Samsung’s 190 GB: Lapsus$ and Source-Code Extortion
One contractor’s credentials, 190 GB of Galaxy bootloader and biometrics code, and the pure steal-and-dump model that outlived encryption ransomware.
Dependency Confusion: How a Researcher Hacked Apple and Microsoft
No exploits, no stolen credentials — Alex Birsan’s February 2021 research got code executed inside 35+ major companies by registering their internal package names on public registries and letting version arithmetic do the rest. The incident file on the cheapest supply-chain attack ever demonstrated.
What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
4 defense lessons from 33 historic cyberattacks – Morris Worm to XZ backdoor. Credentials, trust, detection speed and complexity, plus a small-budget priority list.
Exposed git directory terminal session
The Exposed .git Mistake We Keep Finding After 10 Years
One curl request to /.git/HEAD hands attackers your full source, every commit ever made, deleted files, and usually a working credential. A decade of research says this mistake is not aging out. Here is the exploit chain — and the three-layer fix.
Software Supply Chain Security for AI Agents and MCP Servers
A deep dive into securing AI agent supply chains — MCP server vetting, dependency integrity, sandboxing, and trust anchors for AI infrastructure.
Supply Chain Security: Risks in Dependencies, Builds & Secrets
Software Supply Chain Security: Risks in Dependencies, Builds, and Secrets
A practical guide to software supply chain security covering dependency risks, secrets exposure, CI/CD trust failures, artifact integrity verification, SBOM management, and real-world attack case studies.
GitLab Exploited in Days & the 86-Minute Rust Backdoor
GitLab CVE-2026-19478 went from disclosure to in-the-wild exploitation in days; a compromised maintainer account backdoored three Rust crates with 245M downloads for 86 minutes; Citrix shipped a CVSS 9.3 NetScaler auth bypass. The week's threats, IoCs, and your Monday patch list.
AUR Hijack & PAM Backdoor: June 2026 Supply Chain Crisis
Three supply chain campaigns in one week: 400+ hijacked AUR packages, Velvet Ant’s nine-year Linux PAM backdoor, and KEV entries for Oracle PeopleSoft and Ivanti Sentry. Trust is the attack surface.
Chrome Exploits & PyPI Supply Chain Attacks (June 2026)
Chrome’s fifth zero-day of 2026 and the Shai-Hulud PyPI campaign targeting 19 Python packages highlight the growing convergence of browser exploitation and open-source supply chain threats.
The State of Cybersecurity in 2026: Five Trends Reshaping Digital Defense
From AI-powered attacks to post-quantum cryptography, explore the five cybersecurity trends defining 2026 and what defenders must do now.