Apr 15 · 12 min read · Adding cosign sign to a CI pipeline and calling it "signed releases" is a bit like putting a lock on a glass door. The lock works. The glass does not. Signing the image proves a specific digest was si
Join discussion
Apr 4 · 5 min read · Why this matters Software supply chain attacks are landing one after another. Recent incidents involving Trivy, Checkmarx KICS, LiteLLM, Telnyx, and now Axios show the same pattern: compromise trusted
Join discussion
Apr 3 · 40 min read · TL;DR — Read This First On March 19, 2026 at approximately 17:43 UTC, threat actor group TeamPCP silently redirected trivy-action@0.34.2 — a real, trusted release already running in thousands of CI/CD
CCorrelic commented
Mar 31 · 3 min read · The Log4Shell vulnerability sent shockwaves through the tech world, exposing critical weaknesses in our software supply chains. But was it just a harbinger of what's to come, and are we truly prepared
Join discussion
Mar 5 · 3 min read · The Silent Threat to Software Integrity Most modern DevOps pipelines rely on RSA or ECDSA to sign binaries, Docker images, and commits. While these are secure against classical computers, a cryptograp
Join discussion
Feb 5 · 8 min read · I ran ls ~/.claude/skills/ the other day and found SKILL.md files I don't remember installing. Probably grabbed them from some GitHub link in a Discord thread months ago at like 2am. Opened one up, it was fine, just boring config stuff. But it could ...
Join discussion
Dec 26, 2025 · 12 min read · Author:CyberDudeBivashPowered by:CyberDudeBivash Brand |cyberdudebivash.comRelated:cyberbivash.blogspot.com Daily Threat Intel by CyberDudeBivashZero-days, exploit breakdowns, IOCs, detection rules & mitigation playbooks.Follow on LinkedInApps & Sec...
Join discussionNov 29, 2025 · 3 min read · For decades, the JavaScript ecosystem has been a welcoming, innovative space where anyone can publish and share code. It's been beautiful. It's democratized software development. But it's also been a security nightmare. We've Been Here Before Remembe...
Join discussion
