#Security

How a Fake LinkedIn Job Offer Delivered a Node Backdoor

Attackers are using stolen identities and malicious npm lifecycle scripts to target developers during the recruitment process.

Article · 2mos ago4

Replace Long-Lived AWS Credentials with GitHub Actions OIDC

Configure IAM and GitHub Actions to exchange short-lived, automatically-expiring AWS credentials on every workflow run — no stored access keys, no rotation toil.

Tutorial · 2mos ago0

Curl Pauses Vulnerability Report Intake for July 2026

The project's HackerOne form and security inbox go dark for a month, pushing coordinated disclosure plans into August.

News · 2mos ago2

Sophisticated AUR Malware Waves Expose Container and Pipeline Risks

A second wave of obfuscated malware targeting Arch Linux's user repository highlights the danger of unpinned, automated builds.

Article · 2mos ago3

Harden a Fresh Linux VPS in 30 Minutes: SSH Keys, UFW, and Fail2ban

Lock down a brand-new Ubuntu 22.04 server before you deploy anything: disable password logins, firewall every unused port, and auto-ban brute-force attackers.

Tutorial · 2mos ago0

Migrating TrueType Hinting to Swift: How Apple Beat C

Apple's rewrite of its legacy TrueType interpreter shows how modern Swift features like non-copyable types can outperform C.

Article · 2mos ago4

Set Up Trusted Local HTTPS with mkcert

Generate a real, browser-trusted TLS certificate for localhost in minutes — no more certificate warnings during local development.

Tutorial · 2mos ago0

AUR Supply Chain Attack Delivers eBPF Rootkit and Infostealer

A spoofed maintainer adopted over 400 Arch User Repository packages, injecting preinstall scripts that fetch malicious NPM payloads.

News · 2mos ago0

Critical Ivanti Sentry RCE Under Active Exploitation

A maximum-severity unauthenticated command injection vulnerability in Ivanti Sentry is being actively targeted following a public exploit release.

News · 2mos ago0

Claude Fable 5 Benchmarks Reveal Middling Security Fix Rates

New evaluation data shows Anthropic's latest model struggles with real-world security patches despite its impressive offensive capabilities.

Article · 2mos ago7

Scan Your Containers and Dependencies for CVEs with Trivy in CI

Wire Trivy into GitHub Actions to automatically block pull requests that introduce critical or high vulnerabilities in your Docker images or dependency files.

Tutorial · 2mos ago0

Eyes Open, Vulnerabilities Shipping: The AI Code Security Paradox

A Checkmarx survey of 2,350 developers and security leaders finds 70% believe AI-generated code is more vulnerable — and nearly a third ship it to production anyway. The tools exist. The process doesn't.

Article · 2mos ago0

Arbitrary Code Execution in objdump -g: How a Missing Bounds Check Becomes a Full Exploit

A heap out-of-bounds write in the FR30 relocation handler lets a crafted object file run attacker code when inspected with `objdump -g` — and the exploit defeats ASLR, PIE, and heap hardening in a single shot.

Article · 2mos ago0

Stop Hardcoding Secrets: Environment Variables Done Right

Move credentials out of your source code with .env hygiene, per-environment config, and a secrets manager — using patterns that work in any language.

Tutorial · 2mos ago0

Connect to Your Production Server Securely from Your Dev Machine

Stop typing passwords and raw IP addresses. Set up SSH key authentication, a clean ~/.ssh/config with host aliases and jump hosts, and agent forwarding done safely.

Tutorial · 2mos ago0