GitOps
Security Risks from AI Coding Agents Expand Beyond the Sandbox: Pillar
Jeff Burt | | AI code assistants, AI coding agents, AI Developers, AI sandbox, AI security risks, Cursor, Cymulate, Google Antigravity, Google Gemini, OpenAI Codex, Pillar Security, prompt injectionAI coding assistants have become an essential part of developers’ work, automating many of the repetitive tasks – think boilerplate coding and scaffolding – that in the past ate up a lot ...
GitHub API Abuse, ‘Ghost’ Accounts Part of Malicious Efforts to Map Organizations
Jeff Burt | | Cofense, Data Exfiltration, data mapping, data scraping, datadog, Fortran, GitHub API, GitHub ghost accounts, gitlab, GraphQL, personal tokens, REST APIsDatadog researchers uncover months-long overlapping campaigns to scrape data about companies and their developers ...
‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos
Jeff Burt | | Acalvio, agentic AI guardrails, AI security, Anthropic Claude, Forcepoint, GitHub Agentic Workflows, indirect prompt injection, LLM, Markdown, Microsoft Copilot, Noma Security, private repository, public repositoryNoma researchers again show how easy it is to manipulate AI agents with malicious commands via indirect prompt injection attacks ...
GitLab Previews Revamped DevOps Platform for the Agentic AI Era
Mike Vizard | | Agentic Workflows, AI agents, AI coding tools, AI governance framework, context graph, devops, devsecops, Git protocol, gitlab, GitLab Flex, GitLab Orbit, software lifecycle engineering, Transcend 2026At Transcend 2026, GitLab launched updates to optimize its DevOps platform for AI-generated code, featuring Next Gen Source Code Management, GitLab Orbit, and an AI Governance framework ...
Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable
Jeff Burt | | Aqua Security Trivy, CI/CD cyberthreats, exposed secrets, GitHub Actions, IANS Research, malicious code, microsoft, OWASP Top 10, remote code execution, software development security, software supply chain attacks, software vulnerabilities, TenableA critical vulnerability in a popular Microsoft GitHub repository could allow a threat actor to easily exploit its CI/CD infrastructure to run arbitrary code in the repository and gain access to secrets, ...
‘PackageGate’ Vulnerabilities Can Let Attackers Bypass Shai-Hulud Defenses
Jeff Burt | | Aikido Security, Bun, Git dependency, github, Koi Security, microsoft, npm registry, PhantomRaven, PNPM, remote code execution, Shai-Hulud worm, supply chain attack, VLTIn the wake of the massive Shai-Hulud supply chain attack that ripped through npm late last year and compromised more than 700 packages and exposed 25,000 repositories, developers in the JavaScript world ...
Typosquat Supply Chain Attack Targets Go Developers
A backdoor that impersonates a widely used database module in the popular Go programming language can give hackers control of infected systems, according to a senior threat intelligence analyst with developer-focused platform ...
Fake Stars in GitHub a Growing Security Threat, Analysis Finds
There was a surge of inauthentic stars on code repositories in 2024, ramping up the threat of software supply chain attacks ...
Why and How to Go All-In on GitOps
When you can manage every cloud native deployment using a GitOps approach, as a consequence, declarative and automated processes become baked into your culture and transform your business. ...
GitLab Fixes Security Flaw That Lets Attackers Run Pipeline Jobs
If left unpatched, the vulnerability in the code repository could let threat actors run malicious code and access sensitive information ...
Security, Automation and Developer Experience: The Top DevOps Trends of 2024
Derek Ashmore | | automation, developer experience, gitops, IaC, infrastructure as code, Policy-Based ManagementIf you want to know what's truly changing in the world of DevOps – as opposed to which conversations are most hype-worthy – these are the places to look ...
Best of 2023: ‘Scrum == Cancer’ ¦ Plus: Linux 6.5 Ships
In this week’s #TheLongView: Scrum sucks, sources say; and here comes the Linux 6.5 kernel ...
