CI/CD Security

Read more about the article JetBrains TeamCity Auth Bypass: Build Servers as Front Door

JetBrains TeamCity Auth Bypass: Build Servers as Front Door

March 2024’s CVE-2024-27198 let unauthenticated attackers mint admin accounts on self-hosted TeamCity CI servers, converting every connected build agent into attacker-controlled execution holding source, secrets and signing keys. This piece covers the alternate-path authentication bypass, the companion path traversal, the ransomware crews that queued within days, and the year’s hard-learned rule that build infrastructure deserves domain-controller-grade security.

Continue ReadingJetBrains TeamCity Auth Bypass: Build Servers as Front Door
Read more about the article Codecov Breach: The CI Script That Leaked Build Secrets for Months

Codecov Breach: The CI Script That Leaked Build Secrets for Months

A tampered Codecov Bash Uploader quietly shipped CI environment variables — cloud keys, tokens, signing material — to attackers for two months. The curl-pipe-bash trust model dissected, and how build supply-chain security was rewritten after.

Continue ReadingCodecov Breach: The CI Script That Leaked Build Secrets for Months
Read more about the article Dependency Confusion: How a Researcher Hacked Apple and Microsoft

Dependency Confusion: How a Researcher Hacked Apple and Microsoft

No exploits, no stolen credentials — Alex Birsan’s February 2021 research got code executed inside 35+ major companies by registering their internal package names on public registries and letting version arithmetic do the rest. The incident file on the cheapest supply-chain attack ever demonstrated.

Continue ReadingDependency Confusion: How a Researcher Hacked Apple and Microsoft
Read more about the article Software Supply Chain Security: Risks in Dependencies, Builds, and Secrets
Supply Chain Security: Risks in Dependencies, Builds & Secrets

Software Supply Chain Security: Risks in Dependencies, Builds, and Secrets

A practical guide to software supply chain security covering dependency risks, secrets exposure, CI/CD trust failures, artifact integrity verification, SBOM management, and real-world attack case studies.

Continue ReadingSoftware Supply Chain Security: Risks in Dependencies, Builds, and Secrets