IT as Code
From Software Supply Chains to AI Vulnerabilities: Why Neither Solves Enterprise Linux Security
Moshe Bar | | enterprise security, Linux security, patch management, runtime protection, runtime security, vulnerability managementFor nearly a decade, cybersecurity has been dominated by one overarching concern: securing the software supply chain. Organizations invested heavily in Software Bills of Materials (SBOMs), artifact signing, provenance frameworks, reproducible builds, ...
AWS AI Agent Surfaces Recommendations to Optimize Cloud Computing Environments
Amazon Web Services (AWS) today made available a preview of an artificial intelligence (AI) agent that surfaces recommendations to optimize cost, security, performance and resilience based on the business objectives an organization ...
A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token
Canio Campaniello | | AI agent security, command injection, credential security, GitHub security, least-privilege, OpenAI CodexAI coding agents don't just suggest code anymore. Tools like OpenAI's Codex spin up a real container, clone a real repository, and authenticate with a real GitHub credential to get the job ...
Leaked GitLab Email Tokens Can Reach Code, Secrets and CI/CD Pipelines
Jaime Hampton | | Aikido Security, application security, CI/CD, devsecops, gitlab, Software Supply ChainSecurity researchers have uncovered a GitLab behavior that could let attackers use a leaked project email address to push code, trigger CI/CD jobs and reach other repositories accessible to the address owner ...
Why Plan Review Stopped Working
Mariusz Michalowski | | AI agents, gitops, IaC, infrastructure as code, infrastructure automation, policy as codeThe control that held your infrastructure together was plan review, meaning a person reading a diff and deciding whether to approve it. Not the policy document and not the pipeline configuration. It ...
TeamPCP Supply Chain Attack Leads to CrowdSec Source Code Being Stolen
Jeff Burt | | CrowdSec, EDR, github, Mini Shai-Hulud, NPM security, OAuth tokens, supply chain attacks, TanStack compromise, TeamPCPCrowdSec says attackers stole source code from about 170 private GitHub repositories after a TanStack npm supply chain attack exposed an OAuth token tied to a former employee ...
Flaw in DeepSeek Harness AI Coding Tool Let Agents Disable Their Sandbox
Jeff Burt | | agentic AI security, AI coding agents, AI sandbox, API Keys, DeepSeek Harness, OX Security, VulnCheckNews of the now-fixed vulnerability comes amid growing concerns that AI vendors do not in have complete control of their autonomous agents ...
JFrog Moves to Secure Agentic Engineering Workflows
JFrog today at its swampUP 2026 conference added a zero touch remediation capability that ensures the most secure version of a binary is provided even when application developers request a version that ...
From Operator to Agent Manager: The Real Shift in Network Engineering
I've been saying for ten years that network automation was three years away from being the only way to do things. Every year I moved the goalposts, because the data never caught ...
Cybersecurity Researchers Uncover Flaw in Google AI Coding Tool
Cybersecurity researchers from Pillar Security this week revealed how a prompt injection inserted into a GitHub repository was used to gain Editor-level access to an internal Google Cloud project using a flaw ...
Sonar AI Agent Discovers Vulnerabilities Hidden in Business Logic Workflows
Sonar today made available an artificial intelligence (AI) agent designed to discover vulnerabilities and business logic flaws that pose the greatest risk to an organization should they be exploited. The SonarQube Hunter ...
Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack
Jeff Burt | | arrayref, information stealing, North Korea, Rust programming language, software supply chain attacks, StepSecurity, typosquatting, Wiz ResearchSecurity researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the account of the maintainer of multiple Rust crates and introducing four more ...
