This week’s most requested feature: a “rotate all secrets” button. ☕
Security updates making developers reconsider their weekend plans, 19–23 October:
• OpenCode Console: API-key exposure affecting 1.4% of Console users, disclosed last weekend and reported Monday.
• OpenCode MCP: A separate Windows/WSL code-execution flaw disclosed this week, patched in September.
• Railway: Possible exposure of stored secrets; users advised to rotate credentials and review logs.
• PHP: Two critical remote-code-execution vulnerabilities patched.
• ConnectWise: Cloud Backup credential compromise; customer Microsoft 365 environments need investigation.
• Plex: Attackers exploiting previously patched flaws to install miners and proxies.
• eMudhra: Weak certificate-authority keys triggered revocations and browser protections.
• Oracle: 1,295 security patches in October’s update.
Different incidents. One engineering reminder: every integration adds a trust decision.
Patch runtimes. Revoke exposed keys. Review permissions. Check for persistence.
And give “temporary” credentials an actual expiry date. 😅
#Nullers #CyberSecurity #SoftwareEngineering #DevSecOps
commit 9df0bc8