The tj-actions Supply Chain Attack — Your CI/CD Is the Target
··920 words·5 mins
A compromised GitHub Action exposed secrets from thousands of repositories, highlighting how CI/CD pipelines have become prime targets for supply chain attacks.
- Osmond van Hemert — Senior Software Engineer & AI Product Builder/
- Blog Categories: AI, Security, Development & Infrastructure/
- Security Incidents, Vulnerabilities & Defense/
Security Incidents, Vulnerabilities & Defense
This category gathers posts where security is the main story: breaches, vulnerabilities, software supply-chain incidents, and the practical response to each. Use the articles below to examine how attacks work, what is known, and which defensive decisions follow from the evidence.
For incident timelines, visit Breaches & Zero Days. The Cybersecurity tag follows security themes across other categories too, including infrastructure and developer tooling.
Salt Typhoon and the Treasury Breach — State Hacking Hits Home
··950 words·5 mins
The Chinese state-sponsored Salt Typhoon campaign breached the US Treasury Department, exposing how even the most security-conscious organizations remain
Salt Typhoon — The Telecom Hack That Should Worry Every Engineer
·1006 words·5 mins
The Salt Typhoon campaign has compromised major US telecoms at a staggering scale. What developers and architects need to understand about this ongoing threat.
Salt Typhoon and the Telecom Breach — Infrastructure Under Siege
··1086 words·6 mins
The Salt Typhoon campaign has compromised major US telecom providers, exposing the fragility of critical infrastructure and the growing sophistication of
CUPS Overflows — A Critical Linux Printing Vulnerability Emerges
··905 words·5 mins
A chain of vulnerabilities in CUPS, the Linux printing system, enables remote code execution — and highlights how forgotten infrastructure becomes a security
NIST Finalizes Post-Quantum Cryptography Standards
··837 words·4 mins
NIST has published its first three finalized post-quantum cryptography standards. Here’s what developers need to know and do.
regreSSHion — A Wake-Up Call Hiding in Plain Sight
··784 words·4 mins
CVE-2024-6387 reveals a critical remote code execution flaw in OpenSSH, and it’s a regression from a fix made back in 2006.
The Polyfill.io Attack — A Wake-Up Call for CDN Trust
··1056 words·5 mins
The polyfill.io domain was acquired by a Chinese company and began injecting malware into over 100,000 websites, exposing fundamental weaknesses in how we
Microsoft Delays Recall — When Security Concerns Actually Win
··1064 words·5 mins
Microsoft pulls Windows Recall from the upcoming Copilot+ PC launch after security researchers demonstrate alarming vulnerabilities in the feature’s data
RSA Conference 2024 — AI Meets Cybersecurity Head-On
··945 words·5 mins
RSA Conference 2024 kicks off in San Francisco with AI dominating every conversation.
The xz Utils Backdoor — Open Source's Worst Nightmare, Nearly
··934 words·5 mins
A sophisticated supply chain attack via the xz Utils compression library was caught just days before reaching stable Linux distributions.
Operation Cronos — The LockBit Takedown and What It Means
··917 words·5 mins
An international law enforcement coalition takes down the LockBit ransomware group’s infrastructure in a landmark operation.