Endor Labs has a story on a GitHub based supply chain attack that’s worth reading. Though only 218 repositories out of the 23,000 exposed secrets in the supply chain attack on the GitHub Action tj-actions/changed-files, the impact is still significant as some repositories are very popular and could be used in new supply chain attacks. Details below:
https://www.endorlabs.com/learn/blast-radius-of-the-tj-actions-changed-files-supply-chain-attack
Jim Routh, Chief Trust Officer at Saviynt, commented:
“This information represents excellent work by the writer, Henrik Plate from Endor Labs to demonstrate how threat actors use compromised credentials to access the software supply chain. Although the scope and impact, in this case, are not widespread, the threat actor tactics are useful to understand, due to the exploitation of non-human and human account credentials. This represents another reminder for enterprises to invest in more robust privilege access management capabilities (including continuous validation) applied to those with access to the software supply chain for the enterprise.”
Any organization that uses GitHub should read this report by Endor Labs as it provides a whole lot of insight of how threat actors can execute an attack like this. Thus giving you more insight in terms of how to stop them.
Apple Gets Sued Over The Apple Intelligence Debacle
Posted in Commentary with tags Apple on March 21, 2025 by itnerdSeeing as Apple was hyping Apple Intelligence to sell iPhones and Macs, and then had to back away from that when they delayed the new Siri, you knew that a lawsuit was going to be inbound. And sure enough, here’s the lawsuit:
The suit, filed Wednesday in U.S. District Court in San Jose, seeks class action status and unspecified financial damages on behalf of those who purchased Apple Intelligence-capable iPhones and other devices.
And:
“Apple’s advertisements saturated the internet, television, and other airwaves to cultivate a clear and reasonable consumer expectation that these transformative features would be available upon the iPhone’s release,” the suit reads.
Now I am not a lawyer, but I think that this has merit. Apple did hype Apple Intelligence massively and they did tie it into product launches. So I can see how someone might be a bit ticked off if they bought a new iPhone and some of the key features of Apple Intelligence were not there or didn’t work the way one would have been led to believe. Thus I think Apple might have a problem here that their team of lawyers might have difficulty swatting away. The usual this hasn’t been tested in court applies here. But I suspect Apple is going to focus their efforts in terms of settling this out of court as fast as they possibly can.
2 Comments »