Benji York

Security isn't a tech issue. It's economic. Last month, our OSV-Scanner Agent flagged 23 CVEs in our own dependency tree. The economic reality hit me like a freight train, one I did the math: we will be burning $4,200/month in developer hours manually triaging false positives. Here's the brutal math: Each CVE took 1 hour to verify reachability. Most were phantom threats - unused code paths in transitive dependencies. Our Researcher Agent now performs exploitability analysis in 180 seconds, feeding context directly to our patch workflow. Result: We cut CVE triage time by 89%. Our SOC2 prep timeline this summer compressed from 6 weeks to 2. But here's what surprised me most: The economic model flipped. Instead of security being a cost center, our automated patch generation actually accelerated feature velocity. When your CI runner auto-remediates vulnerabilities before they reach production, we stay in flow state. The broader implication? Most companies are solving the wrong problem. They're buying more scanning tools when they should be buying decision & patching engines. Every unresolved CVE carries compound interest—technical debt that doubles every sprint cycle. We're preparing for SOC2 and ISO27001 audits using XOR to audit XOR. The irony isn't lost on me: our own medicine tastes pretty good. What's your security budget really buying you—protection or process theater? #CyberSecurity #SOC2 #StartupLife

19

Security research moves fast. Your debugging tools should too. When you're staring at assembly output trying to understand stack corruption or heap layout, every minute counts. Traditional GDB workflows can be painfully slow for security research and exploit development. That's exactly why Trail of Bits engineer, disconnect3d, built Pwndbg: a Python tool that augments GDB and LLDB with intuitive context displays and powerful commands specifically designed for security work. At EuroPython today (10:30, Terrace 2A), he'll demonstrate how Pwndbg can: 1. Visualize stack canaries and heap allocators in real-time 2. Dramatically speed up exploit development workflows 3. Make assembly analysis accessible to more security researchers 4. Streamline low-level debugging with Python-powered automation This 45-minute advanced track session is perfect for security professionals, systems programmers, and anyone working at the intersection of Python and low-level systems. https://lnkd.in/gMApQdZW

104

8 Comments

🚀🚀 #vet 1.9.8 released and it supports scanning GitHub Actions "code" The recent tj-actions/changed-files supply chain attack is the topic of the town. While it is a major incident, it appears the actual impact was somewhat limited. Coincidentally or otherwise. We want to protect our users against such attacks but we faced a key challenge. Our malicious code and package scanning infrastructure is built on the assumption that a package version, such as `pkg/npm:express@4.17.1` is immutable. If we scan this package once, we can trust its result in future because npm package registry will guarantee that a package version cannot be updated. This assumption was broken when it comes to scanning GitHub Actions code because GitHub tags are MUTABLE and thats what we saw in tj-actions/changed-files hack as well. To workaround this limitation, we handle GitHub Actions as a special case. We resolve the commit SHA of a given GitHub Action at the time of scanning before initiating a code analysis session. The implementation is generic enough to scan any GitHub repository. Try it out. Feedbacks and suggestions from the community is what drives our roadmap. Link in comment. 💻 Omkar Phansopkar Arunanshu Biswas Sudhanshu Dasgupta Kunal Singh 🎯 Sahil Bansal

64

2 Comments

One compromised NPM maintainer account. Billions of downloads impacted. In September, attackers injected wallet-draining and credential-stealing code into trusted packages like chalk, debug, and ansi-regex. Typosquatted libraries blended in with real developer tools, stealing crypto keys, exfiltrating environment variables, and persisting inside CI/CD pipelines. At its core, this is a supply chain challenge that impacts every layer of the business. Here's how you can respond: ▪️ Enforce hardware MFA and scoped tokens for dev and automation accounts. ▪️ Pin and verify packages with lockfiles and signed artifacts. ▪️ Block risky post-install scripts in production. ▪️ Rehearse incident playbooks for rapid rollback and customer notification. UltraViolet's Threat Intelligence & Detection Engineering (TIDE) Team is actively tracking these campaigns across open-source ecosystems. Read the full advisory → https://lnkd.in/gvyGgmAZ #ThreatIntelligence #SupplyChainSecurity #NPM

28

Every time I read something like this, I feel like we’re no longer securing systems – we’re just trying to keep a pile of API keys, tokens, and bucket URLs from falling into the wrong hands. We moved from guarded fortresses to glass houses with GitHub credentials taped to the windows. „Leaked AWS credentials allowed SpecterOps to register an unclaimed S3 bucket referenced in the OneLogin API that began receiving logs from a OneLogin customer. These logs leaked the customer API key that can be used to obtain the signing key and generate valid JWT tokens, enabling arbitrary user impersonation.“ https://lnkd.in/eYzTtBnJ

