Sebastion
←All topics

security

53 pieces of writing

security11 min read

Gitea CVE-2026-20896, Auth.js GHSA-7rqj-j65f-68wh and Anritsu CVE-2026-3356 show pre-operation authentication checks failing in 2026

Gitea, Auth.js and Anritsu show the same access-control design failure: trust is established before the operation, then later code consumes authority that was never proven at the point of use.

OpenAI's Hugging Face incident was not an AI escape story. It was a sandbox failure.
security12 min read

OpenAI's Hugging Face incident was not an AI escape story. It was a sandbox failure.

security13 min read

CVE-2026-21440 and AI file tools show path traversal is an architectural antipattern

security10 min read

Trivy turned a security scanner into a credential stealer

The Trivy compromise showed why CI/CD security tools are high-value supply chain targets: they run where secrets, tokens and publishing credentials already live.

security12 min read

Pre-operation access checks failed across 75 trust-boundary incidents analysed in arXiv:2607.01711

security12 min read

AI agents turned poisoned repositories and obfuscated code into supply-chain execution paths

security13 min read

Amazon Q, Claude Code and MCP made repository text a supply-chain attack surface

AI-assisted development tools changed the supply-chain boundary: repository text, hidden prompts and tool descriptions can now steer agents toward code execution, secret theft and data exfiltration.

security13 min read

OpenClaw's 470 advisories show unauthenticated RCE became a cloud AI platform pattern

security13 min read

Authentication bypass in 2026: access validation keeps failing before critical operations

security13 min read

PCPJack, polyfill CDN and Bright Data SDK show supply chain attacks moving into runtime weaponisation

Supply chain compromise is shifting from static package poisoning towards runtime weaponisation, where trusted code becomes a credential harvester, traffic broker or covert infrastructure node after deployment.

security13 min read

CIFSwitch CVE-2026-46243 and PraisonAI show privilege escalation is an architectural antipattern

security12 min read

Gogs, PraisonAI and KnowledgeDeliver show authentication bypass is a self-hosted platform design failure

MCP OAuth token persistence turns AI orchestration into a supply-chain trust boundary
security13 min read

MCP OAuth token persistence turns AI orchestration into a supply-chain trust boundary

MCP-based AI orchestration moves OAuth tokens, access grants and memory persistence into the same execution path. Credential handling is now the weakest link in the AI supply chain.

security13 min read

May 2026 developer-tooling compromises: VS Code extensions, PyPI packages and GitHub Actions turned workstations into supply-chain targets

GitHub Actions OIDC and TanStack show why 2026 supply chain attacks target release authority
security11 min read

GitHub Actions OIDC and TanStack show why 2026 supply chain attacks target release authority