docs: Update SSC compromise catalog

[abhisek]

This is first in a (expected) series of PRs to update the supply chain compromises catalog.

• Fix link in index
• Update incident title to make it verbose
• Add note to review incidents that are possibly outside the scope of SSC security

[netlify]

✅ Deploy Preview for tag-security ready!

Name	Link
🔨 Latest commit	7a1993f
🔍 Latest deploy log	https://app.netlify.com/sites/tag-security/deploys/667549170eedf80008105dfc
😎 Deploy Preview	https://deploy-preview-1275--tag-security.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[mnm678]

Thanks for the changes! Let's see if we can get the categorization notes resolved before merging.

[mnm678]

This looks like it was categorized as a supply chain attack because the compromise happened at the source code

[abhisek]

Reading the referenced doc at https://www.computerworld.com/article/1439287/free-software-foundation-s-software-repository-hacked.html

I see original entrypoint for attacker was SQL Injection. Subsequently they extracted credentials from the database through SQL injection, uploaded a PHP reverse shell and gained access to the server that contains the source code for the website. There doesn't seem to be any evidence that this source code is in turn consumed by any other party. This seems like a first party attack without any impact to a third party.

If we still have to retain this, I feel we should change the classification type to Attack Chaining because a multi-step attack was performed to gain access to the server and deface the website.

[mnm678]

Re-categorizing this as Attack Chaining makes sense to me

[abhisek]

@mnm678 Updated the category. Over to you.