Articles by Varun
-
GitHub Actions Security: 5 Best Practices You Must Follow Right Now
GitHub Actions Security: 5 Best Practices You Must Follow Right Now
GitHub Actions is a game-changing CI/CD platform that empowers developers to orchestrate DevOps tasks effortlessly. It…
Activity
5K followers
-
Varun Sharma shared this🚨 Laravel-Lang supply chain attack - every git tag across 4 popular Composer packages was rewritten in a single 90 minute window to steal CI secrets On May 22, 2026, an attacker with org-wide push access to the Laravel-Lang GitHub organization rewrote every existing tag in four widely used Composer packages to point at a new malicious commit: 🔴 laravel-lang/lang (the flagship Laravel translations package — 502 tags) 🔴 laravel-lang/http-statuses (every tag, v1.0.0 through v3.4.5) 🔴 laravel-lang/actions (all 46 tags) 🔴 laravel-lang/attributes (all 86 tags) Anyone running `composer update` against a version range like `^3.4` or `*` now resolves to a poisoned tag. The payload fires on app boot via Composer's `autoload.files` map, exfiltrates CI runner secrets (including GITHUB_TOKEN), and drops an in-memory implant that deletes itself from disk within 3 seconds. The C2 domain is 🚫 flipboxstudio[.]info - a typosquat of the legitimate flipboxstudio[.]com. StepSecurity customers are already protected: 🚫 flipboxstudio[.]info has been added to the Harden Runner global block list and now blocks across every workflow using Harden Runner, even in audit mode We have filed security issues in all four affected repositories. Full technical analysis, IOCs, and recovery steps in our blog post. Link in comments.
-
Varun Sharma shared this🚨5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough Microsoft and GitHub were both breached through their software supply chains this week. Through a poisoned VS Code extension and a trojanized PyPI package. There have been 5 distinct attacks between May 18 and May 19: 🔴 Nx Console VS Code extension compromised (2.2M+ installs) 🔴 actions-cool GitHub Actions hijacked via imposter commits, stealing CI/CD secrets from process memory 🔴 Shai-Hulud npm worm spreading across dozens of packages 🔴 Microsoft's durabletask PyPI package trojanized 🔴 GitHub disclosing a breach of their internal source code Every layer of the software development pipeline was hit simultaneously. IDE extensions, npm packages, PyPI packages, GitHub Actions, a self-replicating worm. The diversity of attack vectors is what makes this wave different. Attackers are not focused on one vector. They are targeting the entire software development and delivery lifecycle. Just a secure registry would not have stopped the VS Code compromise. Just package scoring would not have flagged a hijacked GitHub Action. Traditional EDR or CNAPP tools don't monitor CI/CD runners at runtime or inventory developer machines. You need defense in depth: 🛡️ Runtime agents on CI/CD runners (Harden Runner) 🛡️ Developer machine inventory (Dev Machine Guard) 🛡️ Auto-block compromised actions org-wide (Compromised Actions Policy) 🛡️ Near real-time threat intelligence (Threat Center) 🛡️ Cooldown enforcement for new package versions (Secure Registry) 🛡️ Repo-wide compromised dependency scanning (Package Search) 🛡️ AI-powered analysis of package releases to detect compromises in real time (AI Package Analyst) We wrote a detailed breakdown of all 5 attacks and how defense in depth works in practice. Find the link to the blog post in the comments.
