Charlie McCowan

🟣 Trustblock Security Update The attacks haven’t slowed down - and the stakes keep getting bigger. ▫️ ArcadiaFi - $3.5M drained A Rebalancer contract bug allowed arbitrary swap calls. Two separate drains (Base) siphoned ~$2.5M and ~$1M via validation bypasses and rapid bridging to Ethereum. ▫️ CoinDCX - $44M internal breach A compromised server leaked access to an operational wallet. ~$44M was taken from the exchange’s reserves. Tornado Cash funding and Solana–Ethereum bridging spotted post-attack. 🛡️ Security is no longer just about audit PDFs. Real-time visibility and protocol-level guardrails are how we keep DeFi safe. Explore more: https://trustblock.run

1

🛡️ Open Source Technology Improvement Fund, Inc (OSTIF) is helping safeguard critical OSS projects—one security audit at a time. As an OpenSSF member, OSTIF uses structured, customized audits backed by tools like OpenSSF Scorecard and funding through Alpha-Omega to improve the security posture of widely-used open source software. Read how OSTIF is tackling one of the biggest challenges in OSS: securing vital, high-impact projects with limited resources. 👉 https://hubs.la/Q03s06tQ0 #OpenSourceSecurity #OSS #OpenSSF #OSTIF #Cybersecurity #SoftwareSupplyChain Amir Montazery

10

1 Comment

For fintech and enterprise teams, wallet security isn't just about cryptography, it’s about compliance. Magic is the first wallet infrastructure provider certified across SOC 2 Type II, ISO 27001:2022, HIPAA, GDPR, and CCPA, enabling teams to meet audit and regulatory expectations at scale. Check out our docs → https://lnkd.in/e3F6B32B

4

Break free from “secure” containers that only cover the base image. With ActiveState, every layer—from OS to app libraries—is rebuilt, scanned, and documented. 🛡️ Full provenance, SBOMs, and signed attestations included. Stop inheriting risk—start owning your security story. #OpenSourceSecurity #SBOM

11

1 Comment

Are you measuring the risks that really matter? Traditional assessments rarely capture the sequence of actions attackers use to exploit gaps. At RSAC 2026, we’ll explore how simulating real attacker behavior uncovers exposure hiding in plain sight. Using insights from the 2026 Offensive Security Benchmark Report, we’ll break down reconnaissance, attack paths, and exploitation steps that quantify real enterprise risk. Our CEO, Rogier Fischer, along with our team of experts Matan Shavit and Guy Stockwell, will be at Moscone Center, San Francisco, March 23‑26, sharing these insights with professionals tackling the same risks. If you want to map your blind spots before attackers do, book a time with our team at the conference: https://lnkd.in/e_4dMt2F #RSAC2026 #RSAC #Cybersecurityevents

20

1 Comment

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

6

1 Comment

🚨 𝗩𝗶𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 𝗶𝗻 𝗔𝗰𝘁𝗶𝗼𝗻: A Crypto Platform’s Runtime Wake-Up Call 🚨 After Sysdig runtime detection caught a risky credential exposure in production, a fast-growing crypto trading platform realized that point-in-time scans weren’t enough. 👉 Why chase thousands of low-impact findings when you can zero in on live risks? With Sysdig, they shifted from broad vulnerability coverage to 𝗶𝗺𝗽𝗮𝗰𝘁-𝗱𝗿𝗶𝘃𝗲𝗻 𝘁𝗿𝗶𝗮𝗴𝗲 — transforming runtime insights into strategic action where it mattered most. Full story 🔗: https://okt.to/oQYBGN

18

The impact of a cyberattack comes down to speed of response. Redis's Justin Lachesky tells Brian Contos how fast mitigation of cloud incidents is what turns a potential catastrophe into an attacker walking away with empty hands. #cloudsecurity #SaaSsecurity #CDR #incidentresponse

16

1 Comment

Typosquatting Alert: Fake ghrc.io Registry Could Slip Malicious Containers Into Developer Environments 👉 Full coverage: https://lnkd.in/gYXSK64S 🚨 A fake container registry (ghrc.io) is impersonating GitHub’s legitimate ghcr.io, posing a serious software supply chain risk. 🔑 Key points: - Developers may accidentally pull malicious containers by mistyping the registry name. - Risk flagged by Max Jonas Werner in a LinkedIn post. - Experts warn this could lead to credential theft, pipeline breaches, and service disruption. - Shane Barney (Keeper Security): “Registering a lookalike domain – like ghrc.io instead of ghcr.io – isn’t a new idea, but it’s still effective.” - Boris Cipot (Black Duck): Typosquatting traps can even affect transitive dependencies, making them difficult to detect. - Trey Ford (Bugcrowd): Highlights the importance of SBOMs to track dependencies and prevent malicious code. 💡 Mitigation: double-check registry URLs, enforce least-privilege access, validate sources, and monitor for anomalies in pipelines. What controls do you use to prevent supply chain typosquatting in dev environments? #SoftwareSupplyChain #DevSecOps #Typosquatting #Containers #CyberSecurity

