supply-chain

43 pieces of writing

Hermes Agent's worktree feature copied arbitrary files from your filesystem

Hermes Agent's worktree feature would copy arbitrary files from your filesystem if you cloned a repository with a crafted .worktreeinclude. A two-line path traversal that took four months to land in the codebase.

19 March 2026

security12 min read

MCP gave AI tools a standard interface. Researchers found it was also an attack surface.

10 February 2026

security8 min read

UNC5221 stole F5 source code and its customer list

20 October 2025

security7 min read

Basic ransomware hit one airport software vendor and grounded five European airports overnight

A piece of ransomware described as 'incredibly basic' hit a single software platform and grounded five European airports overnight. The problem wasn't the malware - it was the architecture.

25 September 2025

security6 min read

When a GitHub Action rewrites its own history

17 March 2025

Weekly digests

supply-chain

Hermes Agent's worktree feature copied arbitrary files from your filesystem

MCP gave AI tools a standard interface. Researchers found it was also an attack surface.

UNC5221 stole F5 source code and its customer list

Basic ransomware hit one airport software vendor and grounded five European airports overnight

When a GitHub Action rewrites its own history

Weekly threat intelligence digest — 2026-W30

Weekly threat intelligence digest — 2026-W29

Weekly threat intelligence digest — 2026-W26

Weekly threat intelligence digest — 2026-W23

Weekly threat intelligence digest — 2026-W21

Weekly threat intelligence digest — 2026-W20

Weekly threat intelligence digest — 2026-W19

Weekly threat intelligence digest — 2026-W17

Weekly threat intelligence digest — 2026-W16

Weekly threat intelligence digest — 2026-W15

Weekly threat intelligence digest — 2026-W14

Weekly threat intelligence digest — 2026-W13

Weekly threat intelligence digest — 2026-W12

Weekly threat intelligence digest — 2026-W11

Weekly threat intelligence digest — 2026-W10

Weekly threat intelligence digest — 2026-W09

Weekly threat intelligence digest — 2025-W34

Weekly threat intelligence digest — 2025-W18

Weekly threat intelligence digest — 2025-W17

Weekly threat intelligence digest — 2025-W16

Weekly threat intelligence digest — 2025-W11

Weekly threat intelligence digest — 2025-W04

Weekly threat intelligence digest — 2025-W03