Fork pull requests and runner trust: what Gitea's Actions approval fixes change
Fork pull requests and runner trust: what Gitea's Actions approval fixes change A self-hosted forge holds source code, pipeline definitions and the…
Testing & QA
⚑ Сообщить о проблемеПоследние новости Testing & QA от Tech News
Все темы
agents
ai
api
architecture
automation
backend
beginners
career
claude
cybersecurity
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
Sub-100ms Cargo & Food Safety Triage: Eliminating 72% of Routing LLM Calls in National Supply Chains
Sub-100ms Cargo & Food Safety Triage: Eliminating 72% of Routing LLM Calls in National Supply Chains Part 3 of the "Jev-First Routing for LangGr…
Verify Audit Evidence with a Signed Payload, Not by Format
When many audit-evidence publishers (the systems that produce signed rows of evidence) each emit a different shape and the consumer checks signature…
Build & Release #3: I Deleted Every npm Token I Own
On October 7th I tried to publish @7onic-ui/tokens@0.3.7 and npm told me my own package didn't exist. npm error 404 Not Found - PUT https://regist…
Three merged PRs in an MCP security scanner: the review that found my bug, and two more
What happened Three PRs merged into yunaremaia/mcp-guard — a supply-chain/security scanner for MCP servers — in roughly 36 hours: PR What it did The…
CVE-2026-96365 and the Contribution Model: Why Drupal Site Owners Carry the Patch Burden
CVE-2026-96365 and the Contribution Model: Why Drupal Site Owners Carry the Patch Burden Vulnerability overview CVE-2026-96365 belongs to WID-SEC-20…
Verdaccio on 3,336 hosts: private npm registries and the tokens they hand out
Verdaccio on 3,336 hosts: private npm registries and the tokens they hand out Verdaccio is a lightweight private registry for npm packages. Teams ru…
Artifact Repositories Are Trust Anchors: Incident Response for a Compromised Build Pipeline
Artifact Repositories Are Trust Anchors: Incident Response for a Compromised Build Pipeline A software artifact repository is usually described as i…
One Console, Every Customer: What the N-able N-central Pre-Authentication RCE Says About RMM Concentration Risk
One Console, Every Customer: What the N-able N-central Pre-Authentication RCE Says About RMM Concentration Risk Remote monitoring and management pla…
The Default Join Key That Let Attackers Mint Admin Tokens on JFrog Artifactory
The Default Join Key That Let Attackers Mint Admin Tokens on JFrog Artifactory A package repository that hands out administrator credentials to an u…
AI Supply Chain Compromises: 7 Entry Points Your Security Review Probably Misses
Most of an AI system is made of things you did not build: pretrained weights, public datasets, Python packages, a coding assistant, a handful of MCP…
PyPI stops accepting late file uploads to releases older than 14 days
PyPI now rejects new file uploads against any release older than 14 days, closing off a small but useful window that a compromised publishing token…
uv audit vs pip-audit, and a gate narrower than it looks
Until now, the tools that install packages have never once stopped to ask, "Are you sure it's okay to take this one?" Whether it's pip install or np…
How to Build a Secure Homelab for LLM Inference
We’ve treated local AI deployments as experimental toys for too long. The moment a homelab becomes a dependency for work, the security posture must…
ShadowFeed Weekly #1: IronWorm npm Attack, $36M Humanity Protocol Hack, Microsoft Repos Compromised
ShadowFeed Weekly #1 | Web3 Security Intelligence June 5 — June 11, 2026 ShadowFeed is a real-time Web3 security intelligence service for developers…
Rust Crate 'onering' Compromised: Malicious Code Exfiltration Risk Mitigated with Updated Version
Introduction and Background The Rust ecosystem, celebrated for its memory safety and performance, relies heavily on crates —its package management s…
End-to-End GitHub Security Hardening Guide for Organizations
GitHub is not just a source code platform anymore. For most engineering organizations, GitHub is part identity system, part software supply chain, p…
The Maintainer Trap: What the jqwik Incident Reveals About Trusting Your Dependencies
This article was originally published on LucidShark Blog . On May 29, 2026, a developer pushed a new release of jqwik, a popular Java property-based…
The Bot That Never Was
By Ionut-Cristian Florescu ( @icflorescu ), written June 6, 2026, while still locked out. How the Miasma worm, a Shai-Hulud strain that this week al…
Supply Chain Sense: Merging Gemini AI and Math for Smart Retail Inventory
In neighbourhood retail markets, local Kirana stores, and hyper-local fulfilment centres, inventory management isn’t an administrative task—it’s a h…
I scanned 200 popular MCP server packages. Here is what I found.
The MCP ecosystem has been growing fast, but the supply-chain hygiene has not kept up. MCPwn (CVE-2026-33032, CVSS 9.8) exposed 2,600+ instances. Th…
PCB Shortage Warning: Iran-Saudi Conflict Drives 40% Price Increase — What Hardware Engineers Need to Know
Gulf Conflict Triggers New PCB Supply Chain Crisis A convergence of geopolitical disruption and commodity price surges is creating the PCB industry'…
GitHub Wasn't Hacked, But Your CI/CD Pipeline Might Be: Lessons from Grafana, CISA, and Shai-Hulud 2.0
GitHub wasn't hacked on May 19, 2026. GitHub.com is fully operational, all metrics green. But within the same news cycle, three incidents converged…
How to Choose a PCB Manufacturer – A Practical Guide for Hardware Engineers
10 questions to ask before placing your next order Introduction You‘ve spent weeks designing your PCB. The schematic is clean, the layout is optimiz…
MCPwn Is Live. We Scanned the Supply Chains of 14 MCP Servers. Here's What We Found.
MCPwn Is Live. We Scanned the Supply Chains of 14 MCP Servers. Here's What We Found. April 18, 2026 MCPwn dropped this week. CVE-2026-33032 — CVSS 9…