Secure by Design

The Salesloft/Drift OAuth Breach: When Your SaaS Integrations Become Attack Vectors

by

Executive Summary The Salesloft Drift OAuth breach (August 2025) compromised 700+ organizations through weaponized OAuth tokens, demonstrating why product security teams must threat model SaaS integrations as untrusted attack surfaces. This analysis examines the technical mechanics, architectural anti-patterns, and secure-by-design lessons for teams building or evaluating third-party integrations. The Attack: Six Months of Silent Credential … Read more

Stop Treating LLM Agents as Trusted Users: Lessons from GitLab CVE-2021-39935

by

CISA added CVE-2021-39935 to the KEV catalog on February 3, 2026 – a 2021 GitLab SSRF vulnerability now seeing active exploitation. The federal remediation deadline is February 24, 2026. This is worth examining not because it’s novel (GitLab patched it in October 2021), but because the threat model around CI/CD attack surfaces has fundamentally changed … Read more

Don’t Pipe URLs into Shell Scripts: Lessons from CVE-2026-1281

by

On January 29, 2026, Ivanti publicly disclosed two critical Ivanti EPMM zero-days (CVE-2026-1281 and CVE-2026-1340, CVSS 9.8) that expose a high-risk anti-pattern: shell scripts processing untrusted HTTP input inside privileged management infrastructure. At a high level, these were pre-auth RCEs enabled by unsafe shell evaluation semantics (not just string handling). The root cause traces to … Read more

Thoughts on Fortinet’s CVE-2026-24858

by

Fortinet’s CVE-2026-24858 highlights a critical architectural anti-pattern that every product security team should understand: authentication bypass through alternate paths in SSO implementations. This critical zero-day (CVSS 9.4) allowed attackers with any FortiCloud account to authenticate to other customers’ FortiOS, FortiManager, and FortiAnalyzer devices – even on fully patched systems that had addressed previous SSO bypasses … Read more