DevSecOps Archives • Daily CyberSecurity

OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build OVHcloud CLI attack in a supply chain attack that replaced GitHub release binaries with a secret-stealing build

OVHcloud CLI attack in a supply chain attack that replaced GitHub release binaries with a secret-stealing build

OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build

Do Son October 20, 2026

TL;DR On October 19, 2026, an attacker replaced official OVHcloud CLI release files on GitHub with a...

npm Trusted Publishing Now Expires After 48 Hours npm trusted publishing configuration tied to a GitHub repository name, exposed to a repository name reuse attack before its first publish

npm trusted publishing configuration tied to a GitHub repository name, exposed to a repository name reuse attack before its first publish

npm Trusted Publishing Now Expires After 48 Hours

Do Son October 15, 2026

GitHub Tightens npm Trusted Publishing Rules GitHub has changed the rules for npm trusted publishing. A new...

GitLab Patches CVE-2026-97229 (CVSS 10.0) Flaw That Lets Unauthenticated Attackers Execute Arbitrary Code GitLab critical vulnerability CVE-2026-97229 enabling arbitrary code execution on self-managed servers

GitLab critical vulnerability CVE-2026-97229 enabling arbitrary code execution on self-managed servers

GitLab Patches CVE-2026-97229 (CVSS 10.0) Flaw That Lets Unauthenticated Attackers Execute Arbitrary Code

Do Son October 12, 2026

TL;DR GitLab released versions 19.4.2, 19.3.4 and 19.2.8 on October 8, 2026, fixing 24 security issues. The...

Argo CD Patches Four Critical CVSS 9.9 Flaws Affecting the Repo-Server and AppProject Controls Argo CD vulnerabilities CVE-2026-77459 AppProject bypass and repo-server command execution flaws fixed in v3.5.4

Argo CD vulnerabilities CVE-2026-77459 AppProject bypass and repo-server command execution flaws fixed in v3.5.4

Argo CD Patches Four Critical CVSS 9.9 Flaws Affecting the Repo-Server and AppProject Controls

Do Son October 7, 2026

TL;DR The Argo CD project has fixed four critical security flaws, each rated 9.9 on CVSS. Three...

Gitea Fixes 27 Security Flaws Across 28.0.0 and 28.1.0, Including SSRF and Account Takeover Bugs Gitea security update 28.0.0 and 28.1.0 fixes SSRF flaw CVE-2026-101027 installer takeover CVE-2026-96404 and SSH key bug CVE-2026-103059

Gitea security update 28.0.0 and 28.1.0 fixes SSRF flaw CVE-2026-101027 installer takeover CVE-2026-96404 and SSH key bug CVE-2026-103059

Gitea Fixes 27 Security Flaws Across 28.0.0 and 28.1.0, Including SSRF and Account Takeover Bugs

Do Son October 7, 2026

TL;DR Gitea has shipped 27 security fixes across versions 28.0.0 and 28.1.0. This Gitea security update closes...

Progress Fixes Critical Command Injection Flaw CVE-2026-91140 in DataDirect AI Model Generator Agents Progress DataDirect vulnerability CVE-2026-91140 command injection in Autonomous REST Connector AI Model Generator agents

Progress DataDirect vulnerability CVE-2026-91140 command injection in Autonomous REST Connector AI Model Generator agents

Progress Fixes Critical Command Injection Flaw CVE-2026-91140 in DataDirect AI Model Generator Agents

Do Son October 6, 2026

TL;DR Progress has fixed CVE-2026-91140, a critical Progress DataDirect vulnerability in its Autonomous REST Connector AI Model...

AI Coding Agents Leak 13,000 Internal Screenshots to Public GitHub Repos AI agent screenshot leak in PixelLeak research showing internal images pushed to public GitHub repos

AI agent screenshot leak in PixelLeak research showing internal images pushed to public GitHub repos

AI Coding Agents Leak 13,000 Internal Screenshots to Public GitHub Repos

Do Son September 30, 2026

More than 13,000 internal screenshots sat in public GitHub repositories, open to anyone. Glow Labs says AI...

Octopus Server Flaw CVE-2026-101169 Allows Code Execution via Insecure Deserialization Octopus Server vulnerability CVE-2026-101169 insecure JSON deserialization enabling code execution in the Octopus Deploy server process

Octopus Server vulnerability CVE-2026-101169 insecure JSON deserialization enabling code execution in the Octopus Deploy server process

Octopus Server Flaw CVE-2026-101169 Allows Code Execution via Insecure Deserialization

Do Son September 29, 2026

TL;DR Octopus Deploy has fixed a high-severity Octopus Server vulnerability, CVE-2026-101169. An authenticated user who can edit...

GitLab Patch Release Fixes 13 Flaws, Including High-Severity XSS Bugs GitLab patch release fixing 13 security flaws including high-severity XSS and CVE-2026-15217 on a dashboard

GitLab patch release fixing 13 security flaws including high-severity XSS and CVE-2026-15217 on a dashboard

GitLab Patch Release Fixes 13 Flaws, Including High-Severity XSS Bugs

Do Son August 12, 2026

TL;DR GitLab shipped a new patch release on August 12, 2026. Versions 19.2.2, 19.1.4, and 19.0.6 fix...

GitLab Patch Release Fixes 13 Security Vulnerabilities GitLab patch release 19.2.1 fixing 13 vulnerabilities including CVE-2026-6267 data exposure flaw

GitLab patch release 19.2.1 fixing 13 vulnerabilities including CVE-2026-6267 data exposure flaw

GitLab Patch Release Fixes 13 Security Vulnerabilities

Do Son July 30, 2026

TL;DR GitLab has shipped a new patch release for self-managed installs. Versions 19.2.1, 19.1.3, and 19.0.5 fix...

CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed Gitea vulnerability CVE-2026-58443 public-only token writing to private repository

Gitea vulnerability CVE-2026-58443 public-only token writing to private repository

CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed

Do Son July 20, 2026

TL;DR A critical Gitea vulnerability, CVE-2026-58443 (CVSS 9.6), lets a public-only token push commits into a private...

GitLab Patch Release Fixes Eight Flaws, Including a High-Severity XSS Bug (CVE-2026-6896) GitLab patch release fixing cross-site scripting vulnerability CVE-2026-6896 in version 19.1.2

GitLab patch release fixing cross-site scripting vulnerability CVE-2026-6896 in version 19.1.2

GitLab Patch Release Fixes Eight Flaws, Including a High-Severity XSS Bug (CVE-2026-6896)

Do Son July 9, 2026

TL;DR This GitLab patch release, shipped on July 8, 2026, covers versions 19.1.2, 19.0.4, and 18.11.7. The...

Fleet security vulnerabilities cross namespace secret disclosure Rancher, GitOps Rancher Fleet Critical Vulnerability CVE-2026-41050

Critical Fleet Security Vulnerabilities Threaten Multi-Tenant Clusters

Do Son June 2, 2026

Cybersecurity researchers recently identified multiple critical Fleet security vulnerabilities within the popular GitOps platform. Specifically, these flaws...

npm dependency confusion attack malicious packages discovered

Massive npm Dependency Confusion Attack Infiltrates Corporate Ecosystems

Do Son May 30, 2026

Microsoft Threat Intelligence researchers recently uncovered an active security breach targeting modern software developer pipelines. Specifically, a...

Keys to the Kingdom: Critical 9.9 CVSS Budibase Flaw Allows Total Tenant Takeover

Do Son May 20, 2026

Budibase, the popular open-source operations platform known for saving engineers hundreds of hours building secure Agents, Apps,...

Critical Portainer Flaws Grant Restricted Users Root Access to the Host Portainer Container Escape CVE-2026-44849 Swarm Bypass

Critical Portainer Flaws Grant Restricted Users Root Access to the Host

Do Son May 19, 2026

A dangerous pair of critical authorization failures within the Portainer container management platform allows standard, restricted users...

Three Critical 9.4 CVSS Flaws Expose n8n Automation Nodes to Full RCE n8n Node RCE Vulnerabilities CVE-2026-44791 Prototype Pollution n8n RCE Vulnerabilities CVE-2026-27497 CVE-2026-25053 n8n RCE Vulnerability CVE-2026-21877 n8n RCE, CVE-2025-68613 n8n Git RCE, core.hooksPath Exploit

n8n Node RCE Vulnerabilities CVE-2026-44791 Prototype Pollution n8n RCE Vulnerabilities CVE-2026-27497 CVE-2026-25053 n8n RCE Vulnerability CVE-2026-21877 n8n RCE, CVE-2025-68613 n8n Git RCE, core.hooksPath Exploit

Three Critical 9.4 CVSS Flaws Expose n8n Automation Nodes to Full RCE

Do Son May 18, 2026

Technical teams using the popular workflow automation platform n8n are facing a high-stakes security advisory after researchers...

Urgent Update: Composer Vulnerability Leaks GitHub Secrets in Plaintext Logs (CVE-2026-45793) CVE-2026-40176, CVE-2026-40261 Composer GitHub Token Leak CVE-2026-45793

CVE-2026-40176, CVE-2026-40261 Composer GitHub Token Leak CVE-2026-45793

Urgent Update: Composer Vulnerability Leaks GitHub Secrets in Plaintext Logs (CVE-2026-45793)

Do Son May 14, 2026

In a critical security alert for the PHP community, Nils Adermann, Co-Creator of Composer, has issued an...

9.6 Severity: Critical “Cline” AI Agent Flaw Allows Stealthy RCE via Your Browser Cline AI Vulnerability Cross-Origin WebSocket Hijacking

9.6 Severity: Critical “Cline” AI Agent Flaw Allows Stealthy RCE via Your Browser

Do Son May 12, 2026

In the rapidly evolving world of AI-assisted development, tools like Cline have become indispensable, living in editors...

Data Destruction and Memory Poisoning: Spring AI Vulnerabilities Threaten LLM Integrity Spring AI Vulnerability LLM Memory Poisoning Spring AI Vulnerability Vector Store Injection

Spring AI Vulnerability LLM Memory Poisoning Spring AI Vulnerability Vector Store Injection

Data Destruction and Memory Poisoning: Spring AI Vulnerabilities Threaten LLM Integrity

Do Son May 11, 2026

Spring AI, a popular framework designed to simplify AI integration for Spring developers, has issued an security...

Let’s Encrypt Slashes Certificate Lifespans and Sunsets mTLS on May 13 Merkle Tree Certificates Let's Encrypt 45-Day Certificates ACME Profile Updates 2026 Let’s Encrypt Generation Y, 45-Day TLS Certificates Let's Encrypt, IP Certificates Certificate Revocation Lists

Let’s Encrypt Slashes Certificate Lifespans and Sunsets mTLS on May 13

Do Son May 9, 2026

Mark your calendars, system administrators and DevSecOps teams: May 13, 2026, is going to be a busy...

Highly Evasive NuGet Supply Chain Attack Hijacks 65,000 .NET Build Servers NuGet Supply Chain Attack .NET Malware

Highly Evasive NuGet Supply Chain Attack Hijacks 65,000 .NET Build Servers

Do Son May 8, 2026

A highly sophisticated software supply chain attack has compromised tens of thousands of developer workstations and CI/CD...