1+ day, 7+ hour ago   (20+ words) GitHub Actions now supports cache-mode for least-privilege cache access. Learn how read, write, write-only, and none reduce CI cache-poisoning risk....

2+ day, 12+ hour ago   (170+ words) A single HTTP POST to the commits API bypasses all security controls and reads arbitrary files from a GitLab server. CISA gave agencies until September 14 to patch. watchTowr saw exploitation attempts starting six hours after disclosure. The vulnerability was reported…...

2+ day, 13+ hour ago   (1465+ words) 1. Basic Information Original Title: GitLab urges users to patch max severity path traversal flaw Source: BleepingComputer, GitLab Publication Date: 2026-09-11 Severity: Critical Reason for Severity: It allows unauthenticated network-based reading of credentials and sensitive information on GitLab servers, and attack attempts…...

3+ day, 14+ hour ago   (592+ words) On 6 September 2026, an antivirus quarantined a 32 KB "font file" in one of our projects. That file... Tagged with security, github, polinrider, th1nkdev....

5+ day, 2+ hour ago   (864+ words) I write an application-security tool called SecHelix. Last week I added a GitHub Action to it. Before merging, I pointed the tool at its own new Action. It found two real defects. Neither would have failed a test. Both were…...

1+ week, 3+ hour ago   (735+ words) The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance. North Korea-aligned threat actors have been using a new Linux toolkit in attacks targeting automotive and media organizations in South…...

1+ week, 2+ day ago   (83+ words) SC Media Coder platform targeted by attackers delivering malicious Terraform modules Ping YOUniverse: The next stage of human authentication Student thwarted real-world supply chain attack by rogue Mythos 5 agent Hackers compromise Rust crate arrayref to inject malware The AI you…...

1+ week, 3+ day ago   (477+ words) Here is a grounded read of what happened, with sources, and an honest account of where Latchkey fits. Alongside the cuts, GitHub introduced a $0.002 per-minute Actions cloud platform charge that applies to all Actions workflows. For GitHub-hosted runners, that charge…...

1+ week, 4+ day ago   (589+ words) The attackers are using a network of spoofed websites mimicking legitimate vendors, from browsers and security tools to utilities such as Baidu Netdisk, draw.io, and Sejda PDF, to trick users into downloading malicious installers, the blog added. Microsoft said…...