Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Google has recently announced the launch of ClusterFuzzLite ' a dedicated fuzzing tool for CI/CD…Google Release ClusterFuzzLite Fuzzing Tool As Part Of CI/CD W…
Two critical GitLab flaws can turn authenticated continuous integration and delivery (CI/CD) configuration into code execution on self-managed servers.
Time and time again, Linux systems execute attacker-controlled code during normal operation, and nothing in the system reports it as a failure.Security models …
Trivy, a popular open-source vulnerability scanner maintained by Aqua Security, was compromised a second time within the span of a month to deliver malware cap…
GitLab has released security updates for Community Edition (CE) and Enterprise Edition (EE) to address eight security flaws, including a critical bug that coul…
GitLab has released security updates to address 14 security flaws, including one critical vulnerability that could be exploited to run continuous integration a…
Software development can be a laborious task that necessitates timely delivery when facilitating error-free code.…Best Practices to Ensure CI/CD Pipeline’s Sec…
A file on a build machine could end up in a cloud deployment bundle because of a flaw disclosed by Amazon Web Services (AWS) on Oct 8, 2026.
Cybersecurity researchers have disclosed details of a new automated campaign called Megalodon that has pushed 5,718 malicious commits to 5,561 GitHub repositor…
In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious c…
In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious c…
Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors.…
Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that's capable of harvesting sensitive developer-re…
Containers are among the many recent inventions of modern computing. They have emerged as the cornerstone of software development and deployment. They isolate …
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in…
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run ar…
The compromise of Nx Console shows how much infrastructure now sits behind a single developer account. GitHub repositories, CI/CD pipelines, container build sy…
A new Mini Shai-Hulud supply chain attack campaign, codenamed Miasma, has compromised @redhat-cloud-services packages to steal credentials and secrets from dev…
A new campaign orchestrated by a previously undocumented threat actor has targeted cryptocurrency organizations with an aim to facilitate digital asset theft u…
Linux security professionals spend most of their time on concrete problems. Hardening SSH. Configuring SELinux or AppArmor. Building secure CI/CD pipelines. Ma…
CVE-2025-4517 sits inside Python's packaging stack. It turns archive extraction into an arbitrary file-write vector that hits core supply chain security. On pa…
Cybersecurity researchers have uncovered yet another active software supply chain attack campaign targeting the npm registry with over 100 malicious packages t…
You know how we always preach to secure everything: servers, processes, applications? It turns out that a lot of us missed a serious blind spot hiding in plain…
Recent enhancements have been made to GitHub Actions , a feature of GitHub that enables automation and CI/CD processes for developer teams. The updates focus o…
