Categories
Security
Breach post-mortems, disclosed CVEs, and what they change for the rest of us.
-
Coder registry compromise: the origin pool was the identity
Attackers joined the Cloudflare pool behind Coder's module registry and served credential-stealing Terraform modules. TLS held. The trust behind it didn't.
-
Three unauthenticated CVSS 10s in the system that approves access
ServiceNow patched three unauthenticated CVSS 10.0 flaws. When the platform that records approvals is writable before login, its records become claims to verify.
-
The audit log will say the admin did it
CISA's Metasys advisory (CVE-2026-34491) describes low-privilege XSS that executes in admin sessions. Every action it takes will be logged as the admin.
-
MFA ends at login. Account takeover doesn't.
The login ceremony gets hardware keys and biometrics. Everything after it rides on a cookie. The session, not the password, is where takeover happens now.