supply chain

RSS

1
Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation arxiv.org
The authors show that the classic trusting‑trust attack is not limited to compilers: by tampering with GNU strip they can inject a payload that propagates through NixOS's bootstrap and ends up in almost every binary of the final system. The attack succeeds on a real nixpkgs revision, building a full graphical installer while backdooring the majority of its binaries.
arXiv cs.SE (Software Engineering)arxiv.orgJulien Malka, Aman Sharma, Martin Monperrus, Stefano Zacchiroli, Théo Zimmermann6d1 minpaperHN24159
2
Why Does an NPM Math Library Need an Encrypted Loader?safedep.io
SafeDep discovered that several npm packages masquerading as mathjs contain an encrypted loader that only activates when a caller passes a particular matrix to the LU solver, using the matrix’s lower‑triangular factor as the decryption password. The loader decrypts and executes a multi‑stage remote‑access implant that talks to Slack, Telegram and a blockchain contract, and the same technique is r…
Hacker News front pagesafedep.ioSafeDep Team10h10 minHN9627
3
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers vercel.com
Hacktron reported an RCE in libheif, an AVIF decoder used by Next.js image optimization. Vercel and Hacktron reproduced the issue, then coordinated with upstream maintainers (sharp, libvips, libheif) to deploy platform-wide mitigations and release fixes across the ecosystem.
Vercelvercel.comKarim Rahal4d4 min
4
September 16, 2026 security incident: how we responded to a LiteSpeed zero-day attack hostinger.com
Hostinger detected a zero‑day exploit in LiteSpeed Web Server on a Brazil server on Sep 16 2026, giving the attacker root access and compromising 399 accounts. The team isolated the server, coordinated with LiteSpeed to patch the vulnerability, rolled out the fix fleet‑wide, and restored affected sites from backups within the same day.
Hostingerhostinger.comSaulius Lazaravičius4d2 minpostmortem
5
Laravel Vet: Review Composer Code Before It Installs laravel-news.com
Laravel Vet is a Composer plugin that intercepts installs/updates, shows the diff of each package, and lets you approve changes manually or via an LLM‑based coding agent. Trusted packages are recorded in a `vet.json` with a content hash, so future updates only prompt for new changes. The tool exits with an error on untrusted code, making it CI‑friendly, and works with any PHP project using Compos…
Laravellaravel-news.comEric L. Barnes7d4 min

supply chain

Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulationarxiv.org

Why Does an NPM Math Library Need an Encrypted Loader?safedep.io

Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainersvercel.com

September 16, 2026 security incident: how we responded to a LiteSpeed zero-day attackhostinger.com

Laravel Vet: Review Composer Code Before It Installslaravel-news.com

Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation arxiv.org

Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers vercel.com

September 16, 2026 security incident: how we responded to a LiteSpeed zero-day attack hostinger.com

Laravel Vet: Review Composer Code Before It Installs laravel-news.com