Security built into how software is built and shipped: dependencies, CI, secrets, and hardened deploys.
Composer 2.11 shipped a cooldown that refuses to install a version until it has aged. vlt now holds npm publishes until their dependencies actually exist, because 22% of new npm versions land broken. And Ruby Central's reviewers threw out 90% of what an AI scanner flagged.
Volexity caught an attacker chaining zero-days into unauthenticated root on an Ivanti Connect Secure appliance running the latest build. The payload never touched disk, commands rode in over the same HTTPS requests as the exploit, and Ivanti's Integrity Checker reported no modifications.
Gitea 28.3.0 landed November 1 with twenty-one CVE fixes. Read the list and a pattern jumps out: more than half are the same failure repeated across different route handlers, where a token scoped to public data gets handed private data anyway. That's not twenty-one mistakes.
Eight eMudhra intermediate CA keys turned out to be recoverable from their own public certificates. Not stolen — computable, because the key generation produced almost no entropy. A researcher pulled all eight in under a second and signed a message with each one to prove it.
Self-host OpenClaw from zero to production. Server provisioning, SSH lockdown, Docker, reverse proxy, Fail2ban, performance tuning, and full backup strategy in one guide.
Here's the complete patch-status and lockdown guide, including the systemd hardening, origin validation, env-variable command injection fix, ClawHub skill safety, and how to tell if you've already been hit.
A pull request checkout, a poisoned GitHub Actions cache, and an OIDC token pulled straight out of runner memory. That's how 84 malicious versions of TanStack's packages hit npm in six minutes.
SudoSecurity runs Teleport internally for everything — admin panel access, secure database connections, Kubernetes, and zero-trust philosophy across our entire team. This is the complete technical guide to installing, configuring, and running your own self-hosted Teleport cluster from scratch.
A critical SSRF flaw in Axios was used in a North Korean supply chain attack. Here's what it does and how to patch it today.
On March 31, 2026, Anthropic published version 2.1.88 of Claude Code to the npm registry. Bundled inside was a 59.8 MB JavaScript source map file
Amazon fired 1,800+ engineers while forcing staff onto its Kiro AI tool. Here's why that's a cybersecurity disaster waiting to happen — and what it means for every developer.
Your application is only as secure as every package it depends on. In September 2025, attackers compromised 27 npm packages with 2.6 billion weekly downloads by phishing one maintainer.
