GitHub just confirmed that 3,800 internal repositories were stolen… through a single VS Code extension. Not a zero-day. Not ransomware. A developer plugin. This is TeamPCP’s FIFTH supply chain compromise in ~3 months, and it highlights a massive blind spot most organizations still ignore: IDE security. Most companies heavily govern: ✅ SaaS apps ✅ Cloud infrastructure ✅ Production environments …but allow developers to install extensions with virtually unrestricted access to: ⚠️ source code ⚠️ credentials ⚠️ cloud tokens ⚠️ local systems The attack surface has officially moved upstream, into the tools used to WRITE the code. If your organization hasn’t started governing developer tooling, extension usage, and workstation trust boundaries, now is the time. The GitHub breach wasn’t the anomaly. It was the warning shot. Read @jacob krells latest research here: na2.hubs.ly/H05FnMT0 #CyberSecurity #SupplyChainSecurity #DevSecOps #VSCode #GitHub #SoftwareSecurity #ThreatIntelligence #Infosec

We said it first. Now Mandiant just confirmed it. 👉 Mean Time to Exploit is now negative. Not shortened. Not faster. Negative. Attackers are exploiting vulnerabilities before organizations can even respond. That changes everything. This isn’t about patching faster or scanning more. It’s a timing problem, and most security strategies are already behind. At Suzu Labs, we’re seeing the same thing Jacob Krell just outlined in our latest research: 👉 If you’re reacting, you’re too late 👉 If you’re waiting for alerts, you’ve already missed it 👉 If you’re relying on point-in-time testing, you’re exposed The only way forward? Simulate attacks before attackers do. Continuously validate what actually breaks. Because in a world of negative exploit timelines… you don’t get a head start anymore. 📖 Read the full breakdown: na2.hubs.ly/H05hMNP0 🔗 See how we help teams stay ahead: na2.hubs.ly/H05hNvb0

I am very excited about CYBR.HAK.CON.. We finalized the agenda and speakers, and we have some amazing speakers. @Jhaddix from @arcanuminfosec is our opening keynote, and my BF and @Dallas_Hackers founder @DHAhole is our closing keynote. @TimMedin, @sociosploit, @Larci007, @dkfredde, and the CCN crew (@BarCodeSecurity, @hacker_213, @DistortionCyber), and @hackerfren, are some of the other speakers. Check out the full lineup and get your ticket here cybrhakcon.com! @CybrSecCon @thehackermaker