secrets – Page 8 – Experimental News Clipping Site

Schneier on Security: Critical GitHub Attack

Mar 20, 2025

—

by

Source URL: https://www.schneier.com/blog/archives/2025/03/critical-github-attack.html Source: Schneier on Security Title: Critical GitHub Attack Feedly Summary: This is serious: A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used “tj-actions/changed-files” utility, is now believed to have originated from an…

Simon Willison’s Weblog: Not all AI-assisted programming is vibe coding, but vibe coding rocks

Mar 19, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://simonwillison.net/2025/Mar/19/vibe-coding/#atom-everything Source: Simon Willison’s Weblog Title: Not all AI-assisted programming is vibe coding, but vibe coding rocks Feedly Summary: Vibe coding is having a moment. The term was coined by Andrej Karpathy just a few weeks ago (on February 6th) and has since been featured in the New York Times, Ars Technica, the…

Unit 42: Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files

Mar 18, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ Source: Unit 42 Title: Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files Feedly Summary: A compromise of the GitHub action tj-actions/changed-files highlights how attackers could exploit vulnerabilities in third-party actions to compromise supply chains. The post Threat Assessment: GitHub Actions Supply Chain Attack: The Compromise of tj-actions/changed-files appeared first…

Alerts: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066

Mar 18, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 Source: Alerts Title: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066 Feedly Summary: A popular third-party GitHub Action, tj-actions/changed-files (tracked as CVE-2025-30066), was compromised. This GitHub Action is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets including,…

The Register: Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos

Mar 18, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.theregister.com/2025/03/18/wiz_github_supply_chain/ Source: The Register Title: Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos Feedly Summary: Ad giant’s cloudy arm to pay $30B in security shop deal Wiz security researchers think they’ve found the root cause of the GitHub supply chain attack that unfolded over the weekend, and…

Bulletins: Vulnerability Summary for the Week of March 10, 2025

Mar 17, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.cisa.gov/news-events/bulletins/sb25-076 Source: Bulletins Title: Vulnerability Summary for the Week of March 10, 2025 Feedly Summary: High Vulnerabilities PrimaryVendor — Product Description Published CVSS Score Source Info 1E–1E Client Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged…

Hacker News: Configure Azure Entra ID as IdP on Keycloak

Mar 17, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://blog.ght1pc9kc.fr/en/2023/configure-azure-entra-id-as-idp-on-keycloak/ Source: Hacker News Title: Configure Azure Entra ID as IdP on Keycloak Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text provides a comprehensive guide for configuring Azure Entra ID as an Identity Provider on Keycloak, aimed at enhancing authentication protocols within a Spring Boot WebFlux application. This guide is…

The Register: GitHub supply chain attack spills secrets from 23,000 projects

Mar 17, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.theregister.com/2025/03/17/supply_chain_attack_github/ Source: The Register Title: GitHub supply chain attack spills secrets from 23,000 projects Feedly Summary: Large organizations among those cleaning up the mess It’s not such a happy Monday for defenders wiping the sleep from their eyes only to deal with the latest supply chain attack.… AI Summary and Description: Yes **Summary:**…

Enterprise AI Trends: Prompts Are the New IP—How Prompts Are Quietly Eating All Your "Business Logic"

Mar 15, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://nextword.substack.com/p/prompts-are-the-new-iphow-prompts Source: Enterprise AI Trends Title: Prompts Are the New IP—How Prompts Are Quietly Eating All Your "Business Logic" Feedly Summary: “Business logic" of most apps are getting absorbed into prompts. They are becoming mission critical assets. AI Summary and Description: Yes Summary: The text discusses the growing significance of AI prompts as…

Hacker News: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

Mar 15, 2025

—

by

Kurt Seifried

in Uncategorized

Source URL: https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised Source: Hacker News Title: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos Feedly Summary: Comments AI Summary and Description: Yes Summary: A critical security incident has been identified involving the tj-actions/changed-files GitHub Action, which has been compromised to leak sensitive CI/CD secrets. This incident underscores the urgency for security and…

Tag: secrets