Cybersecurity articles tagged #Open Source Security on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/ai-coding-accelerates-open-source-risk-and-remediation-debthttps://runtimerebel.com/blog/ai-coding-accelerates-open-source-risk-and-remediation-debtAI coding tools introduce open-source dependencies faster than security teams can manage, creating "remediation debt" that impacts enterprise security.Tue, 25 Aug 2026 00:40:34 GMTOpen Source SecuritySupply Chain RiskEnterprise SecurityAI CodingRemediation Debthttps://runtimerebel.com/blog/nico-waisman-evolution-of-offensive-security-and-open-sourcehttps://runtimerebel.com/blog/nico-waisman-evolution-of-offensive-security-and-open-sourceExplore Nico Waisman's journey from self-taught hacker to pioneering offensive security and leading open source supply chain efforts.Tue, 18 Aug 2026 16:21:57 GMTOffensive SecurityOpen Source SecurityPenetration TestingSupply Chain SecurityGitHub Security Labhttps://runtimerebel.com/blog/defending-against-the-1444-surge-in-open-source-supply-chain-attackshttps://runtimerebel.com/blog/defending-against-the-1444-surge-in-open-source-supply-chain-attacksGTIG reports a massive 1,444% spike in open source repository compromises. Learn how to mitigate threats from actors like UNC6780 and MIDNIGHT NEPTUNE.Thu, 30 Jul 2026 14:10:41 GMTUNC6780MIDNIGHT NEPTUNEOpen Source SecurityGitHub ActionsNPM Securityhttps://runtimerebel.com/blog/openmandriva-insider-sabotage-risks-of-contributor-access-misusehttps://runtimerebel.com/blog/openmandriva-insider-sabotage-risks-of-contributor-access-misuseOpenMandriva Linux reports an attempted internal sabotage by a disgruntled contributor, highlighting critical risks of insider threats in open-source projects.Fri, 10 Jul 2026 03:31:37 GMTOpenMandrivaInsider ThreatOpen Source SecuritySupply Chain Attackhttps://runtimerebel.com/blog/flipper-zero-transitions-to-community-led-firmware-development-modelhttps://runtimerebel.com/blog/flipper-zero-transitions-to-community-led-firmware-development-modelFlipper Devices shifts firmware development to a community-centric model, raising new considerations for supply chain integrity and security update lifecycles.Sun, 05 Jul 2026 17:13:50 GMTFlipper ZeroFirmware SecurityFlipper DevicesHardware HackingOpen Source Securityhttps://runtimerebel.com/blog/open-source-zero-days-and-atm-jackpotting-analysis-of-recent-threatshttps://runtimerebel.com/blog/open-source-zero-days-and-atm-jackpotting-analysis-of-recent-threatsLegal actions against ATM jackpotting crews and hacktivists highlight ongoing risks in open-source security and financial infrastructure.Sat, 04 Jul 2026 10:11:58 GMTATM JackpottingOpen Source SecurityAnonymousZero Day Disclosureshttps://runtimerebel.com/blog/linux-foundation-s-project-akrites-bolstering-open-source-securityhttps://runtimerebel.com/blog/linux-foundation-s-project-akrites-bolstering-open-source-securityProject Akrites aims to streamline vulnerability management across open source projects, enhancing reporting, patching, and disclosure processes for critical software.Fri, 26 Jun 2026 12:52:09 GMTLinux FoundationAkritesOpen Source SecurityVulnerability ManagementSoftware Supply Chainhttps://runtimerebel.com/blog/miasma-worm-source-code-briefly-leaked-on-githubhttps://runtimerebel.com/blog/miasma-worm-source-code-briefly-leaked-on-githubAnalysis of the Miasma worm source code leak on GitHub, a credential-stealing framework targeting open-source ecosystems via supply-chain attacks.Wed, 10 Jun 2026 20:58:55 GMTMiasmaWormCredential StealingSupply Chain AttackGitHubOpen Source Securityhttps://runtimerebel.com/blog/miasma-compromises-73-microsoft-github-repos-incident-analysishttps://runtimerebel.com/blog/miasma-compromises-73-microsoft-github-repos-incident-analysisMicrosoft restores some GitHub repositories after 73 projects were hit by Miasma's supply chain attack to inject information stealers. Learn detection steps.Tue, 09 Jun 2026 17:00:07 GMTGitHubMiasmaMicrosoftSupply Chain AttackInformation StealerOpen Source