supply chain · Mon 27 Jul 2026 · 08:07 UTC
A poisoned package can land in a Dependabot update PR before registries remove it. GitHub is adding a 3-day cooldown for routine version updates, while security fixes will still move immediately. Why three days, and what the delay cannot stop: https://thehackernews.com/2026/07/github-adds-3-day-dependabot-cooldown.html
Filed UTCSource X ↗
<p>⚡ A poisoned package can land in a Dependabot update PR before registries remove it.<br /> <br /> GitHub is adding a 3-day cooldown for routine version updates, while security fixes will still move immediately.<br /> <br /> Why three days, and what the delay cannot stop: <a href="https://thehackernews.com/2026/07/github-adds-3-day-dependabot-cooldown.html">thehackernews.com/2026/07/gi…</a></p> <img src="https://nitter.net/pic/media%2FHOOD9xKagAAHwCY.jpg" />…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.