Hello and welcome to the Friday, March 27, 2006 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recorded today from Jacksonville, Florida.

And this episode is brought you by the sands.edu graduate certificate program

in industrial control system security. Well, you can't get quite a go of team PCP and the

supply chain compromise. Kenneth Hartman, Sands instructor, who also did the webcast I mentioned

yesterday, published a quick update as a diary.

One of the important points here is that the checkmarks compromise

affected all 91 tags that was not sort of noted initially.

I mentioned yesterday what you're seeing now is just the tip

of the iceberg. So always suspect underreporting. You must rotate credentials, even if you just

suspect that you had an issue. You may have some time as apparently Team PCP is a little bit behind

in actually using all of the credentials.

But also for future reference, you must get good at rotating credentials.

If you can't do it sort of weekly just for the fun of it without breaking anything,

then you're not good at it.

So try to get to that point.

Light LLM, well, because it was compromised, Pi Pi actually froze that particular repo

and it now has been released again.

Light LLM announced that for now they're not going to release any new releases.

The latest good one is still out there, so you can use it if you want to.

But before they're doing any new releases, they first want to go over their CI CD pipeline,

their release procedures to make sure that something like this doesn't happen again,

...