eMudhra quits TLS, but your servers still trust its broken CAs
The exit announcement fixes nothing on your machines. Why the cracked eMudhra keys still work outside browsers, and the audit to run before mitmproxy users find you.
Tagged
#supply chain security
LiteLLM 1.107.0: a real signature on a backdoored release
Attackers used stolen GitHub CLI tokens to push a backdoored LiteLLM through its signed release pipeline. Here is the exposure check, the rotation list and the gateway fixes.
Plugin4Shell breaks SHA pinning in four AI coding agents at once
A shared design flaw lets attackers swap pinned plugin code in four major AI coding agents without any user action. Two vendors still have no fix.
Homebrew 7.0.0: what breaks on Monday and what to adopt
A migration walkthrough for Homebrew 7.0.0: the Intel Mac cliff, the CI and Brewfile flags that vanished, the Linux sandbox swap, and the two new commands worth adopting today.
RubyGems agent swarm: how three conveniences became RCE
The May RubyGems flood was reportedly an OpenAI training run looking for internet access. What the chain teaches maintainers, agent builders and anyone who owes a registry a heads-up.