ci-supplychain-guard

CI Supply Chain Guard CI/CDパイプラインに悪意のある依存関係がマージされる前に検出する静的解析ツールです。 作者: Otsmane Ahmed ステータス: 研究プロトタイプ v1.0 クイックスタート root@kitploit: 1. Clone and install git clone https://github.com/Otsmane-Ahmed/ci-supplychain-guard.git cd ci-supplychain-guard python3 -m venv venv source venv/bin/activate On...

gitoops

GitOops! 😱 すべての道はクラウドへ通じる GitOopsは、攻撃者と防御者がGitHub Organization内の横移動や権限昇格パスを特定するためのツールで、CI/CDパイプラインやGitHubのアクセス制御を悪用します。 このツールは、GitHub OrganizationとそのCI/CDジョブおよび環境変数との関係をマッピングすることで動作します。Bolt互換のグラフデータベースをバックエンドとして使用するため、openCypherを使って攻撃パスをクエリできます。 root@kitploit: MATCH...

openclarity

OpenClarity is an open source tool for agentless detection and management of Virtual Machine Software Bill Of Materials SBOM and security threats such as vulnerabilities, exploits, malware, rootkits, misconfigurations and leaked secrets. Join OpenClarity's Slack channel to hear about the latest...

pwnproxy

pwnproxy 一个安全测试引擎。所有界面。 一个开放、本地优先的安全测试平台，适用于渗透测试人员、 AI 代理、CI/CD 流水线和团队。 安全测试不再只是桌面端工作流 传统安全工具围绕单个测试人员使用桌面界面而设计。 pwnproxy 围绕一个共享的安全测试引擎构建，可通过终端、TUI、REST API、WebSocket 流、CI/CD 流水线或通过 MCP 的 AI 代理进行控制。 root@kitploit: ┌─────────────────────┐ │ pwnproxy core │ │ │ │ Proxy · Scanners │ │ Repeater ·...

DEFCON-CICD-pipelines-workshop

CI/CD : Il nuovo Eldorado ? Abstract Le pipeline CI/CD stanno diventando sempre più parte dell'infrastruttura standard all'interno dei team di sviluppo; con l'avvento di nuovi approcci come Infrastructure as Code, il livello di sensibilità di tali pipeline sta aumentando rapidamente. In caso di...

CVE-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

Supply Chain Compromises Impact Nx Console and GitHub Repositories

CISA is prioritizing the response to multiple emerging software supply chain intrusion campaigns targeting developer ecosystems Continuous Integration/Continuous Development CI/CD pipelines. These recent incidents, including the GitHub compromise via a malicious Nx Console Visual Studio Code VS...

Malicious code in @cap-js/postgres (npm)

Supply chain compromise of legitimate SAP packages published by threat actor "[email protected]" impersonating SAP toolchain maintainers. All four compromised packages share the same fingerprint: setup.mjs 4.4 KB and execution.js 11.1 MB bundled in the tarball, with a preinstall hook of "node...

CVE-2026-31961 Unbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsing

Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in...

Exploit for Argument Injection in Gnu Inetutils

CVE-2026-24061 GNU inetutils Telnet Detector A safe, passive...

CVE-2026-23889 pnpm has Windows-specific tarball Path Traversal

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for ./ but not .. On Windows, backslashes are directory separators...

Duplicate Advisory: Wrangler affected by OS Command Injection in `wrangler pages deploy`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-36p8-mvp6-cv38. This link is maintained to preserve external references. Original Description SummaryA command injection vulnerability CWE-78 has been found to exist in the wrangler pages deploy command. The iss...

EUVD-2018-6511

Malware in sbrugna...

EUVD-2023-2156

Malicious code in bioql PyPI...

The New Frontline: Why DevOps Became a Cyber Target

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! Your developers didn't become...

CVE-2025-49598 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

CVE-2024-52582

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

Secure Your APIs and Reduce Your Attack Surface With Modern, AI-powered API Security in Qualys Web Application Scanning (WAS)

The rise of APIs presents both opportunities and challenges in today’s hyperconnected digital world. APIs are integral to digital transformation initiatives across industries. The latest data indicates that over 83% of web traffic now comprises API traffic, highlighting their critical role in...

Practical Guidance For Securing Your Software Supply Chain

The heightened regulatory and legal pressure on software-producing organizations to secure their supply chains and ensure the integrity of their software should come as no surprise. In the last several years, the software supply chain has become an increasingly attractive target for attackers who...

An End-to-End Approach to Next-Gen Security for Web Applications & APIs

According to Verizon’s 2022 Data Breach Investigations Report, web applications remain both the top hacking vector and data breach pattern, accounting for roughly 70% of security incidents. This is because web applications are everywhere and easily probed for weaknesses. A vulnerability in any...