Tag

devsecops

879 articles

Latest in devsecops

Blogs

npm Puts a 48-Hour Clock on Unused Trusted Publishing Configurations

GitHub has added an expiration date to unused npm trusted publishing configurations. Any configuration that doesn’t complete a successful publish within 48 hours of creation now expires and can no longer authorize a release. It’s…

Oct 14, 20263 min

All devsecops Articles

Showing 1–24 of 879

Oct14

Noma Security Discloses Claude Code Desktop Exploit

Security researchers at Noma Security uncovered SneakPeek, a vulnerability in Anthropic’s Claude Code Desktop that allowed malicious JavaScript embedded in large HTML files to bypa…

3 min

Oct14

Blogs

GitHub Ties Every Commit to the Account That Pushed It

GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer informat…

3 min

Oct08

Secrets Sprawl and Rotation: A Practical Vault Management Playbook

In 2025 alone, security firm GitGuardian detected 28.65 million new hardcoded secrets exposed in public GitHub commits — a 34% increase year over year and the largest single-year j…

3 min

Oct07

Blogs

HackerOne Report Surfaces Massive Increase in Vulnerability Backlogs

HackerOne research shows vulnerability remediation is getting faster, but AI-driven discovery is expanding exposure debt even more quickly, putting DevSecOps teams under growing pr…

3 min

Oct06

Blogs

Security Teams Are Fixing Vulnerabilities Faster Than Ever. So Why Is Software Getting Riskier?

AI is speeding up dependency decisions, making point-of-selection security essential for reducing vulnerable components, downstream tickets and avoidable rework.

3 min

Oct05

Blogs

GitHub Slams the Brakes on Private Vulnerability Reports

Drowning in AI-generated bug reports? GitHub has a radical answer: Stop accounts from reporting them. GitHub’s new limits on bug reports aren’t a solution to the AI bug-report floo…

3 min

Oct01

Blogs

DevOps Dozen 2026 Nominations Are Open: Recognizing the People and Technology Moving DevOps Forward

When we launched the DevOps Dozen in 2015, we wanted to recognize the people, projects and companies helping this community move forward. We saw the work happening across DevOps ev…

3 min

Sep30

AWS Benchmark Aims to Reduce Number of False Positives Found by AI Vulnerability Scanners

Amazon Web Services (AWS) has developed a benchmark that can be used to test whether a model can distinguish real vulnerabilities from code that looks risky but is actually safe. T…

3 min

Sep28

Blogs

Survey: Lack of Confidence in Software Supply Chain Security Runs High

A survey of 400 platform and security engineers in the U.S and United Kingdom (UK), finds nearly three quarters (73%) are either only moderately confident (58%) or not confident (1…

3 min

Sep28

Blogs

GitHub’s Security Autofix Agent Now Remembers What It Fixed

GitHub’s agentic autofix now uses Copilot Memory to reuse repository-specific security fix patterns, helping Copilot apply lessons from past vulnerabilities across future alerts, r…

3 min

Sep25

Blogs

Leaked GitLab Email Tokens Can Reach Code, Secrets and CI/CD Pipelines

Security researchers have uncovered a GitLab behavior that could let attackers use a leaked project email address to push code, trigger CI/CD jobs and reach other repositories acce…

3 min

Sep25

Blitzy Makes Sandbox for Reverse Engineering Code Available at No Cost

Blitzy has made available a sandbox where DevOps teams can reverse-engineer up to one million lines of code, generate up to 25,000 lines of tested end-to-end code, and identify sec…

3 min

Sep25

Blogs

Why Old Azure DevOps Releases Survive a Pipeline Cutover

Old Azure DevOps Classic releases can retain retired deployment tasks, Helm names, image paths and variables long after a pipeline cutover, leaving stale redeploy paths active.

3 min

Sep25

Blogs

DevSecOps Teams as Partners in Secure Software Delivery

DevSecOps teams can reduce last-minute release delays by shifting security decisions earlier, improving guardrails, clarifying ownership and making findings actionable.

3 min

Sep24

Why Software Supply Chain Security Is Moving to the Gate

March 2026: malicious versions of axios get published directly to npm. May 2026: attackers forge valid provenance for 42 TanStack packages on npm, with 84 malicious versions shippe…

3 min

Sep24

Blogs

GitHub Gives Enterprises a Full Count of Who Holds the Keys

GitHub Enterprise Cloud now lets organizations export a full inventory of credentials, helping security teams identify stale, overprivileged and forgotten access across users, apps…

3 min

Sep23

Cycode Extends DevSecOps Reach to Software Packages Developers Download

Cycode is adding workstation-level protection to stop developers and AI coding agents from downloading malicious or insufficiently vetted software packages.

3 min

Sep23

Blogs

Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters

ZCode’s default-on indexing feature reportedly uploaded entire developer workspaces to cloud storage, highlighting why AI coding assistants should be treated as privileged software…

3 min

Sep23

Blogs

Why Shift Left is Dead

AI-driven development is exposing risks before code is written, forcing security teams to move beyond shift-left and govern agents, prompts, tools and data across the entire develo…

3 min

Sep21

Blogs

Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent

Two patched OpenAI Codex vulnerabilities, Heapjack and Overpatch, exposed how coding agents can escape sandboxes and reach developer systems without approval prompts.

3 min

Sep21

Blogs

GitHub Separates Who Writes Code From Who Runs Your CI

GitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security.

3 min

Sep18

Blogs

Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface

CI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern…

3 min

Sep17

StackHawk Delivers Wingman to Fix Vulnerabilities as Developers Write Code

StackHawk this week launched Wingman, an artificial intelligence (AI) tool that makes it possible for application developers to automatically fix vulnerability issues as code is be…

3 min