26 Million Requests Per Second — Cloudflare and the Mantis Botnet
··876 words·5 mins
Cloudflare mitigated the largest HTTPS DDoS attack ever recorded at 26 million requests per second.
- Osmond van Hemert — Senior Software Engineer & Applied AI/
- Blog Categories: AI, Security, Development & Infrastructure/
- Security Incidents, Vulnerabilities & Defense/
Security Incidents, Vulnerabilities & Defense
This category gathers posts where security is the main story: breaches, vulnerabilities, software supply-chain incidents, and the practical response to each. Use the articles below to examine how attacks work, what is known, and which defensive decisions follow from the evidence.
For incident timelines, visit Breaches & Zero Days. The Cybersecurity tag follows security themes across other categories too, including infrastructure and developer tooling.
Follina — The Zero-Day That Turns a Word Doc Into a Weapon
··921 words·5 mins
CVE-2022-30190, dubbed Follina, exploits Microsoft’s diagnostic tool through Office documents — no macros required.
Heroku's Security Breach — A Wake-Up Call for Platform Trust
··919 words·5 mins
Heroku’s OAuth token breach exposes the fragile trust chain in platform-as-a-service dependencies and what it means for developers.
Spring4Shell Is Here — Assessing the Real Risk of CVE-2022-22965
··1031 words·5 mins
A critical RCE vulnerability in Spring Framework has the internet in panic mode, but the actual risk profile is more nuanced than the Log4Shell comparisons
Lapsus$ Breaches Okta and Microsoft — An Identity Nightmare
··976 words·5 mins
The Lapsus$ hacking group has breached both Okta and Microsoft, exposing critical weaknesses in identity provider security and third-party access management.
The node-ipc Protestware Incident — Open Source as a Weapon
··966 words·5 mins
A popular npm package was deliberately sabotaged by its own maintainer, raising urgent questions about supply chain trust in open source.
HermeticWiper and the New Reality of Cyber Warfare
··830 words·4 mins
As conflict erupts in Ukraine, destructive wiper malware targeting critical infrastructure signals a new chapter in state-sponsored cyber operations.
Alpha-Omega Project — The Linux Foundation Gets Serious About OSS
··791 words·4 mins
The Linux Foundation’s new Alpha-Omega Project, backed by Google and Microsoft, aims to systematically improve the security of critical open source software.
The White House Open Source Summit — When Log4j Gets Political
··972 words·5 mins
The White House convened tech leaders to address open source security after Log4Shell. Here’s what was discussed and what it means for developers.
After Log4Shell — Software Supply Chain Security Can't Wait
·1036 words·5 mins
A week after Log4Shell, the patching chaos continues. But the bigger lesson is about software supply chain security and why we need SBOMs now.
Log4Shell — The Zero-Day That Broke the Internet's Weekend
·870 words·5 mins
A critical remote code execution vulnerability in Apache Log4j has sent the entire industry scrambling. Here’s what you need to know and do right now.
npm Supply Chain Under Siege — The coa and rc Package Compromises
··823 words·4 mins
Popular npm packages coa and rc were hijacked to distribute malware, impacting thousands of projects and raising urgent questions about supply chain security.