As GitHub Actions are retrieved from Git, they should be defined using SHAs rather than Git tags to protect them from supply-chain attacks. GitHub Actions now support workflow lockfiles for this purpose: https://www.python4data.science/en/latest/productive/security/environments.html#check-your-github-actions
#GitHub #Git #SupplyChain #ITSec
#itsec — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #itsec, aggregated by home.social.
-
-
I thought the Cybersecurity Awareness Month is over? But on and on and on it goes: https://www.wordfence.com/blog/2026/11/cve-2026-119618-apache-http2/
Only affects apache web servers where HTTP2 is enabled, but then it could be potentially serious. Debian has already new packages out, and upgrade is as easy as `apt upgrade` (or to be very specific and leave the rest of the system untouched `apt install --only-upgrade apache2`).
So go upgrade now!
-
Update Git! Version 2.56.1 patches several security vulnerabilities, including CVE-2026-111760: Code execution during recursive clones and CVE-2026-113408: Path traversal through a server’s advertised HEAD
https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/
#Git #ITSec #DevOps