Reported News
Brotli fixes have to reach the decoder that runs
CVE-2026-111497 crosses libraries, runtimes and managed deployments. Verify the decoder in the actual workload.
Topic
Open-Source Security
Analysis · Retrospective 2025
Shai-Hulud made publishing credentials part of the infection
The first Shai-Hulud wave linked dependency installation to secret theft and further package publication.
Analysis · Retrospective 2025
tj-actions: fixing the workflow was only the start of secret recovery
The March 2025 compromise connected mutable action tags, secret-bearing logs and credentials that could outlive the malicious code.
Technical Advisory · Retrospective 2024
regreSSHion: verify the running server, not just an OpenSSH version string
A pre-authentication race condition showed why SSH keys, package backports and server patch state belong in separate checks.
Analysis · Retrospective 2024
The xz backdoor: why reviewing the repository was not enough
The 2024 disclosure put release archives, generated build files and distribution-specific build conditions inside the trust boundary.
Analysis · Retrospective 2023
WebP decoding reaches well beyond the browser
CVE-2023-4863 required inventory of browsers, embedded renderers and image-processing workers.
Technical Advisory · Retrospective 2022
Spring4Shell depends on how the application is deployed
Assess CVE-2022-22965 using the actual runtime, Spring dependencies, packaging and servlet container.
Analysis · Retrospective 2021
Log4Shell: the dependency inventory that patching could not replace
A retrospective on embedded Java dependencies, incomplete early fixes and the evidence needed to close a remediation ticket.