DevSecOps
Certificate Renewal Is a Deployment Workflow, Not a Cron Job
Franz Alliod | | automation, certificate management, Certificate Renewal, devops, kubernetes, securityCertificate renewal is often treated as a scheduled task: run an ACME client, obtain a new certificate, and move on. In practice, that view is too narrow for production systems. A certificate ...
Why “Tokenmaxxing” Was Always the Wrong Way for Developers to Measure AI Productivity
Drew Thompson | | ai, AI Development, AI security, application security, developer productivity, software developmentThe term "tokenmaxxing" left the developer lexicon just as quickly as it arrived, and like most viral technology concepts, it means different things depending on who's using it. In practice, the term ...
Critical Flaw in isolated-vm Can Lead to Sandbox Escape, RCE Threat
Jeff Burt | | Activepieces, AI security, C/C++, Endor Labs, isolated-vm, JavaScript security, Mastra, n8n, Node.js security, remote code execution, Sandbox, software vulnerability, TOCTOU, V8 Isolate, vm2Developers for years have been using vm2, an open-source Node.js library, to run untrusted JavaScript inside a secure and isolated sandbox environment. It uses Node.js’s built-in modules and JavaScript Proxies and lets ...
Harness Adds AI Agents to Automate DevSecOps Workflows at Machine Speed
Harness today added multiple artificial intelligence (AI) agents and a virtual patching capability to its portfolio to automate DevSecOps workflows at a time when the number of vulnerabilities being discovered in code ...
Production-Safe Testing: The Missing Piece in Most DevSecOps Strategies
Dharmesh Acharya | | application security, continuous security, devsecops, Production-Safe Testing, security testingMost DevSecOps teams invest heavily in security before deployment, yet attackers target the production environment where applications, APIs, and user behavior are constantly changing. If security validation stops before release, critical risks ...
LiteLLM Attack Affected 2,500 Companies, 434,000 CI/CD Pipelines: CloudSEK
Jeff Burt | | AI infrastructure, AI supply chain attacks, AI-driven CI/CD pipelines, Aqua Security Trivy, CloudSEK, code repositories, FBI, information stealing, LiteLLM, malware, Mini Shai-Hulud, PyPi, TeamPCPThe massive supply-chain attack that compromised LiteLLM in the spring affected more than 2,500 companies and exposed about 434,000 CI/CD pipelines, with victims ranging from top-tier IT and AI companies to cybersecurity ...
‘Flooding Dropper’ Is Hitting npm With a Tidal Wave of Malicious Packages
Jeff Burt | | Flooding Dropper, linux, macOS, malicious npm packages, Microsoft Windows, naming conventions, open source threats, OpenSourceMalware, sonatypeThreat researchers at Sonatype are warning developers of an expanding campaign that is generating a wide range of npm accounts and dropping small numbers of malicious packages from each one, essentially flooding ...
RapidFort Extends Open Source Software Security Reach to Runtime Environments
RapidFort today at the Black Hat USA conference announced it has extended its ability to secure open source software to the runtimes that DevOps teams deploy in production environments. Michael Wood, chief ...
Fast-Moving Shai-Hulud Attack Infects npm Packages with 2 Billion Monthly Downloads
Jeff Burt | | Aikido Security, AWS, credential theft, GitHub Actions, HashiCorp Terraform, npm malware, Shai-Hulud worm, supply chain attackResearchers at Aikido Security and Endor Labs are tracking a fast-spreading supply-chain attack that is compromising a wide range of npm software packages that combined have more than 2 billion installs a ...
FakeGit Targets AI Coding Agents with Malicious GitHub Repos
Jeff Burt | | AgentBaiting, AI coding agents, AI supply chain risk, Anthropic Claude Code, fake repositories, FakeGit, github, Google Gemini, Island, MCP Server, OpenAI ChatGPT, SmartLoader, StealCThreat actors continue to find new ways to incorporate AI into schemes aimed at luring developers into downloading malware from fake repositories. The latest example involves almost 7,600 malicious GitHub repositories that ...
Security Risks from AI Coding Agents Expand Beyond the Sandbox: Pillar
Jeff Burt | | AI code assistants, AI coding agents, AI Developers, AI sandbox, AI security risks, Cursor, Cymulate, Google Antigravity, Google Gemini, OpenAI Codex, Pillar Security, prompt injectionAI coding assistants have become an essential part of developers’ work, automating many of the repetitive tasks – think boilerplate coding and scaffolding – that in the past ate up a lot ...
Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem
Nigel Douglas | | AI coding agents, AntV packages, behavioural analysis, continuous scanning, dependency security, Developer Security, GitHub Actions compromise, malicious packages, Miasma worm, Mini Shai-Hulud, npm malware, OIDC tokens, open source security, package provenance, package quarantine, policy as code, Red Hat npm attack, registry scanning, Shai-Hulud worm, SLSA provenance, software attestation, Software Supply Chain Security, TanStack compromise, trusted pipeline attacksA developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore ...
