The Constructor Was the Endpoint: Jenkins Stapler Data Binding
Jenkins configuration forms can become constructor dispatch. Trace the September 2026 flaws, a safe mechanism lab, detection signals, and durable fixes.
-
-
Two Patches, One Hook: Inside Gitea CVE-2026-60004
CVE-2026-60004 turns duplicate Gitea diffpatch requests into an executable Git hook. Analyze the attack chain, detection signals, and containment.
-
An SBOM Is Not an Alarm: Build a VEX Decision Pipeline
CISA’s 2026 SBOM baseline improves software identity and evidence quality. This advanced guide turns that inventory into an auditable VEX pipeline for exploitability decisions, release policy, and detection.
-
CVE-2026-63077: When TeamCity Deserializes Trust
CVE-2026-63077 exposes every TeamCity On-Premises version to unauthenticated RCE through the agent polling protocol. This deep dive maps the trust failure, runs a safe deserialization mechanism lab, and shows how to detect, contain, and validate CI/CD integrity.
-
GitLost: When a Public Issue Can Read a Private Repo
GitLost turned a public GitHub issue into a private-repository disclosure. Trace the confused-deputy chain, reproduce it safely, and harden agentic CI.
-
GhostApproval: When AI Agent Approval Dialogs Lie
GhostApproval turns a harmless-looking AI agent edit into an out-of-workspace write. Learn the symlink mechanics, safe lab reproduction, detection, and race-resistant defenses.
-
HTTP Security Headers: The Small Details Attackers Love You to Ignore
Attackers love neglected basics. This post shows how HTTP security headers and cookie flags such as HttpOnly, Secure, and SameSite shape real defensive posture.
