Beat
Supply Chain
Open source, dependencies, vendors and the software we all inherit.
- 8
- stories
- JUN 1
- latest
New Shai Hulud Variant Hits Red Hat npm Packages
Researchers said that they found a Red Hat employee’s GitHub account had been compromised and was used by threat actors to push malicious orphan commits directly to several repositories.
LINDSEY O'DONNELL-WELCH · JUN 1 · 3 min
All Supply Chain
New Dirty Frag Linux Bug Emerges
The vulnerability class is a potent new iteration of kernel bugs that corrupt the page cache of read-only files and is a follow-on to the recently disclosed Copy Fail Linux LPE bug.
Dennis Fisher · 3 min
Attackers Target Checkmarx KICS Ecosystem
Yet another supply chain attack has hit the open source ecosystem, this time impacting the Checkmarx KICS Docker Hub repository.
Lindsey O'Donnell-Welch · 3 min
TeamPCP’s Supply Chain Attack Spree Continues
TeamPCP’s latest victim is the Telnyx Python SDK on PyPl, coming after a wave of supply chain hits on Aqua Trivy, Checkmarx KICS/OpenVSX, and LiteLLM.
Lindsey O'Donnell-Welch · 3 min
High-Risk Authentication Bypass Flaw Found in Telnetd
The flaw is in the way that the telnetd server handles some specific user-supplied data. An attacker who exploits this vulnerability would be able to bypass the authentication path and gain root privileges.
Dennis Fisher · 1 min
GitHub Aims to Improve npm Security After Malware Campaigns
GitHub said the changes will help “fortify the security of the software supply chain” after a recent surge of attacks targeting the npm ecosystem.
Lindsey O'Donnell-Welch · 4 min