CSPM Zero-Days, Extension Audits, and GitHub Attack Paths

Analysis

Chrome Extension's DevTools Smuggling Attack Hijacks GraphQL Queries

A deep dive into the security gap tenants create when they blindly trust first-party Chrome extensions. Shows how a malicious extension can impersonate DevTools to hijack GraphQL queries. Worth a read if your team builds or audits browser-based tools.

Tools

Gato v1.6: Extended GitHub Attack Path Mapping and Fork Auditing

Gato just got a major upgrade for mapping attack paths in GitHub organizations. It now auto-discovers sensitive workflows and secrets in forks, not just the main repo. A must-have tool for auditing your GitHub footprint before an attacker does.

News

FortiSwitch RCE Flaw Allows Unauthenticated Attackers to Take Over Devices

Another day, another VPN flaw: Fortinet warns of an unauthenticated RCE in FortiSwitch devices. It's being chained with earlier FortiOS bugs. Treat your network edge devices as the hostile perimeter they are.