Lapsus$ Breaches Okta and Microsoft — An Identity Nightmare
··976 words·5 mins
The Lapsus$ hacking group has breached both Okta and Microsoft, exposing critical weaknesses in identity provider security and third-party access management.
- Osmond van Hemert — Senior Software Engineer & AI Product Builder/
- Blog Categories: AI, Security, Development & Infrastructure/
- Security Incidents, Vulnerabilities & Defense/
Security Incidents, Vulnerabilities & Defense
This category gathers posts where security is the main story: breaches, vulnerabilities, software supply-chain incidents, and the practical response to each. Use the articles below to examine how attacks work, what is known, and which defensive decisions follow from the evidence.
For incident timelines, visit Breaches & Zero Days. The Cybersecurity tag follows security themes across other categories too, including infrastructure and developer tooling.
The node-ipc Protestware Incident — Open Source as a Weapon
··966 words·5 mins
A popular npm package was deliberately sabotaged by its own maintainer, raising urgent questions about supply chain trust in open source.
HermeticWiper and the New Reality of Cyber Warfare
··830 words·4 mins
As conflict erupts in Ukraine, destructive wiper malware targeting critical infrastructure signals a new chapter in state-sponsored cyber operations.
Alpha-Omega Project — The Linux Foundation Gets Serious About OSS
··791 words·4 mins
The Linux Foundation’s new Alpha-Omega Project, backed by Google and Microsoft, aims to systematically improve the security of critical open source software.
The White House Open Source Summit — When Log4j Gets Political
··972 words·5 mins
The White House convened tech leaders to address open source security after Log4Shell. Here’s what was discussed and what it means for developers.
After Log4Shell — Software Supply Chain Security Can't Wait
·1036 words·5 mins
A week after Log4Shell, the patching chaos continues. But the bigger lesson is about software supply chain security and why we need SBOMs now.
Log4Shell — The Zero-Day That Broke the Internet's Weekend
·870 words·5 mins
A critical remote code execution vulnerability in Apache Log4j has sent the entire industry scrambling. Here’s what you need to know and do right now.
npm Supply Chain Under Siege — The coa and rc Package Compromises
··823 words·4 mins
Popular npm packages coa and rc were hijacked to distribute malware, impacting thousands of projects and raising urgent questions about supply chain security.
ua-parser-js Compromised — Supply Chain Attacks Hit npm Again
··1134 words·6 mins
The popular ua-parser-js npm package was hijacked to deliver cryptominers and credential stealers, affecting millions of weekly downloads.
OWASP Top 10 2021 — The Security Landscape Has Shifted
··965 words·5 mins
The OWASP Top 10 gets its first update since 2017, and the changes reflect how fundamentally our attack surface has evolved.
OMIGOD — When Your Cloud Provider Installs Vulnerable Agents
··1123 words·6 mins
The OMIGOD vulnerabilities in Azure’s silently-installed OMI agent expose a troubling pattern: cloud providers deploying software on your VMs without your
Confluence Under Siege — CVE-2021-26084 and Self-Hosted Risk
··1018 words·5 mins
The critical Confluence Server RCE vulnerability is being actively exploited in the wild, raising urgent questions about the sustainability of self-hosted