Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Shai-Hulud: A Persistent Secret Leaking Campaign

On September 15, a new supply chain attack was identified that targeted the @ctrl/tinycolor and 150 other NPM packages. The attack scenario was similar to the one used in the s1ngularity and GhostActions campaigns. The threat actors combined a local environment secrets extraction with a malicious GitHub actions workflow injection in accessible projects. The compromised packages' structure has been detailed in blog posts by socket.dev and StepSecurity.

From Shadow IT to Shadow AI: The Evolution of Unseen Risk

Security leaders are well acquainted with Shadow IT; the unsanctioned apps, services, and even devices employees adopt to bypass bureaucracy and accelerate productivity. Think rogue cloud storage, messaging platforms, or unapproved SaaS tools. These all often slip past governance until they trigger a breach, compliance issue, or operational failure. Now, a more complex threat is emerging - Shadow AI.

How to Setup SAML SSO + SCIM for Confluence with Azure AD / Entra ID as IdP

This video tutorial walks you through the configuration of the miniOrange SAML SSO + SCIM for Confluence with Azure AD as your Identity Provider (IdP). Learn how to seamlessly integrate Azure AD/Entra ID for secure Single Sign-On (SSO) and automated user provisioning. With this plugin, you can: Enable login to Confluence using Azure AD credentials Automatically provision and sync users from Azure AD to Confluence Map Azure AD groups to Confluence roles for role-based access control.

Master regulatory compliance: Dominate change before it dominates you

In this article Change is no longer the exception; it’s the baseline. As we move into 2025, regulatory compliance is morphing faster than many organizations anticipated. New laws, shifting political priorities, disruptive technologies such as AI and IoT, and rising expectations from stakeholders are all combining to reshape what compliance looks like.