BLOG TAG
github
2 posts on this topic. For the full archive, see the security blog. Comparison writes-ups live on Why Puaro and the methodology page.
All posts
Security Insights6 min readMay 06, 2026
The New "Git Push": How Prompt Injection Became a Critical RCE Vector
CVE-2026-3854 proved that a single git push can compromise millions of repositories without touching a single line of application code. Combined with CVE-2025-53773 and EchoLeak, 2026 has made one thing clear: prompt injection is now a production-grade threat vector, not just a curiosity.
Security Insights5 min readSep 29, 2025
The GhostAction Attack: How 3,300+ Secrets Were Stolen from GitHub Repositories
A large-scale campaign abused GitHub Actions to exfiltrate 3,325 secrets from 817 repositories and 327 users. Learn how it worked and how to secure CI/CD pipelines.