The LinkLoot Blog

Stop cache poisoning in GitHub Actions with read-only untrusted triggers

GitHub Actions now gives read-only cache tokens to low-trust default-branch workflow triggers, reducing cache-poisoning paths from pull_request_target, issue_comment, and workflow_run.

Check GitHub Copilot policies before enabling Claude Opus 4.8 fast mode

GitHub is rolling out Claude Opus 4.8 fast mode in Copilot preview. It targets responsive coding and agent workflows, but Business and Enterprise admins must enable it and usage-based billing applies.

Protect Cloudflare WARP macOS Registrations With Secure Enclave Keys

Cloudflare One Client for macOS 2026.6.822.0 adds hardware-backed registration with Secure Enclave support, giving Zero Trust admins a stronger defense against copied device tokens.

Check Node.js 24.18.0 LTS Before Your Next Runtime Upgrade

Node.js 24.18.0 LTS is the latest Krypton release, with root-certificate, Web Crypto, npm, SQLite, and HTTP agent changes worth testing before production rollout.

Patch LiteLLM CVE-2026-42271 Before Your AI Gateway Becomes a Shell

LiteLLM CVE-2026-42271 lets authenticated users run host commands through MCP test endpoints, and Horizon3 shows how a Starlette chain can remove the login barrier. Patch LiteLLM 1.83.7 and Starlette 1.0.1 before exposing agent infrastructure.