DevSecOps
Black Duck Extends Scope and Reach of Code Scanning Tool
Black Duck has updated its Coverity static analysis code scanning tool to provide deeper integrations with artificial intelligence (AI) tools along with updates to its user interface that make it simpler to ...
Why You Need AI Agent Security Validation in Software Testing
Engineering teams have been racing for the last two years to deploy AI agents that can find bugs faster than any QA team ever could. Autonomous testing agents can crawl through codebases, ...
Why Developer Workstations Have Become a Critical Part of the Software Supply Chain
Samuel Ogbonna | | CI/CD security, Developer Security, Developer Workstations, devsecops, open source security, Software Supply ChainFor years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest that this view is incomplete. The Megalodon campaign injected malicious ...
‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets
Jeff Burt | | AI coding agents, AI hallucinations, AI security agents, Cursor, devops, GitHub Copilot, Google Gemini, HalluSquatting, indirect prompt injection, LLM, OpenClaw, promptwareHallucinations have been an ongoing problem since OpenAI first introduced its ChatGPT chatbot in November 2022, highlighting generative AI’s tendency to generate plausible but false or misleading information and its inability to ...
Enterprise Smart Contracts Have a Cryptography Problem. EY Just Built a Way Around It
The business case for smart contracts is building fast. Major financial institutions are using programmable, code-based agreements to underpin financial workflows, supply chain operations, and tokenization initiatives. Developers are being asked to ...
IBM and Red Hat Launch Lightwell Catalog to Automate Remediation
IBM and Red Hat this week revealed that Lightwell Network, a catalog of more than 6,500 application-layer dependencies that drives an automated vulnerability remediation service, is now generally available. At the same ...
GhostApproval Flaw Featuring Decades-Old Feature Found in Six AI Coding Tools
Jeff Burt | | Adversa AI, AI coding agents, AI security risks, Amazon Q Developer, Anthropic Claude Code, Augment, CodeSignal, Cursor, GhostApproval, Google Antigravity, human in the loop coding, OpenAI Codex, SSH keys, symlinks, Unix, Windsurf, WizA security flaw found in six popular AI coding agents can let attackers abuse a decades-old feature in Unix to trick an AI agent into giving them control of a developer’s system ...
North Korea Expands the Reach of PolinRider Supply Chain Attack Campaign
Jeff Burt | | AI supply chain attacks, APT37, Chrome Store, Contagious Interview, devops, devsecops, Famous Chollima, Go modules, Lazarus Group, malicious npm packages, North Korea, package registry malware, Packagist, PolinRider, Rescana, Socket, supply chainThe North Korean-sponsored threat groups behind the long-running fake interview scams targeting developers are expanding the PolinRider supply chain campaign that has escalated over the past several months. Reports from cybersecurity vendors ...
When AI Agents Get Production Access: The Next Big DevOps Risk
Sannan Ali | | AI agents, autonomous operations, devops, infrastructure automation, platform engineering, Production OperationsIt wasn’t that long ago that AI assistants just watched from the sidelines. They could answer your questions, explain how things worked, sum up logs, and write deployment scripts. Handy, sure, but ...
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
Jeff Burt | | AI coding agents, AI security risks, Anthropic Claude Code, Developer Security, exposed credentials, exposed secrets, Futurum Group, indirect prompt injection, leaked API keys, Mozilla 0DIN, shell scriptsA clean GitHub repository that contains no malicious code can launch an attack and fully compromise a developer’s systems by using indirect prompt injections to trick AI-powered coding agents like Anthropic’s Claude ...
Attackers Exploit SimpleHelp Flaw to Steal Info from AI Coding Assistants, Clouds
Jeff Burt | | AI coding assistants, Anthropic Claude Security, Blackpoint Cyber, Cloud accounts, cryptocurrency, Djinn Stealer, Google Gemini, information stealer, OpenAI Codex, RMM software, SimpleHelpThreat actors are exploiting a known security flaw in the SimpleHelp remote monitoring and management (RMM) software to drop two previously unknown pieces of malware that can compromise a broad range of ...
From Phishing to Vishing: Why DevSecOps Must Rethink Communication Security
Key Takeaways: Vishing is the new frontline threat: Attackers are shifting from emails to phone-based scams, using AI and social engineering to bypass traditional security controls. DevSecOps must expand its scope: Securing ...
