Reported News
Brotli fixes have to reach the decoder that runs
CVE-2026-111497 crosses libraries, runtimes and managed deployments. Verify the decoder in the actual workload.
Event / disclosure
Publications
The library
Security cases, technical advisories and analysis. Browse the record by event date, subject or product.
24 publications. Dates below identify the event or disclosure; publication dates appear on each article.
Analysis
Shai-Hulud made publishing credentials part of the infection
The first Shai-Hulud wave linked dependency installation to secret theft and further package publication.
Event / disclosure
Analysis
An issue comment should not choose an agent’s permissions
A GitHub MCP demonstration shows how untrusted issue text can be promoted into unintended tool use.
Event / disclosure
Analysis
tj-actions: fixing the workflow was only the start of secret recovery
The March 2025 compromise connected mutable action tags, secret-bearing logs and credentials that could outlive the malicious code.
Event / disclosure
Analysis
The CrowdStrike outage: recovery needs an independent control plane
The July 2024 content-update failure made boot paths, recovery access and correlated dependencies part of the security conversation.
Event / disclosure
Technical Advisory
regreSSHion: verify the running server, not just an OpenSSH version string
A pre-authentication race condition showed why SSH keys, package backports and server patch state belong in separate checks.
Event / disclosure
Analysis
Polyfill.io and the power delegated by a script tag
A third-party script can change a trusted page. The polyfill.io case makes that delegation explicit.
Event / disclosure
Technical Advisory
ClickFix asks the user to cross the execution boundary
A repair prompt can be a malware-delivery step. Investigate the requested action and whether it actually ran.
Event / disclosure
Analysis
Old credentials opened Snowflake customer accounts
The 2024 Snowflake customer-account campaign followed stolen identities into database access and data export.
Event / disclosure
Analysis
The xz backdoor: why reviewing the repository was not enough
The 2024 disclosure put release archives, generated build files and distribution-specific build conditions inside the trust boundary.
Event / disclosure
Analysis
Change Healthcare made recovery a dependency problem
The 2024 response shows why transaction state and temporary recovery routes belong in continuity planning.
Event / disclosure
Technical Advisory
ScreenConnect’s server was the high-value target
The February 2024 ScreenConnect flaws put server ownership, administrative reach and tenant boundaries in the response scope.
Event / disclosure