Railway says attacker stole secrets and incurred about $740,000 in charges
An upper limit of about 100,000 workspaces may have had environment variables decrypted; Railway reset 1,852 tokens.
1
Stories per day · 30 days
4 RSS
Relatedgithub2npm2slugfest2supply-chain2trusted-publishing2bloom-security1credential-theft1decentralized1e2ee1keycloak1llmjacking1package-hijacking1railway1secrets1tidecloak1zero-knowledge1
11 stories, newest first · one card per story
Stories tagged #oidc
TideCloak: Keycloak authority replaced with decentralized Fabric
TideCloak delivers OIDC-compatible IAM with zero-knowledge auth and E2EE via threshold cryptography on the Tide Fabric.
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub expires unused npm trusted-publisher configs after 48 hours following a slug-reuse flaw affecting 1,500-plus packages.
Over 1,500 npm packages exposed by Trusted Publishing validation flaw
A now-fixed npm Trusted Publishing flaw exposed over 1,500 packages to repository-name hijacks.
4
CVE-2026-79650: Apache CXF: OIDC RP Open Redirect
Apache CXF’s OIDC relying party can redirect authenticated users to an attacker-controlled URL.
Microsoft Entra TrustSink Attack Uses Rogue MFA Provider to Steal Passwords
Varonis disclosed TrustSink, a post-compromise Entra technique using a rogue MFA provider to steal passwords.
Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure
Google Threat Intelligence published a defense-in-depth blueprint for hardening CI/CD pipelines against actively exploited supply chain attack vectors.
SAML: A fractal of bad design
Security research argues SAML is a legacy protocol with fundamental design flaws and should be deprecated for OpenID Connect.
2
CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
Apache Syncope's OIDCC4UI extension leaks OIDC client secrets in the provider list to any authenticated user, versions through 4.1.2 affected.
Product showcase: Doppler secures secrets for humans, pipelines, and AI agents
Doppler's secrets management platform centralizes credentials for engineers, CI/CD pipelines, MCP servers, and AI agents with runtime injection and dynamic secrets.
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.
2