Inside the Metabase SQLi: Exploited in the Wild
Technical analysis of a Metabase SQL injection vulnerability actively exploited in the wild.
High Signal Security
Cloud security research and engineering insights by Rami McCarthy.
Latest posts
keyv and cacheable npm Package Hijacked in Supply Chain Attack
Analysis of a supply chain attack hijacking the popular keyv and cacheable npm packages.
M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
Analysis of a supply chain attack on AsyncAPI exploiting a pwn request vulnerability in GitHub Actions, resulting in malicious npm packages with multi-stage payloads.
Miasma: A Supply Chain Attack Targeting Red Hat npm Packages
Analysis of Miasma, a supply chain attack targeting 32 @redhat-cloud-services npm packages via OIDC trusted publishing abuse.
durabletask: TeamPCP’s Latest PyPi Compromise
Analysis of TeamPCP's PyPI supply chain attack targeting the durabletask package.
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Analysis of TeamPCP's supply chain attack targeting @antv packages on npm.
Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP
Technical analysis of Fragnesia, a Linux kernel local privilege escalation vulnerability in ESP-in-TCP packet handling.
Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised
Analysis of TeamPCP's continued npm supply chain attacks targeting TanStack and other popular packages.
Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC
Analysis of a Linux kernel local privilege escalation vulnerability in ESP and RxRPC packet fragmentation handling.
Practical Package Security: The Unofficial Guide
A comprehensive guide to securing your software supply chain through practical package security measures.