Vikrant
LLM-generated CVE reports are polluting security databases
Someone is flooding the National Vulnerability Database with fake SQLite vulnerabilities written by language models, and it is breaking actual security work.
Read post
supply-chain
7 posts tagged.
- security
-
qubes-osVikrant
Qubes OS has a public CVE list now and it is shorter than you think
Fifteen years of a compartmentalised desktop OS, zero remote code execution bugs. The paper tracking every public Qubes vulnerability is out.
Read post
-
cybersecurityVikrant
Tata Electronics breach claims Apple and Tesla trade secrets leaked
A ransomware gang says they got into Tata's systems and grabbed confidential files from Apple and Tesla. The supply chain question nobody wants asked.
Read post
-
linuxVikrant
1,500 poisoned packages in the Arch User Repository
The Arch Linux team spent the weekend cleaning up more than 1,500 malware-laden packages from the AUR. The scale is what surprised me.
Read post
-
linuxVikrant
400 AUR packages compromised, or why I stopped trusting build scripts
The Arch User Repository just had 400 packages backdoored. The attack vector was not clever. It was obvious, predictable, and it worked anyway.
Read post
-
supply-chainVikrant
Config files that execute code are everywhere
YAML, TOML, and JSON parsers can run arbitrary code during deserialization. Most dependency scanners miss them entirely.
Read post
-
supply-chainVikrant
Composer is getting package signing after 14 years
PHP's dependency manager is rolling out cryptographic signatures. The timing matters more than the tech.
Read post