DevSecOps
Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable
Jeff Burt | | Aqua Security Trivy, CI/CD cyberthreats, exposed secrets, GitHub Actions, IANS Research, malicious code, microsoft, OWASP Top 10, remote code execution, software development security, software supply chain attacks, software vulnerabilities, TenableA critical vulnerability in a popular Microsoft GitHub repository could allow a threat actor to easily exploit its CI/CD infrastructure to run arbitrary code in the repository and gain access to secrets, ...
Appknox Adds AI Tool to Detect and Fix Vulnerabilities in Mobile Applications
Appknox today added an ability to apply artificial intelligence (AI) to assess vulnerabilities in the binaries used to construct a mobile application and recommend a fix that can be passed on to ...
LayerX: Anthropic’s Claude Code Can Easily Be Easily Weaponized
Jeff Burt | | agentic AI guardrails, AI Developers, AI IDE, AI security, Anthropic Claude Code, Anthropic Mythos Preview, LayerX, Project GlasswingLayerX researchers were able to convince the popular AI coding tool to bypass its guardrails and execute malicious instructions ...
Why Most DevSecOps Pipelines Fail at Runtime Security (not Build Time)Â
Nazim Ghori | | configuration drift, Continuous integration (CI/CD), DevSecOps pipelines, Infrastructure as Code (IaC), runtime security, security automationRuntime risk refers to security exposure caused by configuration, identity or infrastructure changes after deployment ...
North Korean Hackers Suspected in Supply Chain Attack on Popular Axios Project
Jeff Burt | | Axios, CI/CD, Google Threat Intelligence Group, JavaScript dependencies, Mandiant, North Korea, remote access trojan (RAT), Socket, sonatype, supply chain attack, TeamPCPThe threat actor targeted a highly popular open source project with more than 100 million weekly downloads, creating a large "blast radius." ...
Sysdig Adds Runtime to Secure AI Coding Agents
Sysdig this week at the RSA Conference (RSAC) revealed it has created a runtime that makes it possible to securely deploy artificial intelligence (AI) coding tools. Jonas Rosland, director of the open ...
Sophisticated Supply Chain Attack Targeting Trivy Expands to Checkmarx, LiteLLM
Jeff Burt | | AI (Artificial Intelligence), AI supply chain attacks, Aqua Security Trivy, Checkmarx, Cloud Security, credentials, exposed secrets, GitHub Actions, LiteLLM, microsoft, Palo Alto Networks, Sysdig, TeamPCPThe supply chain attack that compromised Aqua Security’s Trivy open source security vulnerability scanner and its associated GitHub Actions earlier this month continues to expand, with software development tools from Checkmarx and ...
N. Korean Famous Chollima Hackers Use Malicious npm Packages to Steal Data
Jeff Burt | | Contagious Interview, Famous Chollima, infostealer, linux, macOS, malicious npm packages, Microsoft Windows, Pastebin, remote access trojan (RAT), Socket, software developers, typosquattingA group of more than two dozen malicious npm packages used to steal secrets and credentials from software developers has all the hallmarks – from infrastructure to operations – of Famous Chollima, ...
Security Flaws in Anthropic’s Claude Code Risk Stolen Data, System Takeover
Jeff Burt | | AI API Security, AI coding risks, AI coding tools, AI developer tools, Anthropic Claude Code, Check Point, MCP protocol, Palo Alto Unit 42Three critical vulnerabilities found in Anthropic’s Claude Code agentic AI developer tool could be exploited simply by cloning and opening an untrusted project and lead to system takeover, stolen API keys, and ...
The Hidden Security Risks in Modern JavaScript Frameworks and How React Teams Can Reduce ThemÂ
Samuel Ogbonna | | client-side rendering security, client-side vulnerabilities, content security policy, Dependency Management, frontend attack surface, frontend security best practices, input validation, JavaScript dependencies, JavaScript security, JavaScript vulnerabilities, modern JavaScript frameworks, NPM security, React application security, React security risks, secure React development, SPA security, state management security, third-party libraries risk, web application security, XSS attacksReact and modern JavaScript frameworks accelerate development—but hide serious security risks. Learn where vulnerabilities come from and how to reduce client-side attack surfaces ...
Prompt Injection Isn’t Just a Chat Problem — It’s a DevOps ThreatÂ
Prompt injection is evolving into a serious DevOps threat, enabling AI agents to misuse tools, leak secrets and execute unauthorized actions unless governed with least privilege, sandboxing and human approval. ...
Survey Surfaces More Focus on Software Security Testing and API Security
A global survey of 828 enterprise IT professionals conducted by the Futurum Group finds well over a third of respondents expect their organization to increase spending on software security testing (39%) and ...
