Corentin Bonneton

🚀 Just launched: ExtendDB — an open source DynamoDB-compatible adapter written in Rust. ✅ Full wire-protocol compatibility ✅ PostgreSQL storage backend ✅ Pluggable architecture for more backends ✅ Works with existing AWS SDKs & CLI Apache 2.0 | v0.1 — come build with us 🛠️ go.aws/4fzBl2C

Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets - StepSecurity stepsecurity.io/blog/laravel-l…

‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code. - Affects NGINX 0.6.27 through 1.30.0 - Triggered via the rewrite and set directives in config - Update NGINX ASAP - NGINX is a widely used HTTP web server, be sure to check its prevalence in other products

From REST to gRPC: Architecting High-Performance APIs in Python by @VineetSharmaIoT medium.com/p/from-rest-to…

Update: Socket has found 121 more compromised npm package artifacts across 84 package names, including 64 UiPath artifacts. Combined w/ TanStack, the current known total is 205 affected npm package artifacts across enterprise automation, AI/MCP, auth, workflow, and dev tooling.

Yesterday @coinbase experienced a multi-hour service disruption affecting trading, exchange access, and balance updates. Here's our initial read from Coinbase engineering on what happened, how we recovered, and what we're addressing. At approximately 23:50 UTC on 2026-05-07, our monitoring detected cascading quote failures from internal services that triggered multiple Sev1 incidents that engineering immediately began investigating. Customer-facing impacts included spot trading, Prime, International and derivative exchanges. Root cause: a thermal event (cooling system failure) inside a subset of racks within a single building in AWS us-east-1. We run a primary replica of our exchange infrastructure in a single zone, consistent with industry standards to reduce latency. To prepare for failures like this, we maintain a distributed standby, but during this incident, failures in the primary zone that were designed to be isolated were not, extending the duration of our outage. The failure cascaded down two paths: 1. Multiple hardware components beneath our exchange’s matching engine failed, requiring recovery and failover 2. Distributed Kafka clusters that manage messaging across Coinbase systems failed to remain available, also requiring partition failovers to new hardware brokers with many TiBs of data After isolating the incident: automated tooling drained ~10 Kubernetes clusters worth of related workloads out of the affected zone to stabilize internal services. Most services were back to normal within ~30 minutes of diagnosis. The two things we couldn't automatically drain: the exchange (dedicated hardware and storage) and Kafka (managed service that was designed to be resilient to this, with unique problems). The exchange matching engine is the core system responsible for processing orders and maintaining order books. It is a distributed cluster and requires quorum to safely elect a leader and continue processing trading activity. During the incident, infrastructure-level constraints in the affected datacenter left only a subset of nodes healthy, preventing the cluster from reaching quorum. As a result, trading across Retail, Advanced, and Institutional exchanges were blocked. Recovery required our oncall and engineering teams to execute our disaster recovery plan, restore quorum safely, and validate system health under constrained infrastructure conditions. The team built, tested, deployed, and validated the fix while continuing to manage the broader incident. Kafka recovery was a much larger scale operation. Our primary managed Kafka partitions process many terabytes of data daily and are designed with resiliency guarantees for uninterrupted operation during a datacenter failure just like this. In this case, those guarantees failed and required manual recovery. We again relied on disaster recovery procedures to recover stuck partitions onto new hardware (brokers) that enabled us to safely bring x-service messaging back online across Coinbase. During the lag, customers saw delayed balance streams which resolved automatically once replication caught up. No data lost. Once the engine came back up as part of our standard runbooks, we re-opened markets carefully: all products to cancel-only mode first, audited product states, then moved all markets to auction mode, before restoring trading on Coinbase Exchange. What went right: the team. Incident response across the company came together within minutes, followed well-rehearsed playbooks and used secure automation tooling to recover all services. We have a strong, senior team at Coinbase that worked through rare failure modes to recover all services. To our customers: losing access to your account, even temporarily, is unacceptable. We know that. We're sorry, and we’ll publish a full root cause analysis in the coming weeks 🙏

"Please meet our new CEO" The new CEO:

🚨 SECURITY ALERT: The popular PyPI package lightning has been compromised in a supply chain attack. ⚠️ Affected Versions: 2.6.2 and 2.6.3

LE WD-40 c'est la vie !

If you’re a Vercel user acting on today’s security incident, here are some best next steps: > Rotate all secrets in your Vercel dashboard immediately > Bulk-migrate env vars to sensitive variables (@infisical has a Vercel sync you can use to quickly mark all secrets as sensitive) > Set up automations to rotate DB creds and API keys on a schedule > Use dynamic secrets, so DB credentials are short-lived > Pull secrets at runtime through our SDKs instead of storing them in Vercel > Make sure you have audit logs to see what was accessed

👉 Attendez-vous à une vague d'annonces de fuites de données dans les prochaines semaines. ➡️7 500+ sites Magento défacés en quelques heures dans une campagne de hacking coordonnée à l'échelle mondiale. Magento, c'est l'un des CMS e-commerce les plus utilisés au monde — il propulse des centaines de milliers de boutiques en ligne, des PME aux grandes enseignes. Derrière chaque site compromis : des données clients exposées, des coordonnées bancaires à risque, des tokens de session volables. Les sites e-commerce qui n'ont pas patché leurs instances Magento sont des cibles faciles. 🔴 Si vous gérez un site e-commerce sous Magento : vérifiez vos versions, auditez vos logs, activez un WAF. Maintenant. securityaffairs.com/189734/hacking…

🚀 Nouveau chez @HostMyServers Flatcar Linux est disponible en un clic sur vos VPS depuis votre espace client ! Distribution immuable, cloud-native, parfaite pour vos workloads conteneurisés ⚙️🐳 👉 flatcar.org #Linux #Kubernetes #DevOps #VPS

🚨 Composer 2.9.6 and 2.2.27 are out with fixes for CVE-2026-40261 and CVE-2026-40176, both command injection issues in the Perforce driver. Run composer self-update now. No exploitation detected on Packagist.org and Private Packagist. #php #phpc #composerphp

🚩New Axios Vulnerability Exposes Apps to Remote Code Execution cyberpress.org/axios-vulnerab… Unfortunately, Axios is in the news again. A critical flaw (CVE-2026-40175) enables remote code execution and full cloud compromise. Attackers can chain prototype pollution, SSRF, and request smuggling to bypass AWS IMDSv2 and steal credentials. A public PoC is already available, increasing risk. Just two weeks after the Axios npm compromise, another critical issue emerges. If you rely on Axios, patching and dependency auditing should be a priority. #Infosec #ThreatHunting #CyberSecurity

@SeeMyPing Je pense que si sur Allianz direct.

@Titin_dev ouais, et du coup meme plus d'app mobile pour voir son contrat ou quoi j'y comprends rien

j'vais crever Luko c'est vraiment devenu de la merde

MarkItDown : un outil Python Open Source développé par Microsoft permettant de convertir une grande variété de fichiers (PDF, Word, Excel, images…) en Markdown. 👉 github.com/microsoft/mark…

New React CVE just dropped 😆 DOS vulnerability in Server Functions Patched versions already out: - 19.0.5 - 19.1.6 - 19.2.5

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software. It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans. anthropic.com/glasswing

🚨 A high-vulnerability CVE (CVE-2026-4342) has been identified in ingress-nginx. This vulnerability enables configuration injection and potential code execution on all versions below v1.13.9, v1.14.5, and v1.15.1. As ingress-nginx is now EOL (End of Life), users are strongly encouraged to upgrade and migrate immediately. Details: github.com/kubernetes/kub…