Skip to content
Standard Reader
Log in
Tag

Supply-chain

Articles and publications tagged Supply-chain across the Atmosphere.

43articles9publications
jeffreyciend
jeffreyciendNov 9, 2026
Python's safe path mode narrows module hijacking during script launch
Using Python -P and PYTHONSAFEPATH to reduce launch-directory module hijacking
securitypython
facilishz
facilishzNov 9, 2026
Pip hash-checking mode only works when every dependency is covered
Building a complete pip hash-checked install path for Python dependencies
securitypython
jeffreyciend
jeffreyciendNov 2, 2026
Git submodules carry a second repository trust decision
Git submodules carry a second repository trust decision
gitsubmodules
ivanova
ivanovaNov 2, 2026
Python build isolation controls where package code runs
Python build isolation controls where package code runs
pythonpip
facilishz
facilishzNov 2, 2026
A Terraform provider lock file is a checksum contract
A Terraform provider lock file is a checksum contract
terraformproviders
ioneyrezende
ioneyrezendeNov 1, 2026
TUF rollback and freeze defenses depend on trusted client state
Why TUF metadata recovery must persist trusted versions, expiry and root key transitions.
securitysupply-chain
kozhevnikova
kozhevnikovaOct 30, 2026
Container tags move; digests should decide what runs
Why immutable container digests belong in deployment and rollback records.
containerssupply-chain
sorrelthorncroft
sorrelthorncroftOct 29, 2026
Patching UpdraftPlus is not enough after the UpdraftCentral key theft
Why version updates and old-key revocation do not complete the investigation of existing persistence.
wordpresssupply-chain
kozhevnikova
kozhevnikovaOct 29, 2026
Concentration risk in managed WordPress services: lessons from UpdraftCentral
How managed WordPress services concentrate credential risk across many sites.
wordpresssupply-chain
jeffreyciend
jeffreyciendOct 28, 2026
From Product Mentions to Incident Evidence: A Safer Rank Math Triage
A layered workflow that connects external asset discovery with local incident evidence.
securitysupply-chain
eiuspkz
eiuspkzOct 28, 2026
57,482 Harbor Fingerprints and a Documented Default Administrator Password
The install guide still prints admin and Harbor12345 as the first-login credential. What that means for a registry that hands images to every cluster you run.
harborcontainer-registry
facilishz
facilishzOct 27, 2026
An agentic IDE lost agent logs: what Warp's vendor breach says about trace retention
Warp's third-party breach exposed agent traces, a data class most classification schemes were not written for.
securityai
ioneyrezende
ioneyrezendeOct 26, 2026
A self-hosted CI runner is a credential store that also executes whatever the repository says
What a self-hosted runner executes, what it leaks, and how scope, ephemerality and fork approvals change the exposure.
ci-cdsupply-chain
andreagomez205
andreagomez205Oct 25, 2026
An unsigned SBOM answers a question nobody asked
Why an SBOM without digest-bound signature is a description rather than evidence, and the four verification checks a consumer has to run.
supply-chainsbom
eiuspkz
eiuspkzOct 24, 2026
When the Server Is the Attacker: curl CVE-2026-92392 and the Embedded libcurl You Forgot About
A client-side use-after-free in libcurl's HTTP/2 upload path inverts the usual threat model, and most affected code never calls the curl binary. Inventory and mitigation guidance for embedded copies.
curlhttp2
andreagomez205
andreagomez205Oct 24, 2026
Harbor's Search API Answered Without Authorisation, and the Vendor Called It a Feature
The registry search endpoint answered anonymous callers, and the maintainers said that was documented behaviour. Why registry inventory is reconnaissance, and how to check what your registry returns.
harborcve-2022-46463
ioneyrezende
ioneyrezendeOct 23, 2026
Eight Intermediates and a Key That Was Just a Number: What the eMudhra CA Compromise Means for Non-Browser Clients
Eight eMudhra intermediates were revoked within three days. Browsers were covered; curl, Python, Node, Go and frozen firmware were not. A trust store inventory that actually finds the risk.
pkicertificate-authority
ivanova
ivanovaOct 23, 2026
The .pth file that runs before your code: lessons from the LiteLLM 1.107.0 compromise
How a .pth file in LiteLLM 1.107.0 ran a credential stealer before any import, and the checks that answer whether you were exposed.
supply-chainlitellm
kozhevnikova
kozhevnikovaOct 22, 2026
2,900 sign-in attempts a minute: what the ConnectWise campaign teaches about third-party application trust
What the ConnectWise campaign reveals about OAuth consent, application credential persistence and detection at machine speed.
supply-chainconnectwise
jeffreyciend
jeffreyciendOct 22, 2026
CVE-2026-89111: SSRF in a Multi-Tenant SDK and the OAuth Credentials Behind It
Why an SSRF in a cloud SDK is a credential problem, and how to verify that consuming applications actually shipped the fix.
vulnerabilitycloud
Andrew Nesbitt
Andrew NesbittOct 21, 2026
Trust Stores Are Dependencies Too
26 of 29 CA bundles in critical packages contain roots Mozilla has removed.
securitypackage-managers
Andrew Nesbitt
Andrew NesbittSep 22, 2026
Unfinished Work in Package Security
Some assembly required.
package-managerssecurity
Andrew Nesbitt
Andrew NesbittSep 15, 2026
Shadowing the Standard Library
export PYTHONSAFEPATH=1
securitysupply-chain
Andrew Nesbitt
Andrew NesbittSep 10, 2026
Package Manager Trends
min-release-age, minimum-release-age, -Zmin-publish-age, cooldown.
package-managerssupply-chain