Does anyone know what's happening with GitHub CNA? We have been waiting for a CVE for almost 4 days and still are waiting. It usually only takes a few hours.

Really makes me happy to see how powerful zizmor is (github.com/zizmorcore/z...). I remember thinking a looooong time ago that custom Semgrep rules were enough for what it was doing (at the time) Oh boy did zizmor get powerful, hands down one of the best pieces of software out there! ❤️

GitHub - zizmorcore/zizmor: Static analysis for GitHub Actions

Static analysis for GitHub Actions. Contribute to zizmorcore/zizmor development by creating an account on GitHub.

github.com

New vulnerabilities are exploited within 1 day on average. This is a crazy time for cybersecurity, but we also need to think about how we can utilize this at our advantage as defenders! Here's what I think: dev.to/mikik/vulner... Credits to zerodayclock.com for the screenshot #infosec

I'm not seeing much about SCA vendors (e.g. Socket.dev, Snyk) on how well they can protect against supply-chain attacks. I wonder how well these tools actually catch unknown malware (before it's actually found by humans) Anyone has real-world insights or comparisons? #supplychain #cybersecurity

I published a blog post that lists recommendations and outlines concrete steps that open source projects can (should?) take to reduce the risk of supply chain breaches similar to the recent Trivy incident: mikael.barbero.tech/blog/post/20...

Stop trusting mutable references: how Eclipse Foundation projects should harden GitHub Actions after the Trivy compromise

On March 19, 2026, an attacker used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action, and replace all 7 tags in aquas...

mikael.barbero.tech

Exciting news for projects on GitHub looking to use the private vulnerability reporting / security advisories features: “We're working toward enabling fine-grained permissions for security advisories - create, read, edit, and close/accept/publish” github.com/orgs/communi...

Investing in the security advisory experience on GitHub 🔐 · community · Discussion #189802

We hear you: the signal-to-noise problem is real Over the past few months, we've heard from maintainers across the ecosystem - in community discussions, in support channels, and directly - that the...

github.com

I'm baffled that in 2026 we need to argue that when reporting a vulnerability you shouldn't just click submit and forget, and actually try to help the maintainer when they have questions Basically: "hey, here's my AI's essay that I didn't verify nor read, have fun, see ya!" #cybersecurity #oss

The speed at which AI is evolving can be scary for security teams and this can be discouraging especially if you are in a startup. I came to this conclusion: don't worry about it. Don't overthink it and use your two best tools: talk and governance. dev.to/mikik/contro... #cybersecurity #ai

Controlling AI Sprawl in a Startup Environment

You probably felt it: new AI tools popping up every week. Engineers experiment with three or four...

dev.to

Respecting maintainer time should be in security policies. Even better: you don't even have to mention the elephant in the room! sethmlarson.dev/respecting-m... #opensource #oss #security

Respecting maintainer time should be in security policies

Generative AI tools becoming more common means that vulnerability reports these days are loooong. If you're an open source maintainer, you unfortunately know what I'm talking about. Markdown-format...

sethmlarson.dev

Earlier I sarcastically said "I can't wait for the Clawdbot botnet" - I really didn't expect to see that blog post censys.com/blog/opencla...

OpenClaw’s Rapid Rise: 21,000+ AI Instances Exposed

Censys tracked OpenClaw’s explosive growth, finding 21,000+ exposed AI assistant deployments online and highlighting urgent security risks.

censys.com

Oh wow! Seems like PNPM now disables hooks by default, nice! Kudos to them for taking that decision! 👏 #cybersecurty #supplychain

[1/6] Sanity check before I start spending months on this: do you think this is a good or a bad idea? I'm planning on creating a OSS package firewall (pnpm, Poetry, uv, etc.) #cybersecurity #supplychain

We disclosed two new RSC vulnerabilities: - Denial of Service (High): CVE-2025-55184 - Source Code Exposure (Medium): CVE-2025-55183 Patches are available now, please update immediately. react.dev/blog/2025/12...

Denial of Service and Source Code Exposure in React Server Components – React

The library for web and native user interfaces

react.dev

Just read Sysdig's EtherRAT analysis and… wow! North Korea is now running a RAT with a C2 through Ethereum smart contracts. And not just that, but also with a 9-RPC consensus layer for resiliency. Decentralized, resilient, and honestly very clever. www.sysdig.com/blog/etherra... #CyberSecurity

EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks | Sysdig

A novel Ethereum-powered backdoor, EtherRAT, is being deployed through the React2Shell vulnerability (CVE-2025-55182). With multi-layer persistence, blockchain C2, and self-updating payloads, this mal...

sysdig.com

TIL: flatpak's session bus 'org.freedesktop.Flatpak' permission allows to escape the sandbox (by allowing to run commands on the host machine) This shows the importance of not only denying access to the 'host' and 'home' filesystems.

I wrote up a post about how we hugely improved the write performance for Bluesky's timelines/following feed. If you want to learn more about how we did it, check it out. Some nuggets in there about embracing imperfection in some parts of a system to scale better. jazco.dev/2025/02/19/i...

Just discovered GNS3, an open source software to create virtual network labs (using VMs) Looks amazing! Next step is to experiment with security controls and incident response. Also cool: can sniff packets in one click between links (using Wireshark) World's most basic set-up:

Really looking forward for digital attestations to be widespread ❤️ (PEP 740) I'm also hopeful that more and more developers will start switching towards Trusted Publishers. Maybe a warning if it's not done yet: "You are using an API key, consider using Trusted Publishers if possible: <docs URL>"

Seth Larson@sethmlarson.dev · 2y ago

Last week the Python package "Ultralytics" suffered a supply-chain attack on its build and release process. This is a review of the attack from @pypi.org's perspective. There's plenty of advice for how Python projects can increase their #security posture: blog.pypi.org/posts/2024-1...

Weekend read: What @owasp.org CRS learnt during its open source bug bounty program. coreruleset.org/20230509/wha... (Repost from 2023, covers 180+ reports and 500+ findings) #bugbounty #wafbypass #bugbountytips #weekendread

#blogvent day 4 is here! I wrote about writing! So meta! But actually though, writing for devs/a techy audience can be tough, so I tried to put together some useful tips that have helped me. Hope it's helpful! cassidoo.co/post/good-wo...

Writing good words for tech folks

Writing content for developers can be challenging, and there's some tips that might help.

cassidoo.co

Did you know you can use an ancient magic cookie to downgrade parsers and bypass WAFs?! Hope you enjoy this quality bit of RFC-diving from @d4d89704243.bsky.social! portswigger.net/research/byp...

Bypassing WAFs with the phantom $Version cookie

HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known

portswigger.net

#blogvent Day 2 is here! I wrote about note-taking, one of my fave topics, and strategies I use to not just use notes to hoard information! cassidoo.co/post/note-ta...

The what and the what now: note-taking

Sometimes we take notes just to have notes, rather than for a purpose.

cassidoo.co

Thankfully we are not getting many yet on our end yet. Once every few months, still a few too many where we could spend time on something else. Only 2 GitHub accounts were reported and banned for bulk spamming (us and others users & organizations), hopefully it stays at 2.

Seth Larson@sethmlarson.dev · 2y ago

I've noticed a concerning trend of "slop security reports" being sent to open source projects. Here are thoughts about what platforms, reporters, and maintainers can do to fight back: #oss #opensource #security #vulnerability #vuln #cve #slop #ai #llm sethmlarson.dev/slop-securit...