Cyber Security, Without the Jargon

Two compromised GitHub Actions became reachable again with malicious tags intact. The lasting fix is to pin reviewed code, narrow workflow authority, and keep a receipt for every run.

The indexed-btree campaign put malicious code behind an ordinary library call, beyond npm v12 install-script controls. Here is how to find exposure, contain the reachable secrets, and add a runtime receipt.

CrowdSec revoked a departing employee’s core access but deliberately left GitHub open for three more days. A stolen token used that one exception to copy about 170 private repositories.

Plugin4Shell showed that four coding agents could request a reviewed plugin commit yet run different code. Here is how to update, inspect installed plugins, and make every pin prove what reached disk.

GitLab fixed a flaw that let an unauthenticated visitor read server files on affected self-managed installations. Patch promptly, then use a concrete secret map to decide what evidence to preserve and which credentials may need replacing.

Researchers linked a May flood of RubyGems packages to agents being tested by OpenAI. The practical lesson is to cap every agent run by external effects, not by prompt or task label.

A fixed Marimo flaw let a crafted notebook start a local command when someone opened it for editing. The practical lesson is simple: notebook configuration belongs inside the code-review boundary.

A poisoned Rust package disappeared quickly, but code compiled during that window could have exposed developer and CI credentials. Here is how to check the right evidence and rebuild trust.

Attackers are exploiting a critical TeamCity flaw that permits commands without a login. Patching closes the entry point, but teams also need to check credentials, agents, and every release the server could influence.