https://book.llcczz.org/tags/supply-chain/Recent content in Supply Chain on lcz's BlogHugoen-USFri, 28 Nov 2025 00:00:00 +0000https://book.llcczz.org/posts/cicd-github-actions-secrets/Fri, 28 Nov 2025 00:00:00 +0000https://book.llcczz.org/posts/cicd-github-actions-secrets/Build pipelines hold credentials to everything, run code from untrusted contributors, and are rarely in scope. That combination is why they get compromised.https://book.llcczz.org/posts/xz-utils-backdoor-cve-2024-3094/Fri, 05 Apr 2024 00:00:00 +0000https://book.llcczz.org/posts/xz-utils-backdoor-cve-2024-3094/A near-miss that would have put a backdoor in sshd across major Linux distributions, undone by a curious engineer noticing sshd was 500ms slower.https://book.llcczz.org/posts/log4shell-cve-2021-44228/Wed, 15 Dec 2021 00:00:00 +0000https://book.llcczz.org/posts/log4shell-cve-2021-44228/A week after disclosure, what we knew about the Log4j JNDI flaw, why the blast radius was so large, and how to find affected systems.