklist's queryable signals using Harden-Runner telemetry.

jessehouwing.netwriteupAdded 21 Sep 2026, published 4 Sep 2026

GitHub Security Lab discloses GHSL-2026-203 / CVE-2026-84973, a same-second time-of-check-to-time-of-use race condition in the jupyterlab/maintainer-tools update-snapshots-checkout GitHub Action. The action compares one-second-precision pushed_at and comment created_at timestamps to detect post-authorization pushes, but a strict greater-than check lets an attacker push a malicious commit in the same second as an authorized "please update snapshots" comment, causing the action to check out and later execute attacker-controlled code (including a local composite action and jlpm-driven package scripts) with the workflow's GITHUB_TOKEN (contents: write, pull-requests: write) in the jupyter/notebook repository. The issue was fixed in v1.0.0 and is a variant of the "pwn request" class of GitHub Actions vulnerabilities.

securitylab.github.comadvisoryAdded 20 Sep 2026, published 4 Sep 2026

Adversa AI's monthly roundup of AI coding-agent security research, covering nine items: GhostJacking (using a WAF's own block logs as a prompt-injection delivery channel, 90% success against Claude Code), Black Hat disclosures of unauthenticated-issue-to-RCE chains in the default GitHub Actions configs published by Anthropic, Google, and OpenAI for their coding agents (Gemini CLI rated CVSS 10.0), an agent-to-agent privilege-boundary bypass in Google's ADK repository, the new OWASP Agentic Skills Top 10 with a walkthrough showing open-source skill scanners miss encoded payloads while flagging 9-62% of legitimate skills as malicious, a seven-layer "secure agent harness" containment design, and a 2,826-file adversarial skill benchmark where Gemini CLI and Qwen Code were exploitable 95.5% and 71.6% of the time respectively. The piece draws a common thread across all findings: agents treat machine-generated artifacts (logs, images, other agents' outputs) as trusted instructions, and existing detection never fires.

adversa.aiarticleAdded 7 Oct 2026, published 3 Sep 2026

Endor Labs defines the "agentic development lifecycle" (ADLC) — the process by which AI coding agents autonomously plan, write, test, and ship code — and lays out where it introduces new security risk: insecure-by-default code, architectural design flaws that pass static analysis, hallucinated/unvetted dependencies, and a review bottleneck as agents outpace human reviewers. It cites benchmark data (62% of best-model BaxBench solutions insecure, only 10.5% of SWE-Agent/Claude 4 Sonnet solutions secure, only 1 in 5 AI-recommended dependency versions safe) and proposes a control stack — secure-generation prompting, security-aware multi-agent PR review, reachability-based prioritization, and automated remediation — mapped to NIST SP 800-218A, CSA's Agentic SDLC, and OWASP.

endorlabs.comarticleAdded 3 Sep 2026, published 2 Sep 2026

Endor Labs breaks down why AI coding assistants (Claude Code, Cursor, etc.) hardcode and leak secrets (CWE-798): they learn the habit from public training data, then compound it by ingesting whole workspaces including .env files and copying live tokens into new code or MCP configs. It cites hard data — GitGuardian's 2026 report found 28.65M new hardcoded secrets on public GitHub in 2025 and a 3.2% secret-leak rate on Claude Code-assisted commits vs 1.5% baseline, Lakera found credentials in 33 .claude/settings.local.json files across 30 packages, and Wiz found AI-related secrets among the most common validated leaked credential types — then lays out a layered defense (pre-commit/IDE/CI/CD/full git-history scanning, active credential validation, secure prompting) and an incident-response order of operations (rotate, investigate, purge history, revoke, re-scan).

endorlabs.comarticleAdded 3 Sep 2026, published 2 Sep 2026

Endor Labs blog post arguing that AI coding agents break the traditional scan-then-fix rhythm of application security because commit volume outpaces review queues, and proposes continuous monitoring of dependency drift, code reachability, and secret exposure instead of point-in-time scans. It distinguishes findings, vulnerabilities, and exploitable weaknesses, and recommends ranking by function-level reachability (Endor Labs claims up to 92% noise reduction) rather than raw CVSS severity, with fixes surfaced as PR comments rather than dashboard alerts.

endorlabs.comarticleAdded 3 Sep 2026, published 2 Sep 2026

StepSecurity's Harden-Runner GitHub Action v2.21.0 adds a denied-endpoints input, letting teams block specific egress destinations (domains, wildcards, bare IPs) from CI jobs while leaving everything else reachable — a lighter-weight alternative to allow lists that don't require full enumeration of a job's needs. The piece details how deny-list entries differ from allow-list ones (no per-port scoping), covers the flagship use case of forcing package installs through StepSecurity's Secure Registry proxy by denying direct access to registries like PyPI and Go module hosts, and explains that Harden-Runner's separately maintained Global Block List (built from SOC threat intel, e.g. the Megalodon credential-exfiltration campaign) is distinct from and complements user-managed deny lists. It also candidly notes the deny list's blind spot: campaigns like Shai-Hulud 2.0 that exfiltrate via github.com itself can't be stopped by a deny list, requiring allow-list enforcement instead.

