Archive
Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to supply-chain.
CL0P against MOVEit Transfer, worked as a case rather than read as news. A zero-day in an internet-facing file transfer product, a web shell, and a scope question that has nothing to do with how many hosts were touched. Nine questions, and the answers are in the advisory.
A developer laptop, a package that should not have been installed, and a proxy that logged where the traffic went but not what was asked for. Work out what the truncation costs you, what you can still prove, and whether a full-URL log would have been worth what it costs to keep.
A trusted software update that carried a backdoor, worked as a case. Signing proved the build was the vendor's; it proved nothing about what was in it. Eight questions on detection, scope and the uncomfortable part, which is that nothing your endpoint controls were watching for was wrong.
CVE-2026-60004 turns repository write access into shell execution as the Gitea service account. The interesting part is not the injection. It is that Git hooks are executable files sitting inside a directory your developers write to all day.