Securityhttps://runtimerebel.com/blog/shai-hulud-attack-trojanized-pypi-packages-steal-developer-secretshttps://runtimerebel.com/blog/shai-hulud-attack-trojanized-pypi-packages-steal-developer-secretsNew Shai-Hulud supply chain attack compromises 19 science-focused PyPI packages, distributing malware to steal developer credentials and secrets.Mon, 08 Jun 2026 20:57:57 GMTShai HuludPyPISupply Chain AttackMalwareDeveloper SecretsPythonOpen Source Securityhttps://runtimerebel.com/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chainhttps://runtimerebel.com/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chainAnalysis of the Shai-Hulud campaign by TeamPCP, detailing their open-source supply chain attacks, TTPs, and critical mitigation strategies.Tue, 26 May 2026 20:47:57 GMTTeamPCPShai HuludSupply Chain AttackOpen Source SecurityNPMPyPIMalicious Packageshttps://runtimerebel.com/blog/rubygems-suspends-registrations-due-to-malicious-package-influxhttps://runtimerebel.com/blog/rubygems-suspends-registrations-due-to-malicious-package-influxRubyGems maintainers suspended new user registrations after detecting an automated attack involving over 500 malicious packages targeting platform resources.Wed, 13 May 2026 09:09:56 GMTRubyGemsOpen Source SecurityPackage ManagerSupply Chain SecurityMalicious Packageshttps://runtimerebel.com/blog/the-eol-blind-spot-addressing-cve-gaps-in-legacy-softwarehttps://runtimerebel.com/blog/the-eol-blind-spot-addressing-cve-gaps-in-legacy-softwareLearn why end-of-life software creates critical security blind spots in CVE feeds and how to improve your SCA tool detection for legacy dependencies.Tue, 05 May 2026 16:40:16 GMTEOLSCASoftware Composition AnalysisCVEOpen Source Securityhttps://runtimerebel.com/blog/microsoft-developer-account-suspensions-block-oss-security-patcheshttps://runtimerebel.com/blog/microsoft-developer-account-suspensions-block-oss-security-patchesMicrosoft's suspension of high-profile open-source developer accounts disrupts security patch delivery and introduces significant supply chain risks for Windows.Thu, 09 Apr 2026 08:38:53 GMTMicrosoft Partner CenterOpen Source SecuritySoftware SigningSupply Chain RiskWindows Developmenthttps://runtimerebel.com/blog/ai-led-remediation-crisis-hackerone-halts-bug-bountieshttps://runtimerebel.com/blog/ai-led-remediation-crisis-hackerone-halts-bug-bountiesHackerOne pauses bug bounties due to an AI-driven remediation crisis, highlighting how automated vulnerability discovery overwhelms open-source project capacity to fix…Thu, 09 Apr 2026 00:36:16 GMTHackerOneBug BountyAI SecurityVulnerability ManagementOpen Source SecurityRemediation Crisishttps://runtimerebel.com/blog/axios-attack-industrialized-social-engineering-on-npm-maintainershttps://runtimerebel.com/blog/axios-attack-industrialized-social-engineering-on-npm-maintainersAn analysis of the Axios NPM package attack reveals advanced, scaled social engineering campaigns targeting open-source maintainers, elevating supply chain risk.Tue, 07 Apr 2026 00:41:47 GMTAxiosNPMSocial EngineeringSupply Chain AttackOpen Source SecurityMaintainer Compromisehttps://runtimerebel.com/blog/open-source-security-key-findings-from-2025-trust-reporthttps://runtimerebel.com/blog/open-source-security-key-findings-from-2025-trust-reportAnalysis of the 2025 State of Trusted Open Source Report, detailing prevalent vulnerabilities and consumption patterns in container images and language libraries.Thu, 02 Apr 2026 12:26:52 GMTOpen Source SecuritySupply Chain SecurityVulnerability ManagementContainer SecuritySoftware Composition Analysishttps://runtimerebel.com/blog/tech-giants-pledge-12-5m-to-bolster-open-source-software-securityhttps://runtimerebel.com/blog/tech-giants-pledge-12-5m-to-bolster-open-source-software-securityAnthropic, AWS, Google, Microsoft, and OpenAI invest $12.5 million into the OpenSSF to mitigate systemic supply chain risks in open source ecosystems.Tue, 17 Mar 2026 16:30:47 GMTOpenSSFLinux FoundationOpen Source SecuritySupply Chain SecurityAI Safety