Mastodawn

The most interesting supply chain attack I've ever seen: #trivy

The attack is really bizarre. I learned a lot about GitHub Actions and how the attack was performed.

- https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
- https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation
- https://ramimac.me/trivy-teampcp/#timeline
- https://snyk.io/articles/trivy-github-actions-supply-chain-compromise/

#cybersecurity #supplychain #github #glassworm #githubactions #attack #TeamPCP #c2

Update: Ongoing Investigation and Additional Activity

Open Source Security Advisory Update: Monday, March 23, 2026 Boston, MA 2:00 AM ET We are providing this update to share new developments identified during our ongoing investigation into the Trivy open source incident described below. Over the weekend, the Trivy team continued analysis of the previously reported incident and started implementing additional security measures across repositories and automation …

Aqua

Niclas Feb 3

Please give me a reason, why #ec2 on #aws has less than 5GB tmp and 0 SWAP space? Sooner or later, you'll run into problems😞 .

#sysadmin #linux #cloud

Niclas Jan 28

With this structure, the variables in “host_vars” and “group_vars” are not loaded. This is because the inventory file is not in the root directory. Is there a way to have the inventory file in an inventory folder?

#ansible #sysadmin #devops #gitops #automation

Niclas Jan 27

noyb.eu Jan 27

🎉 First WIN of 2026: the Austrian DPA has ordered Microsoft to stop tracking school children

https://noyb.eu/en/noyb-win-microsoft-ordered-stop-tracking-school-children

noyb win: Microsoft ordered to stop tracking school children

The DSB decided that Microsoft unlawfully placed tracking cookies on the devices of a pupil

noyb.eu

Niclas Jan 23

evacide Jan 23

Do not store your Bitlocker encryption keys on Microsoft's servers if your threat model includes governments or law enforcement. As this article points out, this is the result of a design choice Microsoft made. It didn't have to be this way.

https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/

Microsoft Gave FBI Keys To Unlock Encrypted Data, Exposing Major Privacy Flaw

The tech giant said providing encryption keys was a standard response to a court order. But companies like Apple and Meta set up their systems so such a privacy violation isn’t possible.

Forbes

Niclas Jan 16

Brian Clark Jan 16

RE: https://infosec.exchange/@netresec/115905237000922504

Here’s a good example on why you should have network egress filtering on your network. Nobody uses the finger protocol any more. But the binary still exists in Windows! And if you don’t block outbound port 79/tcp your users are at risk #cybersecurity #LOLBIN

Niclas Jan 5

Has anyone imported CSV data into Prometheus before? I want to import my old data sets back into Prometheus. Unfortunately, I have the problem that Prometheus - after import - takes the timestamp from the import as the value and not the timestamp from the CSV.

#Prometheus #Monitoring #CSV #Dataset #selfhosted #homelab #visualization #grafana #selfhost