Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Accidental Exposure in Private Repo
Mozilla has revoked the cryptographic signing key used for Firefox and Thunderbird downloads on Linux after an unencrypted copy of the key…
Tag: software supply chain
Securing AI-Speed Development: Webinar Explores New Operating Model for Security Teams
AI is enabling development teams to ship 10 to 50 times more code, but security teams still operate at human speed, creating…
Open Source’s Coming of Age: The Rise of the ‘Subset’ and the New Enterprise Security Bar
Open source software is undergoing a forced maturation, driven by a convergence of threats and regulatory pressures. The article argues that while…
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Google has removed three AI agent workflows from its Agent Development Kit (ADK) Python repository after researchers at Pillar Security demonstrated that…
GitHub Introduces 3-Day Dependabot Cooldown to Mitigate Poisoned Package Attacks
GitHub has announced a new cooldown mechanism for Dependabot that introduces a mandatory three-day waiting period before opening pull requests for version…
Mend.io: Software Supply Chain Security
Mend.io disclosed details of an undocumented software supply chain attack using 14 RubyGems packages to store stolen credential data.
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages
Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm…
Chainguard: Securing the Software Supply Chain
Chainguard is a software supply chain security company that provides solutions for secure base images, SBOM management, and policy enforcement. The company…
GitHub ‘Verified’ Commits Can Be Rewritten Into New Hashes Without Breaking Signatures
New research from Carnegie Mellon University PhD student Jacob Ginesin, also a cryptographic auditor at Cure53, reveals that GitHub's 'Verified' commit badge…
GitLost Attack: Public GitHub Issue Tricks AI Agents Into Leaking Private Repo Data
Researchers at Noma Security have demonstrated a novel prompt injection attack, dubbed GitLost, that exploits GitHub Agentic Workflows to leak private repository…