Shai-Hulud made publishing credentials part of the infection
The first Shai-Hulud wave linked dependency installation to secret theft and further package publication.
Incident archive
Security cases organised by event year. Open a case for the technical account, response lessons and source documents.
2025
An issue comment should not choose an agent’s permissions
A GitHub MCP demonstration shows how untrusted issue text can be promoted into unintended tool use.
tj-actions: fixing the workflow was only the start of secret recovery
The March 2025 compromise connected mutable action tags, secret-bearing logs and credentials that could outlive the malicious code.
2024
The CrowdStrike outage: recovery needs an independent control plane
The July 2024 content-update failure made boot paths, recovery access and correlated dependencies part of the security conversation.
regreSSHion: verify the running server, not just an OpenSSH version string
A pre-authentication race condition showed why SSH keys, package backports and server patch state belong in separate checks.
Polyfill.io and the power delegated by a script tag
A third-party script can change a trusted page. The polyfill.io case makes that delegation explicit.
ClickFix asks the user to cross the execution boundary
A repair prompt can be a malware-delivery step. Investigate the requested action and whether it actually ran.
Old credentials opened Snowflake customer accounts
The 2024 Snowflake customer-account campaign followed stolen identities into database access and data export.
The xz backdoor: why reviewing the repository was not enough
The 2024 disclosure put release archives, generated build files and distribution-specific build conditions inside the trust boundary.
Change Healthcare made recovery a dependency problem
The 2024 response shows why transaction state and temporary recovery routes belong in continuity planning.
ScreenConnect’s server was the high-value target
The February 2024 ScreenConnect flaws put server ownership, administrative reach and tenant boundaries in the response scope.
2023
HTTP/2 Rapid Reset: map the work a cancelled stream leaves behind
CVE-2023-44487 made request churn and protocol termination more useful questions than a connection count alone.
CitrixBleed required a session response
CVE-2023-4966 linked a memory-disclosure flaw to reusable sessions that needed a separate recovery decision.
WebP decoding reaches well beyond the browser
CVE-2023-4863 required inventory of browsers, embedded renderers and image-processing workers.
MOVEit: patching the transfer server did not settle the data exposure question
The 2023 campaign separated two jobs that incident tickets often collapse: closing the vulnerability and investigating earlier access.
One compromised supplier led into 3CX’s build systems
The 3CX investigation traced a compromised software input into another vendor’s release environment.
2022
AiTM phishing: why a completed MFA prompt can still end in session theft
The recovery task follows the stolen session into the mailbox, its persistence settings and the business conversations it exposed.
Spring4Shell depends on how the application is deployed
Assess CVE-2022-22965 using the actual runtime, Spring dependencies, packaging and servlet container.
2021
Log4Shell: the dependency inventory that patching could not replace
A retrospective on embedded Java dependencies, incomplete early fixes and the evidence needed to close a remediation ticket.
ProxyLogon left more to investigate than a patch level
Exchange patch state, earlier exploitation and persistent access need separate evidence in a ProxyLogon response.
2020
SolarWinds put management-plane trust under scrutiny
SUNBURST made software provenance, management identities and independent recovery part of the same investigation.
2017
NotPetya spread through credentials as well as exploits
The NotPetya record connects a poisoned update, stolen credentials and remote administration across recovery boundaries.
WannaCry exposed a gap in patch verification
WannaCry, MS17-010 and the gap between a patch notice, installed software and a service that can recover.