Fork pull requests and runner trust: what Gitea's Actions approval fixes change
Fork pull requests and runner trust: what Gitea's Actions approval fixes change A self-hosted forge holds source code, pipeline definitions and the…
Последние новости Web от Tech News
Все темы
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
The EDI 855, Decoded: The Purchase Order Acknowledgment Is Where the Order Becomes a Promise
An 855 · Purchase Order Acknowledgment is the seller's business answer to an 850 · Purchase Order: yes, no, or yes-with-changes — line by line, with…
Sub-100ms Cargo & Food Safety Triage: Eliminating 72% of Routing LLM Calls in National Supply Chains
Sub-100ms Cargo & Food Safety Triage: Eliminating 72% of Routing LLM Calls in National Supply Chains Part 3 of the "Jev-First Routing for LangGr…
The EDI 997, Decoded: What a Functional Acknowledgment Actually Proves (and What It Doesn't)
The EDI 997, Decoded: What a Functional Acknowledgment Actually Proves (and What It Doesn't) A 997 · Functional Acknowledgment proves one narrow thi…
Verify Audit Evidence with a Signed Payload, Not by Format
When many audit-evidence publishers (the systems that produce signed rows of evidence) each emit a different shape and the consumer checks signature…
57,029 Harbor Registries Online: An Artefact Store Is a Deployment Authority
57,029 Harbor Registries Online: An Artefact Store Is a Deployment Authority A container registry holds the images that a platform will run. Control…
3PL EDI, Decoded: The 940, 943, 944, 945, and 947 Warehouse Family
Short answer: when you hand fulfillment to a 3PL, five X12 documents become the contract of record for your inventory: the 940 (Warehouse Shipping O…
MemTensor: When an AI Memory Plugin Becomes the Credential Collector
MemTensor: When an AI Memory Plugin Becomes the Credential Collector StepSecurity reported that the open-source AI memory framework MemTensor had it…
MEMS Sensor Supply Chain Risks: Why Standard Mitigations Fall Short
MEMS sensors are now integral to industrial automation, robotics, and instrumentation. As volumes increase and price points compress, manufacturers…
Build & Release #3: I Deleted Every npm Token I Own
On October 7th I tried to publish @7onic-ui/tokens@0.3.7 and npm told me my own package didn't exist. npm error 404 Not Found - PUT https://regist…
What a build provenance attestation verifies, and what it leaves open
What a build provenance attestation verifies, and what it leaves open Supply chain security has a verification problem. Teams sign artefacts, publis…
Three merged PRs in an MCP security scanner: the review that found my bug, and two more
What happened Three PRs merged into yunaremaia/mcp-guard — a supply-chain/security scanner for MCP servers — in roughly 36 hours: PR What it did The…
CVE-2026-96365 and the Contribution Model: Why Drupal Site Owners Carry the Patch Burden
CVE-2026-96365 and the Contribution Model: Why Drupal Site Owners Carry the Patch Burden Vulnerability overview CVE-2026-96365 belongs to WID-SEC-20…
Verdaccio on 3,336 hosts: private npm registries and the tokens they hand out
Verdaccio on 3,336 hosts: private npm registries and the tokens they hand out Verdaccio is a lightweight private registry for npm packages. Teams ru…
Artifact Repositories Are Trust Anchors: Incident Response for a Compromised Build Pipeline
Artifact Repositories Are Trust Anchors: Incident Response for a Compromised Build Pipeline A software artifact repository is usually described as i…
The Artifactory Token Chain: Why Build Repositories Are a Credential Store
The Artifactory Token Chain: Why Build Repositories Are a Credential Store An artifact repository is rarely described as a credential store, yet tha…
700 Agents, 25 Actions Each, and Nothing Fired
Somewhere in your SIEM there's a rule that fires when one account does too much, too fast. Every threshold like it is a quiet bet that the attacker…
The Shai-Hulud npm worm showed that opening a folder is enough to run code
The Shai-Hulud npm worm showed that opening a folder is enough to run code In August 2026 an attacker took over the GitHub account of a maintainer w…
One Console, Every Customer: What the N-able N-central Pre-Authentication RCE Says About RMM Concentration Risk
One Console, Every Customer: What the N-able N-central Pre-Authentication RCE Says About RMM Concentration Risk Remote monitoring and management pla…
The Default Join Key That Let Attackers Mint Admin Tokens on JFrog Artifactory
The Default Join Key That Let Attackers Mint Admin Tokens on JFrog Artifactory A package repository that hands out administrator credentials to an u…
AI Supply Chain Compromises: 7 Entry Points Your Security Review Probably Misses
Most of an AI system is made of things you did not build: pretrained weights, public datasets, Python packages, a coding assistant, a handful of MCP…
The GNU strip backdoor is the case AI code review can't see
This paper (arxiv 2607.24888) is worth a stop if you evaluate AI code review. It shows Ken Thompson's trusting-trust attack is not compiler-specific…
A Supply-Chain Worm Wrote Itself Into Claude Code's Hook Files to Survive Credential Rotation
Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sur…
What Is JINGDONG Logistics and How Does JD Logistics Use AI in Supply Chain Management?
When people hear about JINGDONG Logistics, also known as JD Logistics, they may think of package delivery. But delivery is only one part of what the…
Image verification, one layer below admission
Every admission webhook you rely on has an escape hatch. Nothing scandalous about that, it is just how Kubernetes wires them up. A CNCF post on July…
PyPI stops accepting late file uploads to releases older than 14 days
PyPI now rejects new file uploads against any release older than 14 days, closing off a small but useful window that a compromised publishing token…
Booking.com Breach: When the Vendor Chain Becomes the Attack Surface
What Happened This week, Booking.com confirmed that unauthorized third parties accessed reservation data belonging to a subset of customers. Exposed…
Dependabot learns to wait: version-update PRs now sit for three days by default
Every time your bot merges a two-hour-old release into main, you are trusting a stranger's freshly published tarball to be the same one everyone els…
Innersource security advisories go GA: a private channel for private vulns
Your platform team ships an internal package. Half the org pulls it. Someone finds a bug that in the wrong hands is a full RCE. What do you do next:…
uv audit vs pip-audit, and a gate narrower than it looks
Until now, the tools that install packages have never once stopped to ask, "Are you sure it's okay to take this one?" Whether it's pip install or np…