Security
5,347 items in 29 lists
-
WordPress Plugin Confusion: How an update can get you pwned vavkamil.cz
Unclaimed WordPress plugins are vulnerable to takeover via the plugin directory.
-
Episki episki.com
State of GRC Trends Budgets and Benchmarks (2026) - Analyzes the current state of governance, risk, and compliance, highlighting the shift toward continuous assurance and multi-framework management within enterprise organizations. Key findings reveal that while compliance…
-
#redteam tip: want to discretely extract credentials from a CI/CD pipeline? twitter.com
Draft pull requests won't alert repository contributors, but will still trigger pipelines.
-
(The) Postman Carries Lots of Secrets trufflesecurity.com
Postman's public API network leaks thousands of secrets due to confusing UI, forks, and insufficient secret scanning.
-
Ensign ensigninfosecurity.com
Cyber Threat Landscape Report (2025) - Analyzes the cyber threat landscape in the Asia-Pacific region, highlighting trends and developments observed in 2025. Key findings include increased activity from state-sponsored groups, the persistence of ransomware, and attacks…
-
Anyone can Access Deleted and Private Repository Data on GitHub trufflesecurity.com
As long as it's part of a fork network.
-
Trojan Source trojansource.codes
Rather than inserting logical bugs, adversaries can attack the encoding of source code files to inject vulnerabilities.
-
ENISA enisa.europa.eu
Threat Landscape Report (2025) - Outlines the organizational scope and collaborative foundation of the 2025 Threat Landscape report, dedicated to enhancing the Union's infrastructure and digital security. Key contributors include EEAS STRATCOM, Europol EC3, and various…
-
Thousands of npm accounts use email addresses with expired domains therecord.media
Maintainer Email hijacking.
-
European Union Agency for Cybersecurity (ENISA) enisa.europa.eu
A European Union agency that contributes to EU cybersecurity policy, enhances trust in digital services, and supports incident response capabilities across Europe.
-
Hijacking GitHub runners to compromise the organization synacktiv.com
Registering a GitHub runner with the ubuntu-latest tag grants access to jobs originally designated for GitHub-provisioned runners.
-
Elastic elastic.co
State Of Detection Engineering (2025) - Analyzes the practice of detection engineering within Elastic Security, detailing their approach to rule development and enhancement. Key findings highlight the impact of real-world threat analysis, automated rule validation, and the…
-
Sourcegraph sourcegraph.com
A web-based code search and navigation tool for public repositories.
-
Why npm lockfiles can be a security blindspot for injecting malicious modules snyk.io
Malicious code can be injected into npm projects via lockfiles (package-lock.json or yarn.lock) because these large, machine-generated files are rarely reviewed thoroughly.
-
Elastic elastic.co
Global Threat Report (2025) - Analyzes the evolving landscape of cyber threats, highlighting a significant shift towards high-velocity attacks that weaponize trusted enterprise tools. Key insights reveal adversaries are prioritizing immediate execution over stealth, with…
-
Deep dive into Visual Studio Code extension security vulnerabilities snyk.io
VS Code extensions have vulnerabilities (command injection, path traversal, zip slip) that can compromise developer machines.
-
whoAMI: A cloud image name confusion attack securitylabs.datadoghq.com
Dependency Confusion using AWS AMIs.
-
Edgescan edgescan.com
Vulnerability Statistics Report (2026) - Analyzes the state of full stack security by evaluating millions of assets across diverse industries to identify critical vulnerabilities and remediation trends. Key findings reveal that 31.9 percent of discovered web application and API…
-
Keeping your GitHub Actions and workflows secure Part 2: Untrusted input securitylab.github.com
GitHub Actions command injection.
-
Durin durin.ai
Home Access Report (2025) - Surveys homeowner practices regarding smart lock and electronic keypad access code sharing and management. Key findings reveal that 78% of holiday travelers share codes, with 22% of homeowners never changing their access codes.
-
Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests securitylab.github.com
Combining pull_request_target workflow trigger with an explicit checkout of an untrusted PR may lead to repository compromise.
-
CloudQuarry: Digging for secrets in public AMIs securitycafe.ro
Researchers found 500GB of credentials, private repos, and keys in public AWS AMIs, impacting various industries.
-
Duo duo.com
State Of Identity Security Report (2025) - Analyzes the state of identity security and the challenges IT and security leaders face in 2025. Key findings reveal low confidence in identity providers and significant gaps in MFA adoption, despite a growing awareness of AI-driven…
-
Risk Explorer for Software Supply Chains riskexplorer.endorlabs.com
-
Duha duha.co
State of Security Vendors RSAC (2026) - Examines the current landscape of cybersecurity vendors at the RSA Conference, focusing on marketing trends, booth design strategies, and the prevalence of artificial intelligence terminology. Key findings reveal that 37 percent of the…
-
Publicly Exposed AWS Document DB Snapshots ramimac.me
Publicly exposed AWS DocumentDB snapshot of Cinemark Brazil revealed millions of customer records.
