Vulnerability Analysis
containerd CRI plugin mount escape (CVE-2022-23648)
CVE-2022-23648 let crafted pod volume specs bypass containerd's CRI mount isolation to reach arbitrary host files — versions, severity, and fixes.
Jan 8, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedRansomware
Costa Rica Conti Ransomware: The First Ransomware Attack to Trigger a National Emergency
The Conti ransomware group attacked Costa Rica's government systems so severely that the president declared a national emergency — the first time a country took such action in response to a cyberattack.
Jan 8, 20265 min read
DeFi Security
Beanstalk Farms Governance Attack: $182 Million Stolen Through a Democratic Vote
Attackers used a flash loan to temporarily gain majority voting power in Beanstalk Farms' governance system, then voted to transfer $182 million to themselves — all within a single blockchain transaction.
Jan 8, 20265 min read
Vulnerability Analysis
Linux AF_PACKET privilege escalation (CVE-2020-14386)
CVE-2020-14386 lets a local attacker with CAP_NET_RAW corrupt Linux kernel heap memory via AF_PACKET and escalate privileges. Here's the fix and impact.
Jan 8, 20268 min read
Incident Response
GitHub OAuth Token Theft: The Heroku and Travis CI Breach
Attackers stole OAuth tokens from Heroku and Travis CI to access private GitHub repositories across dozens of organizations, including npm itself. The full scope of the breach took weeks to unravel.
Jan 8, 20265 min read
Identity Security
Using OCI resource principal authentication to avoid embe...
A concrete guide to OCI resource principal authentication: how it works, how it differs from instance principals, and how to eliminate static API keys from OCI workloads.
Jan 8, 20267 min read
DevSecOps
Temp File Race Conditions in Build Systems: The TOCTOU Problem
Build systems create and process temporary files constantly. Race conditions in temp file handling can be exploited to inject malicious content into builds.
Jan 7, 20265 min read
Supply Chain Security
Azure DevOps Supply Chain Risks: Securing Your Microsoft CI/CD Pipeline
Azure DevOps pipelines present unique supply chain risks from marketplace extensions to service connections. A breakdown of the attack surface and how to harden it.
Jan 7, 20266 min read
Container Security
Container Registry Hardening: The 2022 Baseline
Your container registry is a signing oracle, a software distribution system, and a typosquat target rolled into one. Here is the hardening baseline for 2022.
Jan 7, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.