Picture an admin opening the Microsoft Entra sign-in logs on a Friday evening and finding a sign-in from an app the company approved long ago. There is no user, no device and no MFA prompt. The source is a hosting provider address, not Microsoft's network. Nobody in the tenant clicked anything, and nobody in the tenant held the credential that signed in. ConnectWise says it identified unauthorized access to application identities associated with its Cloud Backup environment,

GitHub disabled two compromised actions-cool Actions in May but never cleaned their release tags. When the repos came back on 16 September, every workflow still pinned to a mutable tag resumed stealing CI secrets on its own. Here is how to hunt the reopen window in KQL, Falcon CQL, Splunk and Kibana.

SHA pinning was supposed to freeze a reviewed plugin at one commit. Four major AI coding agents check out the pinned hash without verifying what landed. What Plugin4Shell allows, which agents are patched, and how to hunt it on developer endpoints.

A software repository sits between the people who build software and the systems that run it. When that repository is compromised, the investigation needs to answer more than whether someone accessed a server. It needs to establish whether the company can still trust the identities, credentials, and artifacts passing through it. Recent Artifactory exploitation illustrates why. Two vulnerabilities allow an attacker to obtain a token and escalate its authority. A separate vulne