-
Varun Sharma reposted thisVarun Sharma reposted this🚨 BREAKING: Microsoft's durabletask PyPI Package Compromised 🚨 durabletask, Microsoft's official Python SDK for Azure Durable Functions, was published with malicious code on May 19, 2026. Three compromised versions (1.4.1, 1.4.2, 1.4.3) were pushed directly to PyPI using compromised publishing credentials, bypassing Microsoft's CI/CD pipeline entirely. The malicious versions contain a dropper that silently downloads and executes a multi-cloud credential theft framework targeting AWS, Azure, GCP, and Kubernetes secrets on Linux systems. If you use durabletask, run `pip show durabletask` now. If you are on version 1.4.1, 1.4.2, or 1.4.3, assume your system is compromised and follow your incident response process. Pin to version 1.4.0 immediately. The StepSecurity team is actively investigating and will keep the blog post updated as new details emerge. Link in comments. #SupplyChainSecurity #PyPI #CyberSecurity #DevSecOps #OpenSource #Python
-
Varun Sharma reposted thisVarun Sharma reposted this🚨 Popular GitHub Action compromised in supply chain attack. All existing tags for actions-cool/issues-helper were moved to a malicious imposter commit that steals CI/CD credentials from GitHub Actions runners. Full details: https://lnkd.in/gyGCrWFN
-
Varun Sharma reposted thisVarun Sharma reposted this🚨 Active npm supply chain attack. 143 packages compromised in a single coordinated wave across the AntV (Alibaba) data visualization ecosystem, plus echarts-for-react, timeago.js, jest-canvas-mock, and others. Some ship over a million downloads per month. 🛡️ The C2 domain sits on the same infrastructure used in the actions-cool/* GitHub Actions compromise we reported earlier today. Every StepSecurity Harden-Runner customer, community tier and enterprise, was protected from second zero of this incident via our global block list. 🚨 We pushed a Threat Center alert to all StepSecurity enterprise customers with detection queries and remediation steps. Here's how StepSecurity Enterprise customers are protected at every stage of the software development pipeline: ⚙️ CI/CD pipelines 1️⃣ Outbound connections to the C2 domain are blocked automatically 2️⃣ Runner.Worker memory read detection flags attempts to dump CI/CD secrets 📦 Code Repositories 1️⃣ npm package search detects compromised packages in default branches and pull requests 2️⃣ npm cooldown and compromised package GitHub checks automatically block pull requests from being merged 💻 Dev Machine Guard 1️⃣ npm package search detects compromised packages installed on developer machines. 🔒 For all stages, StepSecurity Secure Registry blocks these compromised packages from even reaching your environment in the first place. We are tracking the full incident in the blog post linked in the comments, with the complete list of affected packages, safe downgrades, and IOCs. #SupplyChainSecurity #npm #DevSecOps #HardenRunner #ShaiHulud #ThreatIntel
-
Varun Sharma shared this🚨 The actions-cool/issues-helper GitHub Action has been compromised Every existing tag in the repository has been moved to point to an imposter commit that is not reachable from the action's normal commit history. Any workflow that references this action by version will pull the malicious code on its next run. What the malicious commit does on the runner: ⬇️ Downloads the bun JavaScript runtime 🧠 Reads memory from the Runner.Worker process to harvest CI/CD secrets in flight 📡 Exfiltrates the stolen credentials to the attacker-controlled domain t. m-kosche. com Update: A second action in the same organization, actions-cool/maintain-one-comment, has also been compromised by the same actor using the identical pattern How StepSecurity customers are already protected: 🛡 Threat Center alert was sent to all customers in real time, with "Am I Affected?" links to find every workflow using this action and every runner that has talked to the IOC domain 🚫 Compromised Actions Policy - actions-cool/issues-helper has been added to the compromised actions list. For customers with the policy enabled, any workflow run referencing this action is blocked before it executes 🌐 Harden-Runner Global Block List - t. m-kosche. com has been added to the global block list. Every Harden-Runner-protected workflow now blocks outbound calls to this domain automatically, even in audit mode, with no configuration change required 🔍 Imposter Commit detection flags any workflow run using a commit SHA that doesn't match a legitimate tag or branch head - the exact signature of this attack If you use this action: stop running it immediately, or pin to a known-good commit SHA from before the compromise, and rotate any secrets that were available to workflows that recently ran it. Full advisory and IOCs in our blog post. Link in comments.
