LLM-generated CVE reports are polluting security databases
Someone is flooding the National Vulnerability Database with fake SQLite vulnerabilities written by language models, and it is breaking actual security work.
Read the note 1 min read
From the notebook
supply-chain.
7 notes on this topic.
Qubes OS has a public CVE list now and it is shorter than you think
Fifteen years of a compartmentalised desktop OS, zero remote code execution bugs. The paper tracking every public Qubes vulnerability is out.
Read the note 1 min read
Tata Electronics breach claims Apple and Tesla trade secrets leaked
A ransomware gang says they got into Tata's systems and grabbed confidential files from Apple and Tesla. The supply chain question nobody wants asked.
Read the note 1 min read
1,500 poisoned packages in the Arch User Repository
The Arch Linux team spent the weekend cleaning up more than 1,500 malware-laden packages from the AUR. The scale is what surprised me.
Read the note 1 min read
400 AUR packages compromised, or why I stopped trusting build scripts
The Arch User Repository just had 400 packages backdoored. The attack vector was not clever. It was obvious, predictable, and it worked anyway.
Read the note 1 min read
Config files that execute code are everywhere
YAML, TOML, and JSON parsers can run arbitrary code during deserialization. Most dependency scanners miss them entirely.
Read the note 1 min read
Composer is getting package signing after 14 years
PHP's dependency manager is rolling out cryptographic signatures. The timing matters more than the tech.
Read the note 1 min read