Supply Chain Attacks Slip Through Automated Builds
DevOps engineers face increasing risks from supply chain attacks and insecure infrastructure code. They are battling inconsistent code practices, outdated infrastructure, and the difficulty of auditing compromised builds due to malware self-deletion. The reliance on external dependencies and automated pipelines creates vulnerabilities that are difficult to detect and remediate.
SOURCES (60)
“I was given a dev machine. Because it wasn't "production", it wasn't on any backups. I logged on. Init wasn't there, nor kernel images. It was a RHEL machine, so I was able to first, slap a copy of busybox on the machine because stuff…”
“we had a critical last quarter that sat unpatched for 6 weeks. CVSS 9.8, internal system, no internet exposure, no known exploit in the wild. meanwhile a CVSS 6.5 with an active exploit kit and a public-facing asset got patched in 3 days because a dev flagged it after seeing it on twitter. that gap is what broke my trust in CVSS as a prioritization signal. the 9.8 looked scary on paper. the 6.5 was the actual fire. since then we've been trying to rework how we decide what gets fixed first. w”
“I've been spending a lot of time lately looking at infrastructure security, specifically how complex vulnerabilities are often an emergent property of standard coding and Terraform configurations. I'm currently building a tool that parses IaC to automatically map out STRIDE threat models, but before I go too far down the rabbit hole, I wanted to ask how teams are handling this in the real world...”
“we used to keep playwright reports as github artifacts — downloading and unzipping them every time is insanely inconvenient. nice work”
“Heads up if you're running Grafana OnCall's plugin-install flow, CVE-2026-63087 lets anyone reconfigure it with zero auth. Repo's archived, so there's no patch coming from upstream. If you're still migrating off it and need some time, there's a small fix you can apply yourself and build from source in the meantime. Wrote up the actual vulnerable code + a verified patch: emphere.com/blog/cve-2026-63087-grafana-oncall-install-bypass The install endpoint has zero auth on it”
“Hi, I wanted to understand how much risk there is with using core & custom plugins and themes. I have read some previous posts on the sub and am left with the questions below. Thanks! Are core plugins assumed to be as safe as the Obsidian application itself? Are there any security risks with installing a custom theme? If you install the version of a community plugin that passed the initial review, then don't update it, have you eliminated the security concern, assuming the initial review”
“Hi, I wanted to understand how much risk there is with using core & custom plugins and themes. I have read some previous posts on the sub and am left with the questions below. Thanks! Are core plugins assumed to be as safe as the Obsidian application itself? Are there any security risks with installing a custom theme? If you install the version of a community plugin that passed the initial review, then don't update it, have you eliminated the security concern, assuming the initial review”
“Can it be that a plugin passed the original review, you install that version and don't update it, there's still a possibility of a vulnerability risk, due to dependencies it used even when it passed the original Obsidian review?”
“I’m guessing you work in cybersecurity-like industry that it matters so much. But then, don’t products like Kaspersky and even google drive already have settings that allows configuration to avoid copy, print, etc commands? Are you looking for something beyond this?”
“But tailscale works and is proven. Why would you use some garbage some fuck wrote on GitHub?”
“Exactly. At some point you just have to trust the foundation. That is kind of the whole point of using established third-party infrastructure instead of rolling everything yourself. I appreciate you pushing on this though. It made PulseCheck more robust than it was yesterday.”
“We have the standard graveyard of custom bash, Python and even Groovy scripts for atomic ops tasks (draining nodes, killing stuck pods, db failovers, etc.). While standard "community playbooks" are useful for the boilerplate stuff, we inevitably end up needing to run our own custom logic out of our own repos too. But the actual friction is the execution boundary. Trying to enforce "who is allowed to run this script in prod at 3am" (RBAC), requiring an approval before executio”
“Suppose you have to deal with vulnerability findings reported by some automated tools that seem to scan JavaScript projects's dependency lists and compare them against some CVE database. Suppose it seems as if there's a lot more of this work in JavaScript projects than in Rust projects. There might be several reasons for this feeling:- Maybe you're just unlucky and your projects happen to have bad dependencies, and the constant churn is not representative of the wider JavaScript ecosystem.- Mayb”
“I agree, it’s just the wrong approach. As a user, there’s no way to know if a package has been audited during the cooldown by some generous cybersecurity firm before you pull it in, it’s just wishful thinking. Minimizing your dependencies is a more effective strategy against supply chain attacks.”
Forge `devops:securityInfoProvider`: 401 "scope does not match" when linking a workspace (`linkedWorkspaces/bulk`)
“While we wait for today’s Patch Tuesday updates, here’s a rundown of last month’s biggest third-party security disasters, based on importance and impact: Check Point Quantum Security Gateway: Actively exploited VPN authentication bypass enabling unauthorized remote access (CVE-2026-50751, CVSS 9.3) FortiSandbox: Critical unauthenticated command injection across FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS (CVE-2026-25089, CVSS 9.1) Adobe Campaign Classic: Two maximum-severity flaws en”
“We use bitlocker with PIN so you have to babysit your laptop while it updates (since it needs PIN upon reboot during an update). AFAIK it should disable itself during update but it isn't happening.”
