Case studies
31 real incidents and attacks, newest first: what happened, the control that failed and what to change in your own systems. Each case study links to the guides that fix the cause.
| Year | Case study | Category | Key lesson |
|---|---|---|---|
| 2025–2026 | Case study: the Shai-Hulud npm worm (2025-2026) | Supply chain · Dependencies and VEX | Remove long-lived publish tokens: publish with trusted publishing from one protected workflow. |
| 2025 | Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025) | Runtime & cloud · Containers, Kubernetes and service identity | An admission webhook is a network service: let only the control plane reach it, and scope controller access to Secrets. |
| 2025 | Case study: the Amazon Q Developer extension compromise (2025) | AI security · Agents, tools and MCP | Keep write tokens away from untrusted builds, and keep AI agents from acting alone. |
| 2025 | Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025) | AI security · Agents, tools and MCP | Assume malware can drive any AI agent installed on a machine it runs on. |
| 2025 | Case study: the tj-actions/changed-files compromise (CVE-2025-30066) | Supply chain · CI/CD and builds | Pin third-party actions to a full commit SHA; a version tag can be moved to new code. |
| 2024 | Case study: CrowdStrike Channel File 291 (July 2024) | AppSec · Mobile, desktop, embedded and smart contracts | Release content that drives privileged code like code: validate it against the consuming code and stage it through rings. |
| 2024 | Case study: the polyfill.io CDN takeover (2024) | Supply chain · Dependencies and VEX | Every external script tag delegates control of your page to whoever owns that domain, now and after any future sale. |
| 2024 | Case study: the xz Utils backdoor (CVE-2024-3094) | Supply chain · Dependencies and VEX | Build from the tracked source, or prove the release tarball matches it: the backdoor was in the tarball, not the repository. |
| 2023 | Case study: Citrix Bleed (CVE-2023-4966) | AppSec · Vulnerability response | When a flaw can leak session tokens, the fix is patch plus revocation: kill every session after updating. |
| 2023 | Case study: Microsoft AI researchers' over-permissive SAS token (2023) | Runtime & cloud · Cloud and infrastructure as code | A signed storage URL is a bearer credential: scope it to one object, keep it short-lived, and treat scanner hits as live secrets. |
| 2023 | Case study: MOVEit Transfer mass exploitation (CVE-2023-34362) | AppSec · Vulnerability response | Internet-facing systems that aggregate other people's data are prime targets for mass exploitation; reduce what they expose and what they keep. |
| 2023 | Case study: Storm-0558 and the forged Microsoft tokens (2023) | Identity & crypto · Federation and tokens | Bind every signing key to its issuer and never let key rotation stop silently: a 2016 consumer key signed enterprise tokens in 2023. |
| 2023 | Case study: the CircleCI security incident (January 2023) | Runtime & cloud · Cloud and infrastructure as code | A stolen session must not equal production access; as a CI user, federate with short-lived OIDC credentials instead of storing secrets. |
| 2023 | Case study: the Okta support-system breach and session tokens in HAR files (2023) | Identity & crypto · Sign-in, sessions and recovery | Treat HAR files, logs, crash dumps and screen recordings as credentials: sanitize before upload, sanitize again on arrival, restrict who can read them and delete them when the case closes. |
| 2022–2024 | Case study: Moffatt v. Air Canada, a chatbot that misstated the refund policy (2022-2024) | AI security · LLM applications | Treat every automated answer on your site as your own, and test it against your policy. |
| 2022–2023 | Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059) | Supply chain · CI/CD and builds | Your supply chain includes the software your employees install, not only the dependencies your code imports. |
| 2022 | Case study: Spring4Shell (CVE-2022-22965) | AppSec · Secure coding | Bind only the fields a form declares, and stay on a framework line that still gets security fixes. |
| 2022 | Case study: the LastPass breach (2022) | Identity & crypto · Encryption, keys and secrets | Treat backups and their decryption keys as production data. |
| 2021 | Case study: Log4Shell (CVE-2021-44228) | AppSec · Vulnerability response | Know where every copy of a component runs, including shaded and nested JARs, before the next advisory. |
| 2021 | Case study: the Codecov Bash Uploader compromise (2021) | Supply chain · CI/CD and builds | `curl | bash` in CI hands a vendor's storage bucket the ability to run code with all your pipeline's secrets. |
| 2020 | Case study: the SolarWinds Orion build compromise (SUNBURST) | Supply chain · CI/CD and builds | Treat the build system as production: isolate it, rebuild it from a known image for each release, and restrict who and what can reach it. |
| 2019 | Case study: First American's EaglePro document exposure (2019) | AppSec · Access control | Authorize every object access, and make sure a penetration test finding cannot lose severity on its way to the tracker. |
| 2018–2020 | Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot | Identity & crypto · Encryption, keys and secrets | Ericsson's certificate was built into software that had run for about nine months; nothing in the operators' own renewal processes could see it. |
| 2018 | Case study: event-stream and ua-parser-js, two npm package takeovers | Supply chain · Dependencies and VEX | Maintainer burnout is a security issue: a package with one tired maintainer can change hands with an email, as xz Utils showed again in 2024 (/domains/supply-chain/dependencies/case-study-xz-utils/). |
| 2017 | ROCA: structured RSA key generation | Identity & crypto · Keys, signatures and PKI | Patch first, generate again, then replace trust. |
| 2016 | DROWN: one RSA key across incompatible protocols | Identity & crypto · Broken encryption | Close the oracle everywhere the key is used. |
| 2016 | Sweet32: the cost of a small block size | Identity & crypto · Broken encryption | Treat cryptographic lifetime as a measurable quantity. |
| 2015 | FREAK and Logjam: export-grade key exchange | Identity & crypto · Keys, signatures and PKI | Remove export paths and validate the actual parameters. |
| 2013–2014 | Lucky Thirteen and POODLE: two different oracles | Identity & crypto · Broken encryption | Match remediation to the causal path. |
| 2012 | Flame: MD5 certificate forgery | Identity & crypto · Keys, signatures and PKI | Contain the authority and invalidate the vulnerable path. |
| 2001 | WEP: RC4 key reuse and weak IVs | Identity & crypto · Broken encryption | Nonce allocation, authentication, and replacement are separate tasks. |
7 of these are historical attacks on cryptography, kept for what they teach about design. For response guidance, see the guides for the Respond stage and the Respond to a vulnerability workflow.