One Malformed Photo Put OpenAI’s Private Repository Within Reach
The upload bug lived in a third-party forum. The blast radius grew because a community sign-in token carried access into employee AI accounts and GitHub.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
This npm Malware Waited Until Runtime to Slip Past Install-Script Defences
Defences watched package installation. The payload stayed quiet until an application used a normal B-tree method.
Four Linux Network Flaws Can Turn a Local User Into Root, and One Evades the Easy Mitigation
DirtyAH6, TUNderflow, PPPoEject and DiagSpill reach different kernel subsystems. One mitigation does not cover all four.
Microsoft Fixed Eighteen Cloud Flaws Before Customers Could Touch Them
The fixes were real, but there was no update button for customers. The affected layer sat inside Microsoft's cloud control plane.
Your Private Screenshots Were One Server Bug Away From Public View
Gyazo stored far more than pictures. Attackers obtained user records, OCR text, location data and information used to construct image URLs.
Hackers Reached Colorado Water Controls Without Stopping the Pumps
The attackers reached operational settings. Operators disabled remote access, while officials said water delivery and public safety were not affected.
A Departed Employee’s Token Quietly Opened 170 Private Security Repositories
The employee had left. The token had not. GitHub traced the access path back to the wider TanStack supply-chain incident.
How Plugin4Shell Made Reviewed AI Coding Plugins Run Different Code
Four coding agents trusted a commit hash but did not verify the code that Git actually placed in the working tree.
The Fake GitHub Download Arrived With a Microsoft-Signed EDR Killer
The repositories copied more than 40 brands. The payload then used a trusted driver to remove the tools most likely to stop it.
The Login Screen on Your Security Manager Could Hand an Attacker Root
The systems that manage firewalls and collect their logs have a network-reachable stack overflow before authentication.