Reported News
Brotli fixes have to reach the decoder that runs
CVE-2026-111497 crosses libraries, runtimes and managed deployments. Verify the decoder in the actual workload.
Topic
Software Supply Chain
Analysis · Retrospective 2025
Shai-Hulud made publishing credentials part of the infection
The first Shai-Hulud wave linked dependency installation to secret theft and further package publication.
Analysis · Retrospective 2025
An issue comment should not choose an agent’s permissions
A GitHub MCP demonstration shows how untrusted issue text can be promoted into unintended tool use.
Analysis · Retrospective 2025
tj-actions: fixing the workflow was only the start of secret recovery
The March 2025 compromise connected mutable action tags, secret-bearing logs and credentials that could outlive the malicious code.
Analysis · Retrospective 2024
The CrowdStrike outage: recovery needs an independent control plane
The July 2024 content-update failure made boot paths, recovery access and correlated dependencies part of the security conversation.
Analysis · Retrospective 2024
Polyfill.io and the power delegated by a script tag
A third-party script can change a trusted page. The polyfill.io case makes that delegation explicit.
Analysis · Retrospective 2024
The xz backdoor: why reviewing the repository was not enough
The 2024 disclosure put release archives, generated build files and distribution-specific build conditions inside the trust boundary.
Analysis · Retrospective 2023
One compromised supplier led into 3CX’s build systems
The 3CX investigation traced a compromised software input into another vendor’s release environment.
Analysis · Retrospective 2021
Log4Shell: the dependency inventory that patching could not replace
A retrospective on embedded Java dependencies, incomplete early fixes and the evidence needed to close a remediation ticket.
Analysis · Retrospective 2020
SolarWinds put management-plane trust under scrutiny
SUNBURST made software provenance, management identities and independent recovery part of the same investigation.
Analysis · Retrospective 2017
NotPetya spread through credentials as well as exploits
The NotPetya record connects a poisoned update, stolen credentials and remote administration across recovery boundaries.