Always Set persist-credentials: false in actions/checkoutThere's a default in `actions/checkout` that most teams never change — and that quietly leaves a GitHub token sitting in a readable file for every subsequent step in the job. The fix is one line. The 10h ago · 1 min readyadui.hashnode.dev
Stop giving AI agents your production keysOn 15 October 2026, CERT-In issued advisory CIAD-2026-0049, rated critical, titled "AI Agents as Attack Vectors". It describes two kinds of incident, and both come down to how AI agent credentials are10h ago · 2 min readyadui.hashnode.dev
PHP2Shell: a practical patch and check guide for PHP serversPHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619. On October 21, 2026, the PHP project shipped emergency releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, to fix two critical flaws tha10h ago · 1 min readyadui.hashnode.dev
LiteLLM 1.107.0 compromise: incident response guideThe LiteLLM 1.107.0 compromise began on October 21, 2026, when a compromised litellm==1.107.0 was published to PyPI and to LiteLLM's container registries. LiteLLM's incident post states that earlier v10h ago · 2 min readyadui.hashnode.dev