DevOps and Open Technologies
Widespread Mini Shai-Hulud Campaign Is a Matter of Trust
Jeff Burt | | 360 Privacy, AI supply chain attacks, Aikido Security, CI/CD security, credentials, Endor Labs, npm malware, Pathlock, Sectigo, Shai-Hulud worm, TeamPCP, trust in technologyThe latest series of attacks using the notorious Shai-Hulud worm puts into sharp focus the threats facing software developers and their CI/CD pipelines, an issue that has been raised in recent months ...
How Open Source Dependency and Repo Attacks Compromise DevOps Pipelines and How to Stay Safe
Alex Vakulov | | CVE, Dependency Governance, log4j, Malicious Code Injection, open source security, Package Managers, SBoM, secure development, supply chain risk, typosquattingModern applications rely on open source components for up to 90% of their code, creating a vast attack surface dominated by inhemalicious supply chain injections. High-profile incidents like Log4j and the sabotage ...
IBM Bob Takes AI Coding Assistants to the Next Level
IBM Bob goes beyond AI-assisted coding to support the full software development lifecycle — with governance, security, and multi-model orchestration built in ...
Cyber Threats to DevOps Platforms Rising Fast, GitProtect Report Finds
Jeff Burt | | Azure DevOps, CI/CD, code repositories, Cybersecurity, DevOps platform downtime, devops security, extortion, GitHub security, GitProtect.io DevOps Threats report, GPUGate, JIRA, Kaspersky Lab, NPM security, Ransomware, Shai-HuludThe number of incidents targeting DevOps platforms grew 21% in 2025, but the amount of downtime jumped almost 95%, the security firm said ...
Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable
Jeff Burt | | Aqua Security Trivy, CI/CD cyberthreats, exposed secrets, GitHub Actions, IANS Research, malicious code, microsoft, OWASP Top 10, remote code execution, software development security, software supply chain attacks, software vulnerabilities, TenableA critical vulnerability in a popular Microsoft GitHub repository could allow a threat actor to easily exploit its CI/CD infrastructure to run arbitrary code in the repository and gain access to secrets, ...
Claude Code Routines: Anthropic’s Answer to Unattended Dev Automation
Anthropic's Claude Code Routines let dev teams automate scheduled tasks, GitHub events, and API-triggered workflows from managed cloud infrastructure ...
Microsoft Field Engineers Built a Six-Agent Research Pipeline in VS Code That Fact-Checks Its Own Output
Tom Smith | | Agent Handoff Pattern, Azure Kubernetes Service (AKS), Azure Red Hat OpenShift (ARO), Fact-Checking AI, GitHub Copilot Agents, Global Black Belts (GBB), Grounding, MCP Server, multi-agent systems, Project Nighthawk, Technical Research Automation, VS Code Agent SkillsAzure Global Black Belts Diego Casati and Ray Kao developed Project Nighthawk, a multi-agent system that automates deep technical research for AKS and ARO with 100% source-grounding ...
Survey Surfaces Increased Reliance on Open Source Software to Build Apps
Mike Vizard | | AI-Driven Vulnerabilities, Cyber Resilience Act (CRA), DevOps maintenance, DevSecOps best practices, DORA Compliance, Enterprise Open Source Adoption., Open Source Software (OSS), OpenLogic Survey, Software Supply Chain Security, vendor lock-inOpen source adoption is surging, with 49% of IT teams increasing usage. However, 47% of staff spend 75% of their time on maintenance. Explore the impact of AI threats and EU regulations ...
Two Malicious npm Packages Aim to Steal Credentials and Other Secrets
Jeff Burt | | API Keys, CI/CD pipelines, credential theft, Data Exfiltration, exposed secrets, GitHub repositories, maintainer account, malicious npm packages, sonatypeBad actors took over a npm maintainer account and have published two malicious packages designed to steal credentials, API keys, and other secrets from the computers of victims who download them from ...
Open SWE Captures the Architecture That Stripe, Coinbase and Ramp Built Independently for Internal Coding Agents
Tom Smith | | AgenticWorkflows, AGENTSmd, AICodingAgents, AutonomousAgents, CloudSandboxing, DeveloperExperience, devops, DevOpsAutomation, GitHubIntegration, LLMFramework, MITLicensed, SlackOps, SoftwareEngineeringIntelligence, SubagentOrchestrationExplore Open SWE, the open-source framework by LangChain that codifies the internal AI coding agent architectures used by Stripe, Ramp and Coinbase. Released March 17, 2026, this MIT-licensed project offers a customizable ...
How eBPF and OpenTelemetry Have Simplified the Observability Function
Morgan McLean | | auto instrumentation, ebpf, endpoint visibility, Grafana Labs, instrumentation, kernel level, kubernetes, legacy applications, linux, metrics, monitoring, network observability, OBI, observability, observability adoption, observability practice., OpenTelemetry, OpenTelemetry Injector, RED metrics, SDKs, security concerns, Splunk, supply chain, telemetry, third party software, traces, vendor neutral, zero code instrumentationOverview arguing that OpenTelemetry eBPF Instrumentation (OBI) — combined with OpenTelemetry Injector — removes barriers to full observability by enabling zero-code, kernel-level telemetry for Kubernetes and Linux environments, solving language, legacy, and ...
N. Korean Famous Chollima Hackers Use Malicious npm Packages to Steal Data
Jeff Burt | | Contagious Interview, Famous Chollima, infostealer, linux, macOS, malicious npm packages, Microsoft Windows, Pastebin, remote access trojan (RAT), Socket, software developers, typosquattingA group of more than two dozen malicious npm packages used to steal secrets and credentials from software developers has all the hallmarks – from infrastructure to operations – of Famous Chollima, ...
