Tag: Supply Chain Attack
All the articles with the tag "Supply Chain Attack".
- 8 min read
From DSN to Shell: How a Leaked Sentry Key Becomes RCE Through Your AI Agent
A walk through indirect prompt injection at the tool boundary — why 'fix my Sentry issues' is a more dangerous instruction than it looks, and how to make it safe.
- 9 min read
When the Platform Itself Falls: Five Takeaways from the TeamPCP GitHub Breach
The TeamPCP breach of internal GitHub repositories highlights a critical shift in software supply chain attacks: company laptops and developer workflows are now primary infrastructure.
- 11 min read
Tags Are Not Pins: The GitHub Actions Trust Model Has a Foundational Problem
Git tags are mutable pointers, not immutable package hashes. When attackers gain the ability to move tags to imposter commits, standard CI/CD hardening advice breaks down entirely.
- 9 min read
CVE Is Not a Security Strategy: Why Waiting for an Advisory Is the Wrong Move in the Supply Chain Era
The CVE system is structurally unfit for modern supply chain attacks. When threat actors abuse trust relationships rather than software defects, waiting for a reactive advisory leaves organizations dangerously exposed.
- 10 min read
The Rise of Supply Chain Attacks: Why 2025–2026 Changed Everything
Supply chain attacks have evolved from rare, high-profile incidents into industrialized, automated campaigns targeting the open-source ecosystem at scale. The software supply chain is no longer a side door — it's the primary attack surface of the modern era.