Install
Please confirm you are human
This browser or connection looks automated. Press and continuously hold the control for 3 seconds to enable Google-hosted web results and, when separately allowed, AI-assisted answers.
A successful check enables 100 search requests. Interactive access does not authorize scraping, systematic collection, or reuse of search output.
News
Your CI Cache Can Carry Malicious Code. GitHub Just Added New Controls.
2+ hour, 24+ min ago (20+ words) GitHub Actions now supports cache-mode for least-privilege cache access. Learn how read, write, write-only, and none reduce CI cache-poisoning risk....
CodeQL 2.26.4 Enhances GitHub Actions Security, Adds Go 1.27 Support
1+ week, 2+ day ago (295+ words) Joerg Hiller Sep 03, 2026 15:43 GitHub's CodeQL 2.26.4 boosts security for GitHub Actions, improves Rust alerts, and extends support to Go 1.27. Key update for developers. GitHub Actions: Security checks for GitHub Actions have been fine-tuned. Specifically, the update enhances detection for mutable references…...
Production API Key Rotation Explained: 6 Least-Privilege Checks for Node.js GitHub Actions
10+ hour, 29+ min ago (886+ words) Short answer: use two narrowly scoped API keys, switch traffic with an explicit activation step, and revoke the old key only after logs and live requests prove the cutover. For a property-management service, that sequence rotates a production credential without…...
One HTTP Request, Every File on the Server: GitLab’s CVSS 10 Commits-API Flaw Hits Active Exploitation Within Hours
1+ day, 7+ hour ago (170+ words) A single HTTP POST to the commits API bypasses all security controls and reads arbitrary files from a GitLab server. CISA gave agencies until September 14 to patch. watchTowr saw exploitation attempts starting six hours after disclosure. The vulnerability was reported…...
GitLab CVE-2026-85706: Active Scanning Targeting Pre-Authentication File Read
1+ day, 9+ hour ago (1465+ words) 1. Basic Information Original Title: GitLab urges users to patch max severity path traversal flaw Source: BleepingComputer, GitLab Publication Date: 2026-09-11 Severity: Critical Reason for Severity: It allows unauthenticated network-based reading of credentials and sensitive information on GitLab servers, and attack attempts…...
Two and a half months with an intruder in our repositories
2+ day, 9+ hour ago (592+ words) On 6 September 2026, an antivirus quarantined a 32 KB "font file" in one of our projects. That file... Tagged with security, github, polinrider, th1nkdev....
The Laravel upload check that checks nothing, one word away from the two that work
3+ day, 17+ hour ago (411+ words) Here is a file upload check that provides no security at all. That much is unsurprising once you say it out loud. The reason the mistake keeps happening is the interesting part, and it is not carelessness. Both of these…...
I pointed my own security tool at my own GitHub Action. It found two bugs.
3+ day, 21+ hour ago (864+ words) I write an application-security tool called SecHelix. Last week I added a GitHub Action to it. Before merging, I pointed the tool at its own new Action. It found two real defects. Neither would have failed a test. Both were…...
Your npm install Is More Dangerous Than You Think — A Practical Dependency Safety Checklist
4+ day, 1+ hour ago (859+ words) We type this command almost without thinking: A few seconds later, hundreds — sometimes thousands — of packages appear inside node_modules. Then we start coding. But there is something developers often forget: Installing one npm package does not mean trusting only one package....
DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms
5+ day, 22+ hour ago (611+ words) South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access. The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through…...