Topic Thread
3 published observations tracking this thread.
The important change is organizational: AI defense is being treated as shared infrastructure, with open tools, common evidence and a proposed confidential findings exchange rather than isolated vendor controls.
GitLab patched CVE-2026-85706 on September 10 and CISA added it to the Known Exploited Vulnerabilities catalog on September 11. The newer operational signal is GitLab's guidance for checking whether suspicious requests actually disclosed file contents.
The new fact is not that TanStack was compromised in May; it is that a credential stolen then was later used to copy CrowdSec's private repositories, showing why offboarding and token revocation remain part of supply-chain incident response.
