CI/CD
Your CI/CD Pipeline Has Non-Human Identities You Forgot About
Jay Goradia | | CI/CD security, infrastructure access, non-human identities, pipeline automation, workload identityA deployment starts failing late on a Friday evening. The initial assumption is that something changed in the application release. Teams start checking container images, Terraform plans and recent commits. Nothing looks ...
AI-Generated Apps Without DevOps: A Security Disaster Waiting to Happen
Sannan Ali | | AI coding assistants, application security, CI/CD security, devops, Software Supply ChainA small internal tool was built over a weekend. An engineer used an AI coding assistant to generate most of the backend. A simple interface was added, a few API calls were ...
Beyond the Build: Integrating Security into CI/CD Pipelines
In today's fast-paced software development landscape, Continuous Integration and Continuous Deployment (CI/CD) pipelines are essential for delivering applications efficiently. However, the speed and automation they offer can inadvertently introduce security vulnerabilities if ...
The Trust Problem With AI Agents in Production Pipelines
AI agents boost DevOps pipelines, but confident failures create risk. Here’s how to design for calibrated trust and human oversight ...
Cyber Threats to DevOps Platforms Rising Fast, GitProtect Report Finds
Jeff Burt | | Azure DevOps, CI/CD, code repositories, Cybersecurity, DevOps platform downtime, devops security, extortion, GitHub security, GitProtect.io DevOps Threats report, GPUGate, JIRA, Kaspersky Lab, NPM security, Ransomware, Shai-HuludThe number of incidents targeting DevOps platforms grew 21% in 2025, but the amount of downtime jumped almost 95%, the security firm said ...
Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable
Jeff Burt | | Aqua Security Trivy, CI/CD cyberthreats, exposed secrets, GitHub Actions, IANS Research, malicious code, microsoft, OWASP Top 10, remote code execution, software development security, software supply chain attacks, software vulnerabilities, TenableA critical vulnerability in a popular Microsoft GitHub repository could allow a threat actor to easily exploit its CI/CD infrastructure to run arbitrary code in the repository and gain access to secrets, ...
From Code to Cloud: How Full-Stack Developers are Taking Over DevOps
Full-stack developers are taking on DevOps, using CI/CD, Docker and Terraform to own the software lifecycle from code to cloud ...
CloudBees Delivers on AI Promise to Improve Application Testing
CloudBees has made generally available an add-on for continuous integration/continuous deployment (CI/CD) platforms that uses artificial intelligence (AI) to determine which tests should be run first based on the likelihood there will ...
How AI is Shaping Modern DevOps and DevSecOps
AI is reshaping DevOps and DevSecOps by improving CI/CD workflows, DORA metrics and security without adding unnecessary complexity ...
North Korean Hackers Suspected in Supply Chain Attack on Popular Axios Project
Jeff Burt | | Axios, CI/CD, Google Threat Intelligence Group, JavaScript dependencies, Mandiant, North Korea, remote access trojan (RAT), Socket, sonatype, supply chain attack, TeamPCPThe threat actor targeted a highly popular open source project with more than 100 million weekly downloads, creating a large "blast radius." ...
The Trust Tax Framework: Measuring Developer Confidence in CI/CD Systems
Vignesh Sundaram | | Automated Testing Culture, CI/CD Trust, continuous integration, Developer Experience (DevEx), DevOps metrics, flaky tests, Infrastructure Ownership, Mean Time to Confidence, Override Rate, Re-run Rate, Test QuarantineIs your re-run rate over 30%? Discover the "Trust Tax" killing your DevOps ROI. Learn to manage flaky tests through automatic quarantine, contextual reporting, and cultural shifts ...
Sophisticated Supply Chain Attack Targeting Trivy Expands to Checkmarx, LiteLLM
Jeff Burt | | AI (Artificial Intelligence), AI supply chain attacks, Aqua Security Trivy, Checkmarx, Cloud Security, credentials, exposed secrets, GitHub Actions, LiteLLM, microsoft, Palo Alto Networks, Sysdig, TeamPCPThe supply chain attack that compromised Aqua Security’s Trivy open source security vulnerability scanner and its associated GitHub Actions earlier this month continues to expand, with software development tools from Checkmarx and ...
