Signing and software updates

Design firmware updates that can recover safely

Connect trusted boot, update authorization, rollback policy and end-of-life behavior to the device’s actual failure modes.

Development, Release · Developers, AppSec engineers

Case study: CrowdStrike Channel File 291 (July 2024)

How a CrowdStrike content update crashed Windows hosts in July 2024: a field-count mismatch hidden by wildcard tests, a missing bounds check, and no staged rollout.

Development, Release, Maintenance · Developers, Platform engineers and SREs

Review SBOM changes between releases

Turn inventory differences into explainable release decisions without confusing generator changes with software changes.

Release · AppSec engineers, Platform engineers and SREs

Verify artifact signatures against an explicit trust policy

Require the expected artifact, signer and release context before allowing a signed package or image to proceed.

Release · Developers, Platform engineers and SREs

Protect package publication and the update channel

Constrain release identities, verify what consumers receive, and prepare for publisher or update-key compromise.

Release · Developers

Case study: the Shai-Hulud npm worm (2025-2026)

How a self-replicating npm worm turned stolen tokens into hundreds of infected packages in 2025, how its 2026 successors hijacked release pipelines and trusted publishing, what npm and GitHub changed in response, and the publishing, install and response practices that stop it.

Development, Release, Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Case study: the SolarWinds Orion build compromise (SUNBURST)

How an implant on SolarWinds' build server inserted the SUNBURST backdoor into signed Orion updates in 2020, how it was found, why code signing and review could not catch it, and which build controls would have.

Release, Maintenance · AppSec engineers, Platform engineers and SREs

Case study: the Codecov Bash Uploader compromise (2021)

How a credential leaked through Codecov's Docker image process let an attacker change the Bash Uploader that many CI pipelines downloaded and ran, which sent their environment variables, and the secrets in them, to the attacker for two months in 2021.

Development, Release, Maintenance · AppSec engineers, Platform engineers and SREs

Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059)

How a trojanized trading application on one employee's personal computer led to 3CX's build servers and to signed, malicious 3CX DesktopApp releases in 2023: the first cascading software supply-chain compromise Mandiant had seen, how EDR caught it, and the controls that would have stopped it.

Release, Maintenance · Platform engineers and SREs

Protect the source repository: rulesets, reviews and signed commits

Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.

Development, Testing, Release, Security program · Developers, AppSec engineers, Platform engineers and SREs

Staged rollout and rollback for security-critical updates

Ship security fixes, detection content and configuration quickly without taking the fleet down: rollout rings and canaries, content validation, kill switches and rollback that works on a broken host.

Release · AppSec engineers, Platform engineers and SREs

Harden container images from Dockerfile to admission

Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.

Development, Release, Maintenance · Developers, Platform engineers and SREs

Flame: MD5 certificate forgery

Follow how a weak digest and an overpowered certificate trust path enabled forged code-signing authority, without equating the event with RSA key theft.

Design, Release, Maintenance · Developers

Treat model releases as executable supply-chain inputs

Verify provenance, constrain loading and preserve the relationship between model weights, configuration and runtime dependencies.

Development, Release · Developers, AppSec engineers, Platform engineers and SREs

Case study: the Nx s1ngularity compromise and its AI-assisted payload (2025)

How a pull-request-title injection in a GitHub Actions workflow on an outdated branch gave an attacker the Nx npm token in August 2025, how the malicious versions tried to turn developers' own AI command-line tools into file-search agents, and the workflow, publishing and agent controls that stop the same chain.

Design, Development, Release, Maintenance · Developers, Platform engineers and SREs

Signed artifact provenance lab: Reject a release from the wrong producer

A deployment gate accepts any signed artifact. A valid signature from an unrelated repository can therefore reach production. Repair the trust policy applied to verified evidence.