55
55
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
55
55
60
55
55
55
30
55
30
30
42
55
30
30
30
30
55
55
60
42
55
55
55
55
30
55
30
35
55
We got admin access to Baseten's production GitHub in 25 minutes
Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.
Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.
58
55
55
30
55
55
55
60