Research Domain

Web Security & Supply Chain

2 published observations collected under this domain with verified sources.

GitLab repository API path traversal incident moving from patching into forensic verification

GitLab's Critical File-Read Flaw Shows Why Patching Is Only the First Incident-Response Step

GitLab patched CVE-2026-85706 on September 10 and CISA added it to the Known Exploited Vulnerabilities catalog on September 11. The newer operational signal is GitLab's guidance for checking whether suspicious requests actually disclosed file contents.

2026-09-19#GitLab · #CVE-2026-85706

Web Security & Supply Chain7 min read

The Brevo Breach Shows How One Edge Credential Can Turn a Trusted Web Widget Into a Supply-Chain Attack

Brevo's September 14 incident is a useful case study in a web supply-chain boundary that file-integrity checks can miss: attackers changed responses at the CDN edge while origin files stayed untouched.

2026-09-19#supply-chain security · #Cloudflare