FEATURED REPORT
新たなGitHub Actionのサプライチェーン攻撃: reviewdog/action-setup
tj-actions/changed-files に対するサプライチェーン攻撃により、多くのリポジトリが週末に機密情報を漏えいしました。Wiz Research は、reviewdog/actions-setup@v1 に対する追加のサプライチェーン攻撃を発見しており、これが tj-actions/changed-files の侵害に寄与した可能性があります。
Category index
Cyber Security
3862 articles
3862 ARTICLES
CYBERSECURITY
Reconstructing the TJ Actions Changed Files GitHub Actions Compromise
A critical security exploit in the popular GitHub Action changed-files (tj-actions/changed-files) exposed encrypted secrets in plaintext within GitHub Action logs. This vulnerability, affecting over 23,000 repositories, was enabled by orphaned commits and manipulated release tags. Learn how to protect your GitHub workflows from similar exploits.
1 MIN READ
arrow_forward
CYBERSECURITY
An Ode to Defense in Depth
Chainguard’s defense in depth approach to security helped protect it from the recent tj-actions/changed-files GitHub repository compromise. Learn more about how.
1 MIN READ
arrow_forward
CYBERSECURITY
GitHub Action tj-actions/changed-files supply chain attack: everything you need to know
A supply chain attack on popular GitHub Action tj-actions/changed-files caused many repositories to leak their secrets. Discover how it unfolded and the steps to mitigate the risk.
1 MIN READ
arrow_forward
CYBERSECURITY
AI Risk Management: Benefits, Challenges, and Best Practices
Learn how to manage AI risks effectively with best practices, frameworks, and strategies to ensure secure AI adoption while mitigating vulnerabilities.
1 MIN READ
arrow_forward
CYBERSECURITY
Responding and remediating: Best practices for handling security alerts
Discover best practices for responding to security alerts and remediating vulnerabilities early, reducing security toil, and improving DevSecOps efficiency.
1 MIN READ
arrow_forward
CYBERSECURITY
What to Expect at Chainguard Assemble 2025
Chainguard Assemble 2025 will take place in San Francisco on March 25. Take a deep dive into all the topics that sessions at the event will cover.
1 MIN READ
arrow_forward
CYBERSECURITY
Enhancing CA Practices: Key Updates in Mozilla Root Store Policy, v3.0
Mozilla remains committed to fostering a secure, agile, and transparent Web PKI ecosystem. The new Mozilla Root Store Policy (MRSP) v3.0, effective March 15, 2025, introduces critical updates to strengthen … Read more The post Enhancing CA Practices: Key Updates in Mozilla Root Store Policy, v3.0 appeared first on Mozilla Security Blog.
1 MIN READ
arrow_forward
CYBERSECURITY
Snyk and ServiceNow: Streamlining Vulnerability Management with ServiceNow VR Assignment Rules
Learn how to optimize vulnerability management with ServiceNow Vulnerability Assignment rules and Snyk’s AppVR integration. Automate workflows, improve security visibility and reduce risks. Explore real-world examples and enhance your application security strategy.
1 MIN READ
arrow_forward
CYBERSECURITY
Snyk Helps Secure the Golang Bento Project
Discover how Snyk helps secure the open source Golang project Bento by contributing vulnerability fixes and leveraging AI-powered tools. Learn about our efforts to enhance Bento’s security and support open source maintainers through the Snyk Secure Developer Program.
1 MIN READ
arrow_forward
CYBERSECURITY
AI Code Generation: Code Security & Quality, Benefits, Risks & Top Tools
AI code generation accelerates development, enhances productivity, and reduces coding fatigue. However, it also introduces security risks and challenges. Learn how AI-powered coding works, its benefits and limitations, and how to secure AI-generated code using Snyk’s security tools.
1 MIN READ
arrow_forward
CYBERSECURITY
DevSecOps Automation Framework
Learn about the principles of DevSecOps automation, how to implement a DevSecOps automation strategy, & the best DevSecOps tools.
1 MIN READ
arrow_forward