One of the most aggressive supply chain attacks in recent memory has struck the developer ecosystem. … TamperedChef Malware Hides Stealth Attacks Inside Signed AppsRead more
CI/CD security
Megalodon Attack Injects Backdoors Into 5,500+ GitHub Repositories
One of the most aggressive supply chain attacks in recent memory has struck the developer ecosystem. … Megalodon Attack Injects Backdoors Into 5,500+ GitHub RepositoriesRead more
npm Resets Tokens After “Mini Shai-Hulud” Supply Chain Attack
A large-scale software supply chain attack has forced npm to take unprecedented action, resetting thousands of … npm Resets Tokens After “Mini Shai-Hulud” Supply Chain AttackRead more
GitLab Emergency: New Flaws Allow Session Hijacking and Pipeline Crashes
On May 13, 2026, GitLab issued a series of emergency security updates that every DevOps team … GitLab Emergency: New Flaws Allow Session Hijacking and Pipeline CrashesRead more
vm2 Vulnerabilities Enable Full System Takeover
A critical breakdown in one of the most trusted Node.js sandbox libraries is putting countless applications … vm2 Vulnerabilities Enable Full System TakeoverRead more
Malicious NuGet Packages Compromise 64K+ Developer Systems
A stealthy supply chain attack is quietly spreading through the .NET ecosystem, targeting developers and build … Malicious NuGet Packages Compromise 64K+ Developer SystemsRead more
pnpm 11 Turns On Minimum Release Age by Default to Reduce npm Supply Chain Risk
The npm ecosystem has become one of the most targeted environments for supply chain attacks, where … pnpm 11 Turns On Minimum Release Age by Default to Reduce npm Supply Chain RiskRead more
Critical Jenkins Alert: High-Severity Flaws Threaten CI/CD Pipelines
In an urgent move to protect the software supply chain, the Jenkins project has released a … Critical Jenkins Alert: High-Severity Flaws Threaten CI/CD PipelinesRead more
Design as a Weapon: macOS ‘textutil’ and KeePassXC Exposed as Automation Attack Primitives
In modern DevOps and CI/CD, there is a dangerous assumption: if a tool is local, mature, … Design as a Weapon: macOS ‘textutil’ and KeePassXC Exposed as Automation Attack PrimitivesRead more
Gemini CLI Vulnerability Enables CI/CD Code Execution
As AI tools become deeply integrated into software development workflows, they are also becoming part of … Gemini CLI Vulnerability Enables CI/CD Code ExecutionRead more