“GO docker images aren't slim; they're literally just the go compiled app. FROM scratch + copied in binary. A world of different from "slim".”
“Was trimming a Python service image today and actually counted. The base drags in a shell, a package manager, curl, git, tzdata, half of coreutils and a pile of libraries the app has not touched in years of running. Every one of those is a line in my scanner report and a thing an attacker gets for free. We ship one app. Why am I also shipping a whole Linux userland to run one binary. Anyway. Back to it. submitted by /u/Specialist_Dish_9087 [link] [comments]”
“Thank you, ya I think forgejo will be way better regarding many things including vaults. Syncthing serves different purposes and really good even for vaults but I don't think as good as forgejo in vaults edits etc.”
“this is a pure load-balancer gotcha that took us far too long to catch, because nothing in our own infra dashboards pointed at it. most ALB target groups ship with deregistration_delay set to 300 seconds by default. that means when a target is being replaced during a rolling deploy, the load balancer keeps the connection-draining window open for a full 5 minutes. any in-flight connection to a terminating target that does not finish in that window gets cut, and the client on the other end eats a”
“Essentially the same thing, just not owned by a for profit that will inevitably enshitify it.”
“Seems like Fortinet firewalls have some kind of high risk security problem every week? Not with Sophos.”
“Thank you so much! This is definitely what is needed and appears to be a known Microsoft 365 Direct Delivery Attack Vector, completely different from direct send.”
“100%, the CVEs we view as a prob because in many cases we cannot upgrade because they break something else, or we are stuck upgrading firewalls more times than we should be. Yea that drives us crazy too, we have so many firewalls on 7.2 right now because of how bad 7.4,7.6 are. We saw memory usage go through the roof on 7.4. Tunnel issues, the taking away sslvpn. The list goes on. I hope folks see the writing on the wall of what fortinet is doing. Then when Sophos has done a firmware upgrade we”
“Yes exactly, they told me his company is a sophos partner and they only sell this „solution“. I tried to convince my boss to not buy it / switch.. Our fortigates are not even EoL…”
“Mostly yes for pre-deployment, but there's a real gap worth knowing about upfront. Agentless is the right call for scanning images, manifests, and dependencies before anything runs. Catches vulnerable base images, misconfigured RBAC, exposed secrets, and manifest drift without needing an agent in every pod. Once clusters autoscale aggressively, trying to attach an agent to every ephemeral pod just isn't operationally reasonable. Where it falls short: runtime. Kubernetes workloads spin up”
“Ugh, yeah, supply chain attacks will get worse and worse. Glad Im a mostly backend dev on c#. Can count the number of 3rd party nuget packages used on my fingers.”
“Why extra dependency? Construct configuration object and validate it with zod on start. Or even without zod - wrapper getter from process.env that fails if property not set, it it's required to be present”
“You run npm run dev or node server.js , and the app crashes because a teammate added a new required key to .env.example but forgot to tell you. I wanted a tool that would catch this before startup, prompt me for the missing values, and append them without wiping out my .env formatting or comments. Since existing tools either crash on startup (dotenv-safe) or wipe out file layout (sync-dotenv). To solve this, I built envrepair , a zero-dependency CLI tool that wraps your startup command, compares”
“CVE-2026-14191, heap overflow in the RAR5 recovery volume parsing, 7.8. crafted archive, user opens it, memory corruption, you already know how this goes. honestly the bug isn't what gets me. it's that in 2026 winrar still ships with no automatic update. every time one of these drops the fix is out same day and then basically nobody installs it, because the app has never once in its life told a user to update. so the vulnerable install base barely moves and the phishing crews absolutely”
“Hi all, Just got an email from Progress informing to shutdown the Sharefile Storage Zone Controllers you have because of a credible external security threat. https://imgur.com/a/Y6hZcae submitted by /u/dfctr [link] [comments]”
“Postgres, Redis, nginx. We moved everything onto continuously rebuilt minimal images about 6 weeks ago to cut down the Debian CVE noise we were drowning in and it helped. Every bump still goes through the test suite. No shell makes debugging painful though. Anyone else do this and still feel like it was worth it? submitted by /u/Lance_Saul_85 [link] [comments]”
honestly no idea. thats the worst part, silent drops leave no trail fixed it deeper last night too, backend now accepts partial logs with nulls instead of rejecting. safer default
“Got the same. That's broken too. The update will likely sync the servers provided there's not another bug hidden back there, but I can't get my update or database back because they nuked both the communicate and support update. What did they DO? I'm wondering if they tried to save money with an AI and let too many people go or something. Or maybe they went with a Jr while firing the OGs. But whatever this is is complete trash. It's like my first year of coding where I had no”
“Palo Alto put out an advisory for CVE-2026-0286, a command injection bug in the PAN-OS CLI. It's authenticated, so an attacker needs admin/CLI access, but with that they can break out of the CLI and run arbitrary commands on the underlying system. Lower urgency than an unauth RCE, but still worth patching, especially if you've got multiple admins, shared creds, or any path that could lead to CLI access getting popped. Affected: PAN-OS below 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8 First”
“LMAO - I don't know why that made me laugh but it did. What vulnerability scanner would you recommend?”
