Topic tag

supply chain

7 articles tagged supply chain. Browse the full archive or jump to all posts.

September 27, 2026 · 11 min read

474 GitHub App Keys Still Work: The Inventory Nobody Can Produce

GitGuardian pulled over 500,000 exposed RSA keys out of public sources and found 474 GitHub App private keys that still authenticated, against 440 distinct Apps. Forty-four had organisation admin. The fix is not a rotation sprint, it is the inventory you cannot currently produce.

August 27, 2026 · 10 min read

The Steam avatar that unmasked TeamPCP: what the AFP arrests teach you about identity hygiene

The AFP arrested two alleged TeamPCP members in Western Australia. The forensic thread that got there was a single cat avatar reused across five platforms for a decade. Here is the chain, and the five controls Flare says you should steal.

August 15, 2026 · 13 min read

MCP servers walk off with your SSH key: what to lock down

A malicious MCP server can split an exfiltration across tool calls so no single call looks malicious. Compliance rose from 42% to 82% in the split test.

August 13, 2026 · 17 min read

LiteLLM supply-chain leak: how I checked my own home gateway before the news cycle caught up

A 40-minute poisoned-publish window on PyPI in March turned LiteLLM into the largest AI supply-chain leak of 2026. 195 TB of credentials, 2,500+ orgs, 434,000 CI/CD pipelines. I run LiteLLM at home. Here is the audit I ran this morning, what the Postgres logs actually showed, and the call I made on whether to rotate six provider keys.

August 8, 2026 · 10 min read

TrueConf shipped backdoored installers. How to check your fleet

Attackers breached TrueConf and trojanized its client installers with backdoors. MSPs and SMB IT teams: the fleet check is cheap, the rebuild is not, and the discipline is the part worth keeping.

July 22, 2026 · 22 min read

When Your AI Agent Says It's Done, How Do You Know?

AI agents will tell you the work is done. Whether it actually is - that is the security question every IT lead should be asking in 2026.

May 27, 2026 · 16 min read

CISA Left Its Own Passwords on GitHub for Six Months

CISA left AWS GovCloud keys in a public GitHub repo for six months. Then GitHub got breached. What the May 2026 supply-chain failures mean for you.