-
From Self-Hosted GitHub Runner to Self-Hosted Backdoor praetorian.com
Attackers exploit misconfigured runners and weak PAT security to gain persistence, escalate privileges, and move laterally.
-
DSCI & Seqrite dsci.in
India Cyber Threat Report (2025) - Analyzes the evolving cyber threat landscape in India using telemetry collected from 8.44 million endpoints across the country. Key findings reveal over 369 million security detections during 2024, with Trojans emerging as the most prevalent…
-
-
Drata drata.com
State of GRC (2025) - Focuses on the evolving role of Governance, Risk Management, and Compliance, transitioning from a cost center to a strategic business driver. A key finding highlights the challenges GRC teams face in balancing compliance complexity and business growth…
-
Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows paloaltonetworks.com
GitHub Actions, even when pinned to a commit SHA, can still pull in malicious code via mutable dependencies like Docker images, unlocked packages, or external scripts.
-
All the Small Things: Azure CLI Leakage and Problematic Usage Patterns paloaltonetworks.com
Azure CLI leaks secrets to CI/CD logs due to usage patterns.
-
Dragos dragos.com
OT Cybersecurity Report A Year in Review (2026) - Examines the rising sophistication of operational technology threat groups that actively map control loops to disrupt physical processes. Key findings reveal that ransomware impacted over 3300 industrial organizations in 2025…
-
Abusing Repository Webhooks to Access Internal CI/CD Systems at Scale paloaltonetworks.com
Repository webhooks, used to trigger CI/CD pipelines, can be abused to access internal systems.
-
New Zealand dpmc.govt.nz
Cyber Security Action Plan 2026pdf (2026) - Examines national cyber security strategy and threat mitigation across critical infrastructure, establishing immediate government priorities and regulatory frameworks for the coming years. Key findings outline fifteen targeted…
-
The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree paloaltonetworks.com
A novel GitHub Actions worm exploits the action dependency tree. Attackers compromise an action, then infect dependent actions via branch pushes or tag overwrites, spreading malware recursively.
-
How I hacked into Google's internal corporate assets observationsinsecurity.com
More ways to find dependencies in code for Dependency Confusion.
-
Office of the Director of National Intelligence dni.gov
Annual Threat Assessment (2026) - Assesses the global threat landscape facing the United States, focusing on transnational organized crime, illicit drug trafficking, and emerging technological challenges. Key findings indicate that synthetic opioid-related overdose deaths…
-
Hidden GitHub Commits and How to Reveal Them neodyme.io
A tool that can reveal deleted GitHub commits that potentially contain sensitive information and are not accessible via the public Git history.
-
Guardz digitalisationworld.com
State of MSP Threat Report (2026) - Examines the evolving MSP threat landscape and analyzes identity-driven attacks, artificial intelligence-powered threats, and endpoint vulnerabilities observed across managed SMB environments. Key findings reveal a 190% surge in ransomware…
-
10 real-world stories of how we've compromised CI/CD pipelines nccgroup.com
Examples include exploiting S3 misconfigurations, Jenkins plugin flaws, GitLab runner privilege escalations, Kubernetes pod annotation vulnerabilities, and compromised developer laptops.
-
Digital AI digital.ai
Application Security Threat Report (2025) - Quantifies evolving risks in modern application security. Key findings highlight industry trends, attack data categorized by industry and OS, and regional variations in attack rates.
-
AWS Targeted by a Package Backfill Attack mend.io
Scan commit history for internal packages to execute dependency confusion.
-
DigiCert digicert.com
Ultraddos Biannual Report (2025) - Analyzes the landscape of distributed denial of service attacks during the first half of 2025, documenting a significant shift in threat actor behavior and infrastructure capacity. Key findings reveal an 84.37 percent decrease in total attack…
-
PPE — Poisoned Pipeline Execution medium.com
Poisoned Pipeline Execution (PPE) lets attackers run malicious code in a CI/CD system without direct access.
-
Digi Americas digiamericas.org
Financial Sector Threat Landscape (2025) - Investigates the cybersecurity landscape of the Latin American financial sector, focusing on systemic vulnerabilities, regulatory gaps, and the tactics of prominent threat actors. Findings reveal that the region faces a…
-
Malicious code analysis: Abusing SAST (mis)configurations to hack CI systems medium.com
Misconfigured SAST tools can be exploited to execute malicious code on CI systems, allowing attackers to steal credentials or deploy malicious artifacts.
-
Department of Homeland Security dhs.gov
Threat Assessment (2025) - Analyzes homeland security threats in 2025, focusing on terrorism, transnational crime, and threats to critical infrastructure. Key concerns include the evolving tactics of nation-state actors, the persistent threat of cyberattacks targeting critical…
-
Bypassing required reviews using GitHub Actions medium.com
GitHub Actions can bypass required reviews, allowing malicious code pushes to protected branches.
-
Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies medium.com
Researchers uploaded malicious packages with internal company names, gaining access to Apple, Microsoft, and others due to dependency confusion.
- next page of items loading…