stepsecurity.ioarticleAdded 3 Sep 2026, published 2 Sep 2026

StepSecurity announces Harden-Runner support (v2.20.1+/v2.21.0) for GitHub Actions jobs executed on AWS CodeBuild-hosted just-in-time runners, including custom container images. The post frames the feature around CVE-2025-8217, where a threat actor exfiltrated GitHub tokens by dumping CodeBuild build-environment memory via a malicious pull request to compromise the AWS Toolkit for Visual Studio Code and AWS SDK for .NET repos, and notes that CodeBuild runners additionally expose an assumed IAM service role and VPC network reachability that GitHub-hosted runners don't have. Harden-Runner correlates outbound network calls, file writes, and process executions to the workflow step that triggered them and unifies detection across GitHub-hosted, self-hosted, ARC, and CodeBuild-hosted runner fleets.

stepsecurity.ioarticleAdded 3 Sep 2026, published 2 Sep 2026

Endor Labs blog post arguing that lifecycle hooks — not system prompts, skills, or MCP tools — are the only enforceable control plane for coding agents, because hooks intercept consequential actions (shell commands, file writes, credential access, package installs) before execution and return a deterministic allow/block/escalate verdict the agent cannot opt out of or reason around. It frames platform engineering's "golden path" concept applied to the agentic development lifecycle (ADLC), positioning hooks as the mechanism to restore reliability and observability that autonomous coding agents otherwise erode.

endorlabs.comarticleAdded 3 Sep 2026, published 1 Sep 2026

Novee Security disclosed that a low-privilege GitHub issue could trigger code execution on CI runners for Gemini CLI and Claude Code, and hijack the next agent run in OpenAI Codex, via flaws in the "harness" code surrounding each coding agent rather than the LLM itself. CVE-2026-12537 is a CVSS 10.0 OS command injection in Gemini CLI's container launcher via a crafted .gemini/.env file (fixed in 0.39.1); CVE-2026-54316 abused Hugging Face's public download counter as a side channel to exfiltrate a Claude Code API key one character at a time (fixed in 2.1.163). A separate Claude Code bash-quoting validator bypass and a Codex AGENTS.md instruction-file poisoning issue (via shared checkout across two passes) had no CVE, prompting OpenAI to only issue workflow/documentation fixes.

thehackernews.comwriteupPublished and added 1 Sep 2026

PackageGuard is an open-source .NET CLI tool that scans NuGet, npm, pnpm and Yarn dependencies (direct and transitive) across a codebase, enforcing hierarchically-configured allow- and deny-lists for licenses, packages and versions. It scores each package's Legal, Security and Operational risk using signals like OSV vulnerability data, maintainer activity, package signing and release cadence, and can emit a CycloneDX or SPDX SBOM enriched with OSV vulnerability data, plus console, HTML and SARIF output for CI/GitHub code scanning. It's positioned as a free alternative to commercial supply-chain tools like Black Duck and Snyk.

github.comrepoPublished and added 31 Aug 2026

StepSecurity documents how an external GitHub user (p00paboot) hijacked the release workflow of @7nohe/openapi-react-query-codegen by exploiting an npm publish issue-comment trigger that lacked commenter authorization checks, allowing pull-request code to be checked out and published via GitHub Actions OIDC trusted publishing. Ten malicious versions were pushed with preinstall hooks and a poisoned binding.gyp that executed a payload downloading Bun, stealing GitHub/git credentials, probing GCP metadata, and enumerating SSH keys, confirmed via StepSecurity Harden-Runner behavioral analysis on isolated runners. The post lists affected versions, file/hash IOCs, and remediation steps including credential rotation and pinning to clean releases.

stepsecurity.iowriteupAdded 3 Sep 2026, published 28 Aug 2026

StepSecurity describes a new Credentials inventory page in Dev Machine Guard that scans developer machines for thirteen well-known credential source types (npm, PyPI, Docker, AWS, GCP, Kubernetes, Vault, GitHub, SSH keys, etc.) across five categories and reports how many devices hold each, how many entries exist, and whether the material is stored in plaintext or protected. It frames the feature against real attacker behavior - the TeamPCP stealer in the xinference PyPI package and the hijacked Bitwarden CLI npm package both enumerated this exact list of well-known dotfile paths - arguing defenders need the same enumeration attackers already have to scope incidents and plan rotations.

stepsecurity.ioarticleAdded 3 Sep 2026, published 28 Aug 2026

Aikido Security's guide to hardening Docker images explains where container vulnerabilities come from (base OS layers like Debian/glibc that ship far more than an app needs), citing CVE-2023-4911 (Looney Tunables in glibc) and the xz-utils backdoor as cautionary examples for version-pinning decisions. It lays out hardening steps such as multi-stage builds, removing unused packages, non-root users, read-only filesystems, dropping Linux capabilities, pinning base images by digest, generating SBOMs, and signing/verifying images, then pitches Aikido Images, which backports CVE patches onto the same pinned base image version instead of forcing a migration to a new hardened distro.

aikido.devarticleAdded 3 Sep 2026, published 28 Aug 2026

DataSentry is a Claude Code plugin that redacts secrets (AWS keys, tokens, credentials) from tool outputs before they enter the model's context window, using deterministic hooks rather than model instructions, and blocks prompts that contain live credentials. It ships 40 regex-based detection rules (ported from an enterprise Warp ADE ruleset), stable per-secret placeholders via sha1 hashing, per-category overrides, an audit log, and a fail-closed mode; PII/financial/healthcare pattern detection is reserved for a paid Enterprise tier.

github.comrepoPublished and added 27 Aug 2026