Cyber Security
How a Fake Interview Led to the $6.3 Billion Binance Hack
Learn how a fake job interview, malware, stolen access, and wallet authorization abuse contributed to the $6.3 billion Binance hack.
Loading
Detecting Supply Chain Attacks in AI Coding Tool Extensions
Learn how to identify and reduce supply chain risks in AI coding extensions through inventories, dependency reviews, SBOMs, controlled updates, and runtime monitoring.
Detecting Prompt Injection in Documents Used by RAG Applications
Learn how prompt injection affects RAG applications and how to detect suspicious document content, separate trust boundaries, and reduce risks from retrieved data.
GitHub Webhook IP Changes: Keeping Firewall Rules Up to Date
Learn how to retrieve GitHub webhook IP ranges, safely update firewall allowlists, automate validation, and troubleshoot blocked webhook deliveries.
Upwind’s $400M Series C: A Beginner’s Guide to Runtime Cloud and AI Security
Learn what Upwind’s $400M Series C means, how runtime cloud security works, and why AI workloads change security priorities for teams.
Why AI-Agentic Penetration Testing May Be Preferred Over Breach and Attack Simulation in 2027
Compare breach and attack simulation with AI-agentic penetration testing, including their strengths, limitations, guardrails and roles in continuous security validation.
Breach and Attack Simulation vs. Security Control Validation vs. Agentic AI Penetration Testing
Compares breach and attack simulation, security control validation, and agentic AI penetration testing, explaining the questions each approach answers and how they complement one another.
GitHub Package Firewall: How to Control Which Dependencies Your Team Can Install
Learn how to control package dependencies in GitHub using dependency review, Dependabot, registry permissions, repository rules, and CI/CD policy checks.
How to Check Whether a Git Repository Contains Secrets Before a Release
Learn how to detect exposed secrets in Git files and commit history, automate secret scanning in CI/CD, and respond safely to leaked credentials.
How to Use the GitHub Dependabot Alerts API to Find Affected Package Versions
Learn how to retrieve GitHub Dependabot alerts with the REST API, interpret vulnerable version ranges, identify patched versions, and review dependency security risks.
OpenSSH 10.6 Adds Post-Quantum Signatures: What Server Admins Need to Know
Learn how OpenSSH 10.6 hybrid ML-DSA-44 and Ed25519 signatures affect SSH authentication, compatibility checks, test keys, and server rollout planning.
Chrome Connection Allowlists Give Web Apps More Control Over Network Access
Learn how Chrome Connection Allowlists use the Connection-Allowlist HTTP header to restrict network destinations and strengthen web application security.
GitHub Makes It Easier to Find Withdrawn Dependabot Alerts
Learn how GitHub’s withdrawn Dependabot alerts work, including the new webhook action and HTTP 410 API response for keeping security integrations accurate.
GitHub Updates GitHub App Permissions for Least-Privilege Access
Learn about GitHub App permission updates for least-privilege access, including repository creation, installation management, refresh tokens, and credential controls.
CodeQL 2.27.2 Brings Analysis Updates for C++, Go, Rust, and JavaScript
Learn how CodeQL 2.27.2 affects security analysis for C++, Go, Rust, and JavaScript, and how to validate updates in GitHub code-scanning workflows.
GitHub Now Tracks Who Pushed a Commit, Not Just Who Authored It
Learn how GitHub push attribution distinguishes commit authors, committers, and pushers to help teams investigate repository changes and improve audit trails.
GitHub Adds a Model for Detecting Leaked Secrets
Explains how GitHub's AI-based secret detection complements pattern scanning, reduces false positives, and guides developers in validating, revoking, and rotating exposed credentials.
GitHub AI Scan Status Is Now Visible in Security Overview
Learn how GitHub Security Overview exposes AI-powered scan status so security teams can monitor scan execution, failures, coverage, and results across repositories.
GitHub Lets Teams Add Private Comments to Security Advisories
Learn how GitHub private comments in security advisories help teams investigate vulnerabilities, coordinate remediation, and keep internal security details out of public disclosures.
GitHub AI Scan Status Is Now Visible in Security Overview
Learn how GitHub Security Overview displays effective AI Scan status across repositories, supports filtering and CSV exports, and helps teams identify gaps in pull request security coverage.
GitHub Enterprise Cloud Ends Support for X25519-Only TLS Connections
Learn why GitHub Enterprise Cloud no longer accepts X25519-only TLS clients and how to diagnose HTTPS failures by enabling compatible P-256 or P-384 key-agreement groups.
GitHub Adds More CVE Data to the Security Advisory API
Learn how GitHub's Security Advisory API exposes CVE and dependency vulnerability data for automated security workflows, with a C# API client example.
GitHub Code Scanning Now Skips Inactive Repositories
Learn how GitHub code scanning can skip inactive repositories, the resource benefits, and the security controls teams need for inactive but still deployed code.
GitHub App Tokens Are Getting Longer: What Should Developers Check?
Learn how to prepare applications for longer GitHub App tokens by removing format assumptions and reviewing credential storage, validation, logging, and transmission.
GitHub Private Vulnerability Reports: How Structured Reports Make Security Triage Easier
Learn how GitHub Private Vulnerability Reporting supports structured security reports, faster triage, safe disclosure, and effective vulnerability remediation.
GitHub X25519 TLS Change: What Developers Need to Fix Before October 7
Learn how GitHub’s X25519-only TLS restriction change affects HTTPS clients and how to enable P-256 compatibility before October 7, 2026.
GitHub Advanced Security Trials: What Teams Can Test Before Enabling GHAS
Introduction Security tooling is easier to evaluate when developers can test it against real repositories instead of judging it from feature lists. GitHub Advanced Security, commonly called GHAS, brings several application security capabilities into the GitHub development workflow. These include cod
How Developer Credentials Can Turn a Package Install Into a Cloud Security Risk
Learn how malicious package installation scripts can access developer credentials and become a path to cloud compromise, and how least privilege and credential isolation reduce the risk.
How to Use Smaller Token Scopes for Dependabot Alerts in GitHub Actions
Learn how to reduce GitHub Actions token permissions for Dependabot workflows using least privilege, job-level scopes, security boundaries, and troubleshooting.
How Long Should You Keep Closed Dependabot Alerts?
Learn how long closed Dependabot alerts should be retained, what security data to preserve, and how teams can build a practical vulnerability retention strategy.
