https://blog.cybercult.biz Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence. en-us Fri, 04 Sep 2026 10:45:25 +0000 https://blog.cybercult.biz/posts/2026-09-04-coder-registry-compromise/ On August 31, 2026, threat actors compromised the Cloudflare account governing cloud development platform Coder, injecting unauthorized IP addresses into the origin pool for <code>registry.coder.com</code>. Over a fourteen-hour window, the rogue endpoints selectively intercepted inbound requests and delivered modified Terraform modules containing credential-harvesting code to engineers across enterprise and public-sector environments. Coder responded by removing the rogue IP addresses, terminating active administrative sessions, and distributing updated integrity hashes, though the breach underscores how upstream traffic tampering can outmaneuver otherwise vigilant cybersecurity defenses. Fri, 04 Sep 2026 12:00:00 +0000 https://blog.cybercult.biz/posts/2026-09-04-coder-registry-compromise/