There's a default in `actions/checkout` that most teams never change — and that quietly leaves a GitHub token sitting in a readable file for every subsequent step in the job. The fix is one line. The
On 15 October 2026, CERT-In issued advisory CIAD-2026-0049, rated critical, titled "AI Agents as Attack Vectors". It describes two kinds of incident, and both come down to how AI agent credentials are
PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619. On October 21, 2026, the PHP project shipped emergency releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, to fix two critical flaws tha
The LiteLLM 1.107.0 compromise began on October 21, 2026, when a compromised litellm==1.107.0 was published to PyPI and to LiteLLM's container registries. LiteLLM's incident post states that earlier v