Reported News
Brotli fixes have to reach the decoder that runs
CVE-2026-111497 crosses libraries, runtimes and managed deployments. Verify the decoder in the actual workload.
Event / disclosure
Publications
The library
Security cases, technical advisories and analysis. Browse the record by event date, subject or product.
24 publications. Browse by event date below, or use the incident archive for a year-by-year view. Publication dates appear on each article.
Analysis
Shai-Hulud made publishing credentials part of the infection
The first Shai-Hulud wave linked dependency installation to secret theft and further package publication.
Event / disclosure
Analysis
An issue comment should not choose an agent’s permissions
A GitHub MCP demonstration shows how untrusted issue text can be promoted into unintended tool use.
Event / disclosure
Analysis
tj-actions: fixing the workflow was only the start of secret recovery
The March 2025 compromise connected mutable action tags, secret-bearing logs and credentials that could outlive the malicious code.
Event / disclosure
Analysis
The CrowdStrike outage: recovery needs an independent control plane
The July 2024 content-update failure made boot paths, recovery access and correlated dependencies part of the security conversation.
Event / disclosure
Technical Advisory
regreSSHion: verify the running server, not just an OpenSSH version string
A pre-authentication race condition showed why SSH keys, package backports and server patch state belong in separate checks.
Event / disclosure
Analysis
Polyfill.io and the power delegated by a script tag
A third-party script can change a trusted page. The polyfill.io case makes that delegation explicit.
Event / disclosure
Technical Advisory
ClickFix asks the user to cross the execution boundary
A repair prompt can be a malware-delivery step. Investigate the requested action and whether it actually ran.
Event / disclosure
Analysis
Old credentials opened Snowflake customer accounts
The 2024 Snowflake customer-account campaign followed stolen identities into database access and data export.
Event / disclosure
Analysis
The xz backdoor: why reviewing the repository was not enough
The 2024 disclosure put release archives, generated build files and distribution-specific build conditions inside the trust boundary.
Event / disclosure
Analysis
Change Healthcare made recovery a dependency problem
The 2024 response shows why transaction state and temporary recovery routes belong in continuity planning.
Event / disclosure
Technical Advisory
ScreenConnect’s server was the high-value target
The February 2024 ScreenConnect flaws put server ownership, administrative reach and tenant boundaries in the response scope.
Event / disclosure