// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
PHP project criticized Chainguard for its coordinated vulnerability disclosure approach, saying it could expose widely used web software to risk.
-
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Microsoft attributes a ConnectWise supply-chain attack to a China-aligned group that used an automated AI framework to reach many tenants.
# 21 Oct
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab issued fixes for an unauthenticated remote code execution flaw affecting self-managed instances since version 7.0.
-
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Attackers are actively exploiting four Plex Media Server vulnerabilities, according to CISA.
-
LiteLLM supply chain attack hoovers up passwords and secrets
A supply chain attack involving LiteLLM reportedly collected passwords and secrets and delivered a remote access trojan.
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
LiteLLM version 1.107.0 was compromised in a supply-chain attack that distributed a credential stealer and backdoor through PyPI and Docker images.
-
Widespread PHP Flaw May Cause Many Site Outages Today
A pair of PHP vulnerabilities affecting many websites is being actively exploited and can allow attackers to take control of servers.