explore | Grilled Cheese

An npm package that never runs at install. It fires inside `BTree.prototype.set` when your code stores key 100.

No install hook, so --ignore-scripts saves nothing. Loader beacons to Slack/Telegram, pulls stage two from an Ethereum contract. ~2M weekly downloads.

#npm #DevSecOps

Fortinet warns CVE-2026-104286 is being exploited against FortiMail. CVSS 9.8, unauthenticated file writes, no fix released yet. Disable IBE or restrict management access.

fortiguard.fortinet.com/FG-IR-26-175

#Fortinet #DevSecOps

📝 「認証情報の墓場」GitHubが化した真因——DevSecOpsの理想と現実の致命的ギャップが招いた54万件流出事件

54万件以上の有効な認証情報がGitHubで放置される事態。その背景にある開発プロセスの構造的欠陥と、セキュリティ文化の歪みを徹底解剖します。

🔗 https://techscope365.com/2993/

#GitHub #認証情報流出 #DevSecOps #AI #テクノロジー

Votre clé API Claude vaut trois fois plus que ce que vous pensez ; et pas dans le bon sens.

blog.gioria.org/fr/ai-securi... #DevSecOps

🚨 CVE monsters have entered the software supply chain. Deploy the Docker Commandos! 🐳

At #BaselOne26, Mohammad-Ali A'râbi shows how SBOMs, BuildKit attestations & Cosign can secure Java container builds – plus a live Spring Boot demo.

🎟️ eventfrog.ch/BaselOne26

#Java #Docker #DevSecOps #BaselOne

Paying $40k/month for an Elasticsearch cluster to hold logs nobody queries? Loki takes the Prometheus approach: index labels, not full text. Here's when it works, when https://www.valtersit.com/guides/monitoring/log-aggregation-with-loki-the-prometheus-approach-to-logs/
#Loki #Grafana #DevSecOps

Your DNS is plaintext. One tap in the colo and every internal name leaks or gets poisoned. A guide to deploying DoH and DoT internally: tradeoffs, certs, migration, hardening. https://www.valtersit.com/guides/networking/deploying-encrypted-dns-internally-doh-and-dot-guide/ #dnssecurity #devsecops

271 lines, beginner level. Scans requirements.txt against known CVEs, outputs JSON, can exit non-zero on high severity for CI. https://www.valtersit.com/python/dependency-vulnerability-scanner-with-pip-audit/ #Python #Security #DevSecOps

Overclocked is the one people quietly repost the second they find it. No https://music.amazon.com/tracks/B0HCW61V2X?marketplaceId=ATVPDKIKX0DER&musicTerritory=US&ref=dm_sh_94UWmn4YNyHj5mTwzCdAUV1Do

Also on other platforms.

#Music #AppleMusic #GitHub #LoFi #MusicVibe #DevSecOps #CyberPunk

Discover critical OpenBao security vulnerabilities that lead to code execution. Learn how to patch these OpenBao security vulnerabilities now.

#OpenBao #Cybersecurity #Vulnerability #SecretsManagement #DevSecOps

✍️ New blog post by Gabriel Koo

Your AWS role can't tell a human from an agent anymore, part 5: putting the four layers together

#aws #security #ai #devsecops

✍️ New blog post by Gabriel Koo

Your AWS role can't tell a human from an agent anymore, part 4: detection — what did the agent actually touch?

#aws #security #ai #devsecops

✍️ New blog post by Gabriel Koo

Your AWS role can't tell a human from an agent anymore, part 3: the SCP backstop

#aws #security #ai #devsecops

✍️ New blog post by Gabriel Koo

Your AWS role can't tell a human from an agent anymore, part 2: label every agent call with a User-Agent tag

#aws #security #ai #devsecops

✍️ New blog post by Gabriel Koo

Your AWS role can't tell a human from an agent anymore, part 1: the threat model and the identity problem

#aws #security #ai #devsecops

SpiderFoot automates OSINT for threat intelligence and attack surface mapping. The value is not one scan. It is repeatable search against a changing external footprint, so drift becomes visible before someone else notices it. Repeatability beats heroic audits. #AttackSurface #DevSecOps

Canada’s #digitaltransformation is accelerating, and secure software delivery is key to keeping pace. Join Carahsoft in Ottawa on 10/14 for the #DevSecOps Conference Canada & hear Government success stories and explore secure software delivery. Sign up: https://carah.io/DevSecOpsConferenceCanada2026