GitHub and PyPI Time-based Policies Aim to Improve Supply Chain Security
NEOSEC enrichment — no mirror of the original source
GitHub and the Python Package Index (PyPI) have introduced policies intended to reduce the risk of introducing poisoned packages. GitHub's Dependabot cooldown waits at least three days after release publication of non-security versions to o
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Murray, Neely.
More on GitHub
Other advisories
- CriticalCVE-2026-62253Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app
- HighCVE-2026-62251Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app
- CriticalCVE-2026-62252Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app
- MediumCVE-2026-41504Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza
- HighCVE-2026-41510Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza
- HighCVE-2026-26287External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets
- MediumCVE-2026-41508Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza
- Not ratedosv:GO-2026-6651Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core
Other news entries
- Security patches need patches now that attackers have AINewsThe Register — Security
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesNewsThe Hacker News
- Hallucinated domain in official OpenAI skill underscores AI supply chain risksNewsCSO Online
- GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 RepositoriesNewsThe Hacker News
- Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE AppNewsThe Hacker News
- GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to HijackingNewsThe Hacker News
- Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub BreachNewsSecurityWeek
- Over 1,500 npm packages exposed by Trusted Publishing validation flawNewsCSO Online
ID