Analysis · Retrospective 2025
Shai-Hulud made publishing credentials part of the infection
The first Shai-Hulud wave linked dependency installation to secret theft and further package publication.
Analysis
Analysis
Independent interpretation of verified facts: what an event means, who carries the risk, and what the record does not yet show.
Analysis · Retrospective 2025
An issue comment should not choose an agent’s permissions
A GitHub MCP demonstration shows how untrusted issue text can be promoted into unintended tool use.
Analysis · Retrospective 2025
tj-actions: fixing the workflow was only the start of secret recovery
The March 2025 compromise connected mutable action tags, secret-bearing logs and credentials that could outlive the malicious code.
Analysis · Retrospective 2024
The CrowdStrike outage: recovery needs an independent control plane
The July 2024 content-update failure made boot paths, recovery access and correlated dependencies part of the security conversation.
Analysis · Retrospective 2024
Polyfill.io and the power delegated by a script tag
A third-party script can change a trusted page. The polyfill.io case makes that delegation explicit.
Analysis · Retrospective 2024
Old credentials opened Snowflake customer accounts
The 2024 Snowflake customer-account campaign followed stolen identities into database access and data export.
Analysis · Retrospective 2024
Change Healthcare made recovery a dependency problem
The 2024 response shows why transaction state and temporary recovery routes belong in continuity planning.
Analysis · Retrospective 2024
The xz backdoor: why reviewing the repository was not enough
The 2024 disclosure put release archives, generated build files and distribution-specific build conditions inside the trust boundary.
Analysis · Retrospective 2023
WebP decoding reaches well beyond the browser
CVE-2023-4863 required inventory of browsers, embedded renderers and image-processing workers.
Analysis · Retrospective 2023
MOVEit: patching the transfer server did not settle the data exposure question
The 2023 campaign separated two jobs that incident tickets often collapse: closing the vulnerability and investigating earlier access.
Analysis · Retrospective 2023
One compromised supplier led into 3CX’s build systems
The 3CX investigation traced a compromised software input into another vendor’s release environment.
Analysis · Retrospective 2021
Log4Shell: the dependency inventory that patching could not replace
A retrospective on embedded Java dependencies, incomplete early fixes and the evidence needed to close a remediation ticket.
Analysis · Retrospective 2021
ProxyLogon left more to investigate than a patch level
Exchange patch state, earlier exploitation and persistent access need separate evidence in a ProxyLogon response.
Analysis · Retrospective 2020
SolarWinds put management-plane trust under scrutiny
SUNBURST made software provenance, management identities and independent recovery part of the same investigation.
Analysis · Retrospective 2017
NotPetya spread through credentials as well as exploits
The NotPetya record connects a poisoned update, stolen credentials and remote administration across recovery boundaries.
Analysis · Retrospective 2017
WannaCry exposed a gap in patch verification
WannaCry, MS17-010 and the gap between a patch notice, installed software and a service that can recover.
Subscribe: RSS for Analysis