#Supply Chain
Hugging Face Diffusers flaws turn model loading into a code execution risk
Hugging Face Diffusers flaws turn model loading into a code execution risk Security researchers have disclosed a set of Hugging Face Diffusers vulnerabilities t...
Lucas Oliveira
Research
JetBrains TeamCity RCE Puts Self-Hosted CI/CD Servers on an Urgent Patch Clock
JetBrains TeamCity RCE Puts Self-Hosted CI/CD Servers on an Urgent Patch Clock JetBrains has released fixes for CVE-2026-63077, a critical unauthenticated [remo...
Lucas Oliveira
Research
U-Boot FIT signature flaws expose a fragile pre-OS trust boundary
U-Boot FIT signature flaws expose a fragile pre-OS trust boundary Firmware security company Binarly has disclosed six vulnerabilities in U-Boot's FIT signature...
Lucas Oliveira
Research
Vect and TeamPCP show how stolen build secrets become ransomware access
Vect and TeamPCP show how stolen build secrets become ransomware access Sophos says two cybercrime groups, Vect and TeamPCP, have formalized a partnership that...
Lucas Oliveira
Research
GitHub breach forces GHES signing-key rotation
GitHub breach forces GHES signing-key rotation | 2026 GitHub's May 2026 incident is a useful reminder that developer tooling is now part of the production trust...
Lucas Oliveira
Research
DAEMON Tools supply-chain attack turns trusted installers into a malware delivery path
DAEMON Tools supply-chain attack turns trusted installers into a malware delivery path The most important part of the DAEMON Tools incident is not that malware...
Lucas Oliveira
Research
PyTorch Lightning supply-chain compromise puts AI developer credentials at risk
PyTorch Lightning supply-chain compromise puts AI developer credentials at risk The most dangerous supply-chain incidents are not always the ones that hit opera...
Lucas Oliveira
Research
Bitwarden CLI npm compromise exposes CI/CD credential risk
Bitwarden CLI npm compromise exposes CI/CD credential risk A brief compromise of the Bitwarden CLI npm distribution is still a high-priority defender story beca...
Lucas Oliveira
Research
Critical protobuf.js flaw turns untrusted schemas into JavaScript code execution
Critical protobuf.js flaw turns untrusted schemas into JavaScript code execution A newly disclosed protobuf.js issue deserves attention well beyond the JavaScri...
Lucas Oliveira
Research
CPUID breach turned CPU-Z and HWMonitor into a malware delivery path
CPUID breach turned CPU-Z and HWMonitor into a malware delivery path Executive summary A compromise of the CPUID website briefly turned trusted download links f...
Lucas Oliveira
Research
TELUS Digital breach: ShinyHunters claims 1PB data theft
TELUS Digital breach: ShinyHunters claims 1PB data theft | 2026 Executive Summary TELUS Digital confirmed on March 12, 2026 that it is investigating unauthorize...
Lucas Oliveira
Research
Chrome Extension Supply-Chain Attack: ShotBird and QuickLens
Chrome Extension Supply-Chain Attack: ShotBird and QuickLens | 2026 Executive Summary ShotBird and QuickLens, two Chrome extensions that were previously legitim...
Lucas Oliveira
Research