[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog:all:1":3},{"total":4,"posts":5,"page":53,"per_page":54},6,[6,16,25,32,39,46],{"slug":7,"kind":8,"title":9,"excerpt":10,"cover_image_url":11,"cover_image_alt":12,"author_name":13,"published_at":14,"reading_minutes":15},"gheist-campaign-abuses-stolen-github-tokens-to-dump-private","rapid-alert","Gheist campaign abuses stolen GitHub tokens to dump private repo and cloud secrets via Actions logs","Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgheist-campaign-abuses-stolen-github-tokens-to-dump-private-1032a4f5-cover.png","Gheist rapid alert: Stolen GitHub token, private repo? Every secret in it got printed.","Marcus Lenngren","2026-10-27T05:06:27.466+00:00",3,{"slug":17,"kind":18,"title":19,"excerpt":20,"cover_image_url":21,"cover_image_alt":22,"author_name":13,"published_at":23,"reading_minutes":24},"honeypots-see-attacks-first","analysis","Honeypots see attacks before the patch, but how do companies act on it?","Amazon's decoys are probed within 90 seconds of going online. What deception and honeypots do for the security community, and six small steps that let an ordinary team act on early warnings with the people it has.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1f0002b6-fc7e-49f4-9d6c-fb41c50beb17.png","A decoy server is immediately surrounded by incoming attack probes and attempts on a dark digital background.","2026-10-26T06:27:00+00:00",8,{"slug":26,"kind":8,"title":27,"excerpt":28,"cover_image_url":29,"cover_image_alt":30,"author_name":13,"published_at":31,"reading_minutes":15},"node2shell-node-js-brotli-decoder-rce-cve-2026-111497","Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines","Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-cover.png","Node2Shell rapid alert: Does your service decode Brotli? One crafted stream can run code.","2026-10-23T16:42:51.248+00:00",{"slug":33,"kind":8,"title":34,"excerpt":35,"cover_image_url":36,"cover_image_alt":37,"author_name":13,"published_at":38,"reading_minutes":15},"arista-patches-third-exploited-velocloud-orchestrator-zero","Arista Patches Third Exploited VeloCloud Orchestrator Zero-Day in Four Months (CVE-2026-114625)","CVE-2026-114625 is a critical SQL injection in VeloCloud Orchestrator on-prem, CVSS 9.9, actively exploited. Any authenticated user with the lowest tenant role can become a superuser operator. Patch to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and hunt for abuse now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Farista-patches-third-exploited-velocloud-orchestrator-zero-714429b3-cover.png","VeloCloud VCO rapid alert: Your SD-WAN runs VeloCloud? One low tenant login owns the box.","2026-10-23T15:26:13.908+00:00",{"slug":40,"kind":8,"title":41,"excerpt":42,"cover_image_url":43,"cover_image_alt":44,"author_name":13,"published_at":45,"reading_minutes":15},"php2shell-critical-pre-auth-rce-in-php-core-under-broad","PHP2Shell: Critical Pre-Auth RCE in PHP Core Under Broad Exploitation, Patch Now","Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), allow unauthenticated remote code execution. Exploitation began four days before the 21 Oct patches. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fphp2shell-critical-pre-auth-rce-in-php-core-under-broad-f10ea3b4-cover.png","PHP2Shell rapid alert: Running PHP on the internet? One crafted request and code runs.","2026-10-23T12:58:01.88+00:00",{"slug":47,"kind":8,"title":48,"excerpt":49,"cover_image_url":50,"cover_image_alt":51,"author_name":13,"published_at":52,"reading_minutes":15},"litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker","LiteLLM 1.107.0 supply chain attack: poisoned PyPI and Docker images steal cloud and AI credentials","On 21 Oct, LiteLLM 1.107.0 shipped a credential stealer and backdoor through all seven PyPI wheels and Docker images. The packages were live for about three hours and downloaded over 49,000 times. Just starting Python in an affected environment runs the malware. Clean version: 1.106.2.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flitellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker-ceecec71-cover.png","LiteLLM 1.107.0 rapid alert: Ran LiteLLM 1.107.0 anywhere? Just starting Python leaked your keys.","2026-10-23T12:58:00.867+00:00",1,12]