117

1 Comment

In case you missed it, LinkedIn just unveiled their next-gen #Kafka replacement: NorthGuard (also short for NG 👍) 📖 Official blog: https://lnkd.in/gyWMhAMS 💬 Rumored to be written in C++ (source: https://lnkd.in/g-UF22Zd) There’s no open source plans yet. No mention of cloud storage. But the motivation is clear: Kafka was getting too heavy at their scale: ⚙️ 32 trillion records per day 💾 17 PB/day 📡 400K topics across 10K+ machines in 150 clusters NorthGuard is a bold rethink of Kafka for massive throughput and scale, and yes, it’s built in C++. That part resonates with us at Timeplus. We also chose C++ to build our real-time streaming engine. It’s a harder path,  but it gives us blazing-fast performance, low memory usage, and minimal third-party dependencies. Looking forward to more technical deep dives and talks on NorthGuard in the future. Until then, it’s another reminder that some of the best real-time systems today are written the hard way, in C++, such as #Redpanda, such as #Timeplus :) The official blog is certainly great, but if you prefer something with more diagrams and context, I highly recommend the blog from Vu Trinh https://lnkd.in/gUdViRnv

110

14 Comments

SSPR has become a default expectation in modern SaaS environments. It frees up IT. It improves user experience. But it also opens the door to something far more dangerous - invisible attack vectors. Attackers know SSPR flows aren’t always monitored closely. So they exploit them. Repeated password resets. Off-hours access. Suspicious geolocation. Signals that may seem benign in isolation, but when correlated, can point to credential compromise in progress. Traditional security tools often miss these patterns. Because they’re looking at events, not intent. Reco does it differently. Our platform correlates self-service password reset activity across Microsoft Entra, Okta, and Salesforce. We detect when accounts change credentials too frequently, from unexpected IPs or devices, or in ways that don’t align with their typical behavior. And we don’t stop at alerting. Reco Investigations Center ties password resets to privilege level, user group, authentication method, and risk context, enabling fast triage and decisive action. In a world where identity is the new perimeter, Reco delivers the visibility and intelligence needed to stop account takeover before it escalates.

119

4 Comments

Found a bug in the SEC's programmatic submissions API that mislabels filings as having XBRL when they don't. This bug spans from the start of the SEC's voluntary XBRL program in 2005 to the present. https://lnkd.in/gx7QvqBi

32

6 Comments

Updates on our LLM Gateway: Going forward, will be sharing more here on LinkedIn 🙂 •⁠ ⁠We’re moving away from the old model of dumping all logs into a central store (Clickhouse earlier) → now pushing logs to S3 (or any object store). This opens up a lot more flexibility: logs for different projects or regions can go into different buckets. Super useful for enterprises where data compliance and locality are non-negotiable. Rolling this out starting this week. •⁠ ⁠New UI for routing configs: you can now set up pretty complex routing rules (weight/priority based, latency-based load balancing) directly from the UI in just a few clicks. No more digging through configs

102

8 Comments

What's on OIG's mind? I put together all work plans (both past and currently active) published by HHS Office of Inspector General OIG, cleaned them, and loaded them into a table in the mimilabs data lakehouse. Now mimilabs users can review OIG's focus areas using SQL and Python. One thing I've always been curious about is: what's on OIG's mind now? Where will they focus more this year and next? What areas need more compliance oversight? I noticed some work plans have "tags" (unfortunately not all), so I decided to look at how the tags have been changing over time. The chart below shows work plan tags over time (based on work plan announcement/revision dates). Different times require different focus areas. For example, in 2022-2023, COVID-19 was one of the main focuses, as we all know. So, which areas are gaining traction this year? Two promising areas are: 'financial stewardship' and 'managed care'. These are the areas that (at least based on the work plan tags) seem to be getting lots of attention. What are your thoughts? What do you think OIG will focus on more in this administration?

18

So apparently k8s finally managed to enable user namespaces on by default. It's only been... what almost 10 years now? You want a cookie for that? A lot of docker containers are deployed w/root which makes them security dumpster fires. User namespaces are designed to help alleviate this although not even a month ago Qualys published multiple bypasses for them. One of the many issues with "containers" is that they are a hodgepodge of various namespaces that are left up to the container runtimes and their orchestrators to implement themselves. You know what's better than a user namespace? Not having users inside your image to begin with! You can actually run your existing software without the notion of a user using nanos unikernels. So there is no user mapping between the host and the guest - be it root:root or root:non-root. It just doesn't exist. In today's threat environment deploying your software with users is becoming increasingly untenable.

51

5 Comments