supply-chain

2 articles · newest first

Close-up of a developer's hands typing code on a laptop keyboard

a single request, no login, no clicks — and your public GitLab repo is gone

GitLab's emergency patch fixes a code-injection bug that let an unauthenticated attacker delete repositories, forge merge records, or ban maintainers in one HTTP request — and researchers reproduced it within minutes of the advisory going live.

Priya Nair · Aug 22 · 6 min

Industrial factory assembly line representing manufacturing sectors hit by the Windchill breach campaign

Software

Cl0p just named Shell and Philips as ransomware victims — a bug with no login let them in

More than 40 companies have been named so far in a campaign that chains two flaws in PTC's Windchill and FlexPLM software into unauthenticated remote code execution.

Priya Nair · Aug 20 · 8 min