1

What’s going on with React? If you’re shipping React Server Components (RSC) - most commonly via Next.js App Router, there were 3 RSC-related security disclosures in December 2025. 1) React2Shell CVE-2025-55182 (Critical, CVSS 10.0) A flaw in the RSC “Flight” protocol handling can lead to unauthenticated remote code execution in unpatched environments. Important: even if you don’t expose Server Functions explicitly, you may still be impacted if your app supports RSC. 2) Denial of Service: CVE-2025-55184 + CVE-2025-67779 (High) A crafted request can hang the server process (infinite loop), taking your app down. 3) Source Code Exposure: CVE-2025-55183 (Medium) A crafted request can cause a Server Function to return compiled source of other Server Functions, leaking business logic, and potentially secrets if they were inlined into code. What to do (like, right now): - Patch to the latest fixed versions (note: if you patched “last week”, you may need to upgrade again) - 19.0 -> 19.1, 19.1.0|1 -> 19.1.2, and 19.2.0 -> 19.2.1 - Next.js: upgrade to the latest patched version in your release line, or run:  npx fix-react2shell-next - If your app was internet-exposed and unpatched around Dec 4, rotate secrets/tokens after patching - Add defense-in-depth: rate limiting/WAF + monitoring for suspicious RSC traffic - Stop hardcoding secrets in Server Functions! prefer environment variables at runtime (regardless of the presented vulnerabilities!) Need a fast sanity check on your repo + deployment path? Comment “RSC” or DM Enpitech.

1

GitLab has released a report detailing North Korean fake IT worker tradecraft. AlphaSOC highlights the use of Railway, Vercel, and JSON object storage for C2 and data exfiltration purposes. Read more here >> https://lnkd.in/eSKcZ_Uh

7

VIAVI Observer bridges the gap with the ultimate source of truth: https://lnkd.in/gZtKAYCu ✅ Root-cause visibility ✅ Post-breach forensics ✅ Cross-functional alignment. It’s not magic. It’s metadata and packets, working together.

23

For those unfamiliar with cross-region resilience, you can find white papers on that from AWS. But about losing data on failover…You need to test that scenario. The application layer needs to handle lost data and data corruption correctly. For example, in a banking application, financial transactions should use database transactions until all database actions are complete - debits and credits written to different tables and an audit record. If a system fails mid transaction the record is never written. That’s why eventually consistent systems should not be used for financial transactions. In the case of a load balancer or web site, stop accepting new requests in failing systems. Route new requests to new systems while allowing existing sessions to complete normally (if they can). All systems processing data should have a built in mechanism for recognizing and logging corrupted data, not process it, but continue to process valid data. Using queues helps store copies of transaction requests until they can be properly processed. And yes some data that gets logged due to corruption may need manual review. There are different methods for DR: hot-hot where you have systems running in multiple regions at all times so when one fails the application still works ($$$$), constant replication so you’re not copying all the data at the point of failure, and pilot light where you have a minimal version of your system and build it up at the point of failure. I worked at a bank where, not in cloud, all systems were failed over to a new region every three months in physical data centers to make sure it worked. Test the scenario and make sure your applications work correctly.

12

CVERiskPilot Beta 2.0 is live. We built CVERiskPilot to help security teams turn raw vulnerability exports into evidence-backed, reviewable remediation decisions without overstating certainty. Beta 2.0 includes: - Multi-tenant authenticated workflows - Uploads for JSON, SARIF, CSV, and XLSX - Findings triage and deep review - Remediation ticket workflows - Executive reporting - Billing and release-readiness foundations - Auditor-facing self-assessment and evidence-tracking views What matters most to us is trust: - Clear tenant isolation boundaries - Reviewable workflows - Advisory AI, not black-box automation - Evidence-oriented operations and release discipline This is still beta, and we’re treating it like beta: real workflows, real hardening, real feedback loops. If you lead vulnerability management, platform security, or security operations and want early access or want to help shape the product, we’d love to connect. #CyberSecurity #VulnerabilityManagement #AppSec #SecurityOperations #DevSecOps #SaaS #B2B #BetaLaunch

1

SOC 2 Myth: You need a board to get attested. Startups can meet CC 1.2 with leadership reviews and vCISOs. Our Co-Founder, Sammy Chowdhury explains how. Read more below. #SOC2 #Compliance #Security

19

1 Comment

Precompiled binaries are a black box risk. Without source code, you’re left with vendor docs—and guesswork. In our "Security Short", Edwin Shuttleworth stresses that the only way to truly understand what’s inside precompiled binaries is through binary analysis. Visibility matters. #BinaryAnalysis #CyberSecurity #SupplyChainSecurity

10