23 articles tagged
Cloudflare Gateway can now allow or block package downloads across seven ecosystems. Detection is fail-open, and an unparseable version string matches no comparison at all.
AWS added a task-hours cap to Security Agent on 19 August 2026. The smallest allowed value is 20 hours, and the Price List API rates pen testing at $50.00 per hour, so the floor is $1,000 a test.
GitHub shipped three application-security changes on 20 August 2026. The new Mitigated dismissal reason is absent from the REST API enum and from the documentation page the changelog links to, and admins are told
GitLab 19.3 removed the budget_caps_graphql_api feature flag and made GitLab Credits usage caps generally available. The release note says features are suspended at the cap. The subscriptions documentation says
Go ships a security patch roughly every month and drops a major version out of support the day the next-but-one arrives. How eCorpIT builds and maintains Go services against that clock.
Rails 7.2 stopped receiving security fixes on 9 August 2026, nine days after its last patch. Ruby 3.2 was already end-of-life. How eCorpIT audits, upgrades and maintains a Rails estate.
On 4 August 2026 a worm published poisoned versions of keyv and cacheable carrying valid npm provenance. Rotating credentials first triggers a dead-man's switch. Nine controls for Node-heavy teams, and what npm v12 does
Turning code scanning on across a large estate is one afternoon of work and six months of alert triage. A new repository property changes the sequence, and the cost is per active committer, not per repository.
Attackers force-pushed 75 of 76 trivy-action tags in March 2026 and stole secrets from every pipeline that ran a scan. Here is the credential isolation architecture that survives a poisoned action, with the exact GitHub
Valid provenance signed keyv 6.0.0 on 4 August 2026, and eight malicious releases were still tagged latest 101 minutes later. What attestations prove, and the cooldown config for npm, pnpm, Yarn and Bun.
Push Security tracks 25-plus device-code phishing kits and a 37.5x rise in phishing pages by April 2026. Passkeys do not help. Here are the settings that do, per platform.
A hijacked maintainer account pushed Shai-Hulud malware into the keyv and cacheable npm family on 4 August 2026, with valid GitHub Actions provenance. Here is the containment order for the first 90 minutes.
OpenAI's Codex Security CLI is Apache-2.0 open source, but it calls a gated, metered engine. How to install it, wire it into CI with exit codes and SARIF, and where it fits next to Semgrep, CodeQL and Snyk.
On 28 July 2026 GitHub began ingesting OpenSSF malicious-packages advisories, so Dependabot malware alerts now cover npm, PyPI and more. Here is how to enable them and respond when one fires.
GitHub shipped a CodeQL query on 10 July 2026 that catches prompt injection in code review: js/system-prompt-injection flags untrusted input flowing into an AI model's system prompt. Here is what it detects, how to turn
The first scheduled Next.js security release landed on 20 July 2026 with nine CVEs across App Router, Server Actions, rewrites and the image endpoint. Here is who is actually exposed and how to patch.
Four of the 13 Next.js advisories published in May 2026 let attackers reach protected pages without passing middleware. Patching to 16.2.5 does not close all of them, and the reason is Turbopack.
AI writes a growing share of enterprise code, and 2026 attacks like GhostApproval and Friendly Fire target the assistants themselves. A senior engineer's guide to the AppSec layer AI-assisted teams need, and how eCorpIT
Slopsquatting turns AI package hallucinations into supply-chain attacks. A practical guide to the data, the confirmed incidents, and seven CI controls that block hallucinated dependencies before they reach production
Adversa AI tested 11 open-source coding agents in June 2026 and beat the safety filter on 10 of them with shell tricks that are 30 years old. How the bypass works, which designs held, what to change now.
Eleven CVEs landed against Model Context Protocol implementations in April 2026, and Anthropic called the underlying STDIO behaviour expected. Here is what that means for anyone running MCP servers in production
Microsoft's July 2026 Patch Tuesday fixed a record 570 flaws, including two zero-days already under attack. AI-assisted discovery is why the number exploded, and why the old triage signals stopped working.
CVE-2025-3248 gave unauthenticated attackers code execution on Langflow, and it was not the last. How to harden Langflow, Flowise, and n8n: patching, network isolation, gateway auth, secrets, and sandboxing for AI
