Posts
Decisions, questions, and things worked out along the way.
-
Zeabur's Breach Report and the Credentials Nobody Rotated
PostZeabur and 91APP both published investigations in the past two weeks. In both cases, the attacker used keys that should have been replaced already, or that never belonged where they were stored.
-
PHP2Shell This Week: The Patch Wasn't Out Yet, and the Attacks Had Already Started
PostFrom an advance notice of the patch to leaked details and a warning from Japan's prime minister, PHP2Shell showed how dangerous the gap between announcement and fix can be. Node.js and Go also shipped updates the same day.
-
Wait a Day Before Installing New Releases: What This Week's Supply Chain Attacks Have in Common
PostThe malicious LiteLLM release stayed on PyPI for 1 hour 44 minutes; pnpm and GitHub both default to a one-day cooldown for new versions, and this is why