-
Varun Sharma reposted thisVarun Sharma reposted this🚨 BREAKING: Nx Console VSCode Extension Compromised 🚨 Nx Console (nrwl.angular-console) v18.95.0, a VS Code extension with 2.2M+ installs, was published with malicious code on May 18, 2026. The compromised version executes an obfuscated credential stealing payload on workspace activation. If you use Nx Console, assume your machine is compromised and follow your incident response process. The StepSecurity team is actively investigating and will keep the blog post updated as new details emerge. Link in comments. #SupplyChainSecurity #VSCode #CyberSecurity #DevSecOps #OpenSource
-
Varun Sharma liked thisAlways a pleasure to learn and help customers and community to enable their cloud in the most secure way :D Those controls are only some of the ones we are building, more PQC stuff to come!Varun Sharma liked thisPost-quantum cryptography (PQC) is a hot topic for many of my customers. Some are still in the "information and inventory gathering" stages and others are actively enabling or migrating to PQC-safe algorithms. It's great to see tools like prowler adding checks for PQC-related configurations. For example, see https://lnkd.in/dQsZ3vzT This will help customers to identify deviations from their desired configuration state. Along with my colleagues Patrick Palmer Avni Rambhia and ☁️ Jonathan Jenkyn ☁️we are spreading the message about PQC and how customers can mitigate their PQC related risks.GitHub - prowler-cloud/prowler: Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.GitHub - prowler-cloud/prowler: Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
-
Varun Sharma liked thisVarun Sharma liked thisWindows developer machines are often the highest-value targets in supply chain attacks. They've also been the hardest to inventory. Until recently, security teams running mixed fleets had a choice: general MDM that didn't understand developer workflows, or EDR that didn't understand supply chain risk. Dev Machine Guard now runs natively on Windows. The same scanning engine, the same enterprise dashboard, the same policies, now covering Windows developer machines alongside macOS and Linux. MSI based releases are also supported for ease of deployment and management at scale. Coverage on Windows includes: 🤖 AI coding agents (Claude, Cursor, GitHub Copilot, Codex) 🔌MCP server configurations 🧩IDE extensions and plugins 📦npm packages, global and per-project 🔎Native detection paths: %LOCALAPPDATA%, %PROGRAMFILES%, Windows Registry ⏰Scheduled scanning via Task Scheduler Both AMD64 and ARM64 builds ship signed with Sigstore, with build provenance attestations. The scanning engine is open source: https://lnkd.in/g7rHTY-e StepSecurity Full blog post linked in comments. #SupplyChainSecurity #DevSecOps #WindowsSecuritydsf
Experience
-
-
-
-
-
-
-
-
-
Education
Patents
Other similar profiles
Explore more posts
-
Cyble
In the latest Cyble Podcast, Chirag D Joshi joins Kapil B. to discuss some of the biggest security weaknesses organizations are facing today. He highlights three areas that continue to drive real-world vulnerabilities: 🔹 Security configuration management 🔹 Privileged access management — across both human and system identities 🔹 The growing impact of AI on identity and access complexity He also shared why security testing is becoming a major priority, especially with APRA’s increased focus on stronger testing requirements. Watch the full clip for the complete discussion. 🎥👇 #CyblePodcast #CyberSecurity #VulnerabilityManagement #PrivilegedAccessManagement #ThreatIntelligence #SecurityTesting #APRA
1 Comment -
Peeyush Trivedi
