Disco duro externo conectado a un portátil sobre una mesa de despacho

The clone doesn't carry the .git/config. The ZIP does

Four CVEs published in August and September 2026 describe the same sequence: you open a folder with an AI coding agent, the agent calls git to work out where it is, and that folder's local configuration runs a program with your credentials before anybody asks whether you trust it. Inside: what git's documentation says about core.fsmonitor, why an ordinary clone does not work as a delivery route, why the ownership check git does have is disarmed by the most ordinary gesture there is, and the trick that hides the key from your own grep.

AI Cybersecurity DevOps

Read more →

Dos portátiles abiertos sobre una mesa de oficina y una mano escribiendo sobre unos papeles

19 Sep 2026 7 min read

The agent pinned the plugin's commit. Git handed it the attacker's branch

Plugin4Shell affects the four most widely used AI coding agents: they clone the plugin repository, check out the pinned commit and never verify they landed on it. We reproduced in the lab, with git 2.43, the git behaviour it rests on: exit code 0, a warning nobody reads, and the attacker's content in the working tree. The same 40-character string gives a different answer depending on which git command reads it, so auditing with git log is no help. And today's defence today depends above all on where the plugin repository is hosted.

IA Cybersecurity DevOps

Read more →

Puesto de trabajo vacío de noche en una oficina pequeña: portátil cerrado, teclado mecánico, taza fría y flexo encendido

18 Aug 2026 5 min read

Five days, an issue title and a Jira token

On 17 August Wiz described how it pulled a Jira token out of Snowflake by opening an issue on a public repository: the issue title was the exploit. The line that allowed it had gone in five days earlier, in a change meant to tidy the code up, and it replaced the safe pattern that GitHub's own documentation recommends in writing. What failed in the review chain, why the "if" that looked like a filter filtered nothing, and what we look at in a pipeline.

CI/CD AI GitHub

Read more →

Terminal de contenedores nevada con grúas portuarias y miles de contenedores apilados: la cadena de suministro por la que viaja el código que instalas

10 Aug 2026 5 min read

ChainDrop: 444 npm packages compromised and not a single patch to apply

On 4 August, between 09:35 and 13:20 UTC, a worm spread by itself across 444 npm packages, stealing the credentials it needed to keep spreading. The first malicious version went out through the legitimate pipeline, carrying a valid provenance signature. And there is a trap that inverts the correct reflex: revoking the stolen token is exactly what fires the next payload. What to look for in your lockfiles, in what order to rotate, and why there is no fixed version to install here.

Development CI/CD Cybersecurity

Read more →

FakeGit

7,600 fake repos; your AI is the target

23 Jul 2026 5 min read

Malware no longer fools you: it fools your AI. FakeGit and its 7,600 fake GitHub repositories

The FakeGit campaign seeded GitHub with 7,600 fake repositories; roughly 200 of them alone account for over 14 million malware downloads. The news isn't the volume: more than 800 posed as MCP servers and AI skills, and the assistants recommended them on their own. It has a name now: agentbaiting.

AI Cybersecurity GitHub

Read more →

everyWAN Blog

The clone doesn't carry the .git/config. The ZIP does

The agent pinned the plugin's commit. Git handed it the attacker's branch

Five days, an issue title and a Jira token

ChainDrop: 444 npm packages compromised and not a single patch to apply

Malware no longer fools you: it fools your AI. FakeGit and its 7,600 fake GitHub repositories

Subscribe to our newsletter