Research

Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to ci-cd.

Collection

Format

AnalysisConstructed

Evidence Gap Challenge No. 2: the proxy only kept the domain

A developer laptop, a package that should not have been installed, and a proxy that logged where the traffic went but not what was asked for. Work out what the truncation costs you, what you can still prove, and whether a full-URL log would have been worth what it costs to keep.

12 Sept 2026about 40 minutes of workT1195.001T1059.007T1552.001evidence-gap-challenge evidence retention supply-chain

Analysis

Gitea's diffpatch endpoint plants a Git hook, and the hook does the rest

CVE-2026-60004 turns repository write access into shell execution as the Gitea service account. The interesting part is not the injection. It is that Git hooks are executable files sitting inside a directory your developers write to all day.

30 Aug 20265 min readCVE-2026-60004T1195.002T1059.004T1546gitea ci-cd supply-chain code-injection