Latest Posts

We reproduced the *sshole OpenSSH authentication bypass on Alpine Linux. See the exact exposure conditions, lab results, patched versions, and mitigations for musl-based hosts and containers.

An APT verification bypass can let an attacker replace a package and run code as root. Learn how to patch CI/CD runners and container images, and use Harden-Runner to find HTTP package downloads and investigate suspicious activity.

StepSecurity Malicious Files finds files planted by Miasma, Shai-Hulud and other supply chain attacks in GitHub repositories and on developer machines.

Binance’s November 3 findings trace the attack from a malicious interview assignment through developer tools, an internal AI tool, and stolen deployment credentials to wallet signing. We examine the sequence and the controls security teams should review.

On October 29, 2026, trojanized builds (2.1.312 and 2.1.313) of the official Claude Code VS Code extension were published to Cursor's VS Code Extension Marketplace for macOS and Windows.

GitHub’s native egress firewall covers GitHub-hosted Linux runners. See five ways Harden-Runner goes further, from anomaly detection to build tampering

Inventory the Claude Code and Codex plugins on developer machines and in your GitHub repositories: where each came from, what it bundles, whether it is enabled, and which repositories distribute it.

Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual environments, and CI/CD images.