Tag

Automation

2 posts

October 2026

The Token That Published the Worm: Trusted Publishing, Sigstore, and Provenance After Shai-Hulud Shai-Hulud did not exploit npm. It read publish tokens out of developers' .npmrc files and environment variables, used them to push poisoned versions of the victims' … Research 27 min read

September 2026

The Certificate Nobody Renewed: 47-Day TLS, ACME Renewal Information, and the End of Revocation as a Safety Net The 200-day certificate limit has been in force since 15 March 2026. The 100-day limit arrives on 15 March 2027 and the 47-day limit two years after that, with … Engineering 26 min read

All posts