The RBI auditor gave them 30 days. Their NAC had been in "monitor mode" for 14 months. --- The CISO knew it was a problem. His team knew it was a problem. But monitor mode was comfortable. No enforcement meant no helpdesk tickets. No complaints from users. No late-night calls about blocked devices. Until the auditor wrote three words in the findings report: "Non-enforcing access control." Suddenly 30 days to move from monitor to enforcement across 2,000+ endpoints. Here's what saved them: They didn't try to enforce everything at once. Week 1: Enforced on server VLANs only (highest risk, fewest devices, smallest blast radius). Week 2: Added corporate laptops with certificate-based auth. Week 3: BYOD and contractor devices with profiling + limited access. Week 4: IoT and unmanaged devices — quarantine VLAN with explicit allow-list. By day 28, enforcement was live across the network. The auditor's follow-up found zero open findings. --- The lesson isn't "hire a consultant when the auditor shows up." The lesson is: enforcement doesn't have to be all-or-nothing. Phased rollout. Highest risk first. Smallest blast radius. Expand when stable. If your NAC is sitting in monitor mode and you know the audit is coming — the clock is already ticking. DM me "ENFORCE" for a phased enforcement roadmap I've used at 4 different banks. #NAC #cybersecurity #RBI #compliance #BFSI #networksecurity #audit
-
IONIX
🚨 New Critical Adobe AEM Forms Vulnerabilities #CVE-2025-54253 & CVE-2025-54254 Two newly disclosed CVEs affecting Adobe Experience Manager (AEM) Forms on JEE could enable attackers to execute arbitrary code remotely or access sensitive files via XXE injection. 🔍 CVE-2025-54253: Exploitable misconfiguration leading to remote code execution 🛑 CVE-2025-54254: XML External Entity flaw enabling file disclosure ➡️ Public PoCs are already circulating - that means real-world exploitation is imminent. The IONIX research team is actively tracking exploitation attempts. If you're using AEM Forms v6.5.23 or earlier, you're at risk. We recommend patching immediately and validating configurations to block abuse vectors. Our latest blog covers: ✅ Exploit details with sample payloads ✅ Real-world impact assessment ✅ Patch guidance and config hardening ✅ Asset visibility via the IONIX Threat Center 👉 Read the full breakdown: https://lnkd.in/e-cKayNg #CyberSecurity #Adobe #CVE #ZeroDay
-
OpsMx
From Alerts to Action: Inside OpsMx’s AppSec Vision In this Pulse 2.0 interview, OpsMx CTO Gopinath Rebala shares how OpsMx redefines Application Security Posture Management (ASPM) for modern software delivery. 🔎 Key takeaways: 1) Why Delivery BOM > SBOM for secure releases 2) Making “Shift Left” work—without slowing devs down 3) How GenAI powers faster remediation and policy automation 4) Real-world wins from policy-enforced CI/CD security This is a must-read if you care about scaling AppSec without slowing innovation. 👉 Read the interview: https://lnkd.in/gXHg6Erc #ApplicationSecurity #DevSecOps #ASPM #SoftwareSecurity #CTOInsights #GenAI #OpsMx
-
Tom Conkle
Why do I keep talking about Customer Responsibilities Matrices (#CRMs)? Because they help safeguard your data and assuming “the provider handles that” is never appropriate. CRMs aren't just a mandatory requirement for #CMMC. They help ensure service providers and their customers remain aligned and security is achieved. I have dozens of stories for how a lapse in communication caused significant risk to an organization using a cloud service offering. What about you? Do you have any stories you'd like to share on how a CRM could have helped save the day (not to mention a lot of time and money)? If you’re an external service provider (CSP, MSP, MSSP) and don’t want to be the cautionary tale in someone else’s post, download the Optic Cyber Solutions CRM Template today (link in comments) to get started with your CRM. If you have questions on how to develop a CRM reach out, I'll still be talking about them and happy to help.
5 Comments -
Murtuja Bharmal
India’s power sector is getting new cybersecurity rules. Our eBook breaks down the Draft CEA Cyber Security Regulations, 2024 in simple terms; what it means for OT/ICS security, audits, incident response, and vendor requirements. Useful for: CISOs, IT/OT teams, compliance/audit teams, and power-sector vendors. Inside: chapter-wise summary + quick compliance checklist. Download: https://lnkd.in/dWQjxb9i #PowerSector #OTSecurity #ICSSecurity #CyberSecurity #Compliance #GRC
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content