CI/CD
Browse all articles, tutorials, and guides about CI/CD
4posts
Posts
⌘K
CI/CD
|11 min read
One git push to RCE: the anatomy of CVE-2026-3854 and the parsing bug behind it
A single git push could execute code on GitHub's backend, with cross-tenant reach on github.com itself. The root cause is a bug you almost certainly have somewhere too: untrusted input smuggled through a delimited internal header.
CI/CD
|11 min read
The pwn request just got harder: what actions/checkout v7 changes, and what it does not
GitHub is backporting a fork-checkout block to actions/checkout, with enforcement on July 20, 2026. Here is what a pwn request actually is, what the change stops, and the three ways your pipeline is still exposed after you upgrade.
Security
|11 min read
Your GitOps Controller Is Tier Zero: the Argo CD repo-server RCE
An unauthenticated RCE in Argo CD's repo-server turns one compromised pod into full cluster takeover. Reported 18 months ago, still unpatched. Here is how it works and the one control that stops it.