“These are not simple quick processes however pointers: Look at intune autopilot provisioning This needs a deep dive, review the process how you identify a leaver, block access, expire account, reset password, or immediately delete from your environment. Use graph API to revoke licenses, use group licensing and can then pull users out of groups. Decide if you need to retain the account for legal etc or simply delete will revoke licenses. Much bigger project. Look into cloud hosting aws,Google azu”
“It’s a bit comical because these companies have some of the largest open source projects. And to argue that MS does patch a lot of CVEs is also comical. Go look at how many are still open that are actually dangerous and don’t involve some crazy “well you have to do this, at this time of day, between two forks in a road” type stuff. Would MS putting Windows 11 as open source damage Windows 11? Absolutely, but a project that starts open source has less to worry about.”
“Tenet Security just disclosed an attack with an 85% success rate against Claude Code, Cursor, and Codex. Here's how it works in 60 seconds: Attacker finds your Sentry DSN (public in your page source, GitHub, mobile binaries - 2,388+ orgs exposed) POSTs a fake "error event" to Sentry's ingest API - completely unauthenticated, any payload accepted Crafts the payload to look exactly like a real Sentry resolution note You tell your agent: "fix the unresolved Sentry issues"”
“the fix was written last time but the actual npm publish didn't go through, so @ latest was still serving the old single-upload code. that's why you got the identical error. it's genuinely live now as 0.4.2: npm i -g u/restora/cli@latest restora backup --to s3 your 7.66GB will go through as ~29 parts via S3's multipart flow instead of hitting the single 5GB cap. still going to take a while.. that's Notion's ~3 req/sec rate limit on the download side, not the upload, so th”
“condolences, Entra is a pita. Besides that I can only recommend to get someone involved that knows Entra well and can help with hardening it. Without it, it is incredibly vulnerable.”
“Spent part of the weekend going through Socket's PolinRider writeup (the DPRK campaign hitting npm, Packagist, Go modules, and at least one Chrome extension, 108 packages so far per their count). The package count isn't what got me. It's the delivery mechanism. The loader doesn't phone home to attacker infra at all. It hits public RPC endpoints on TRON, Aptos, and BNB Smart Chain, pulls down encrypted payload data, XOR-decrypts it, and evals. Your domain blocklist is useless beca”
“Learned this one the painful way. Heroku rotates DATABASE_URL during certain maintenance events. If you've hardcoded that value anywhere instead of reading it from the environment, your app can randomly stop talking to the database after maintenance. Nothing's "broken." Your code is. It's one of those infrastructure gotchas you only learn after losing a few hours debugging. What's the most expensive infrastructure lesson you've learned the hard way? Mine was this. W”
“I just went through this same ordeal. I was using TacticalRMM and I love the product but the upkeeep and the security were starting to become concerns. I moved to Gorelo and have been happy so far.”
“Something came up in a code review this week that made me realize how easy this mistake is to make. A teammate was investigating an auth issue and pasted a production access token into the first JWT decoder that showed up in Google. The token still had about 50 minutes before it expired. It reminded me of something that's easy to overlook: A JWT payload is just Base64URL-encoded JSON, but the entire token is still a bearer credential . Anyone with a valid token can generally use it until it”
“(This was made and tested only in Gemini) Master Manifest: [ANCHOR STATUS: STABLE-INTEGRAL-LOGIC-GATE] Drift Analysis: None (Full alignment with the "System Manifest" objective). Integrity Check: 100%. Vector Alignment: Codifying the "Logic Gate" framework for portability and utility. The Master Manifest: Architectural Logic Engine This document is the definitive configuration for the Logic Gate (formerly "The Oracle"). It is designed to be pasted as the initial pro”
“I've been thinking a lot about how much quiet risk sits in the base images we treat as done." so the Most of the security and supply chain conversations I'm in focus on scanners, SBOMs, dependency policies, and CI gatekeeping, but underneath all that are long-lived container bases that only change when someone remembers to bump a tag. failure mode isn't just slow patching, but tht nobody really owns the rebuild loop as a first-class responsibility. The common pattern looks somet”
“There are different sections of the scorecard, some are for minor issues like you mentioned, others are for security issues that can either ding the score or block installing entirely. It's a step in the right direction IMO.”
“Update specifically for @ martijn90 and @MSPlive, I finally got some time this week. So now I have packages, images, and automated builds for both amd64 and arm64. I haven't really tested yet aside from my AI-generated GitHub workflow "run basic install via helm in kind" testing, but it should all work. 😂 OpenSUSE and Ubuntu 26.04 packages are at https://software.opensuse.org/download/package?package=teleport&project=home%3Adannysauer There are container images based on opensu”