Tag

CI/CD security

33 articles

Latest in CI/CD security

Blogs

Two GitHub Campaigns, One Weak Point: Stolen Developer Credentials

Two separate GitHub attack campaigns, Gheist and Testmetest, exploited stolen developer credentials to steal secrets, compromise workflows and target software supply chains. The attacks reveal dangerous blind spots in GitHub Actio…

Oct 30, 20263 min

All CI/CD security Articles

Showing 1–24 of 33

Oct28

Blogs

CI/CD Cache Poisoning Is No Longer a Theoretical Attack

CI/CD cache poisoning can turn untrusted code into compromised releases. Learn how to secure caches, isolate workflows and protect software supply chains.

3 min

Oct27

Gheist Hackers Abuse GitHub Tokens to Steal Repository Secrets

The evolving Gheist campaign uses stolen GitHub tokens and malicious Actions workflows to extract repository secrets and cloud credentials. While GitHub protections have blocked ob…

3 min

Oct21

Blogs

GitHub Puts a Firewall Between npm and Your CI Runners

GitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detectio…

3 min

Oct19

Blogs

From Static Scans to Runtime Awareness: The Next Phase of Software Supply Chain Security

A growing wave of software supply chain attacks, including Shai-Hulud, Axios and LiteLLM, is exposing weaknesses in conventional security tooling. Malicious open-source packages ca…

3 min

Oct14

Blogs

GitHub Ties Every Commit to the Account That Pushed It

GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer informat…

3 min

Oct08

Secrets Sprawl and Rotation: A Practical Vault Management Playbook

In 2025 alone, security firm GitGuardian detected 28.65 million new hardcoded secrets exposed in public GitHub commits — a 34% increase year over year and the largest single-year j…

3 min

Sep25

Blogs

DevSecOps Teams as Partners in Secure Software Delivery

DevSecOps teams can reduce last-minute release delays by shifting security decisions earlier, improving guardrails, clarifying ownership and making findings actionable.

3 min

Sep21

Blogs

GitHub Separates Who Writes Code From Who Runs Your CI

GitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security.

3 min

Sep18

Blogs

Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface

CI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern…

3 min

Sep14

Blogs

More JFrog Artifactory Bugs Are Under Attack, and All Three Have Patches

Attackers are actively exploiting three JFrog Artifactory flaws, exposing how slow patching can turn artifact repositories into software supply chain attack paths.

3 min

Sep14

Blogs

GitLab’s Critical Patch Closes a Path Traversal Flaw Attackers Are Already Probing

GitLab patches two critical flaws, including a CVSS 10.0 unauthenticated file-read vulnerability, putting self-managed instances under urgent pressure to upgrade.

3 min

Aug26

AI Can Generate Your Infrastructure. Can Your CI/CD Pipeline Trust It?

AI-generated infrastructure code is exposing a growing security gap, pushing platform teams to add stronger automated gates, provenance tracking and human review before Terraform,…

3 min

Aug21

Blogs

Why Cryptographic Inventory Is the First Step Toward Quantum Readiness

Post-quantum readiness starts with visibility. DevOps teams need a continuous cryptographic inventory to map algorithms, keys, certificates, libraries, infrastructure and third-par…

3 min

Aug13

The Agent Proposes, the Pipeline Disposes: Controls for AI-Authored Change

When agents write code and open pull requests faster than humans can read them, ‘the diff looked fine’ stops being a control. The durable controls live outside the agent’s reasonin…

3 min

Jul27

Blogs

GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks

GitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads.

3 min

Jul23

Blogs

The Trust Graph: Why Infrastructure Diagrams No Longer Describe Modern Systems

Traditional architecture diagrams miss the identity relationships that now drive breaches and outages. Platform teams need trust graphs that map who and what can act across modern…

3 min

Jul21

Blogs

Zero Trust Starts at the Code: Building Secure Systems with PKI and DevOps Automation

When a certificate expires, it can take down a production system, and teams usually only find out after something goes wrong. These issues are hard to catch because they rarely tri…

3 min

Jul13

Blogs

Why Developer Workstations Have Become a Critical Part of the Software Supply Chain

For years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest tha…

3 min

Jul06

Novee Uncovers Cordyceps: The Latest Threat to CI/CD Pipelines

A newly discovered supply chain security flaw is once again putting a spotlight on inherent weaknesses in CI/CD pipelines and the growing interest among cyberthreat actors to explo…

3 min

Jun12

Blogs

Why Endpoint Protection Matters More than Ever in CI/CD Environments

CI/CD environments depend on far more than repositories and deployment infrastructure. Developer endpoints hold sensitive data: cloud credentials, SSH keys, deployment permissions,…

3 min

Jun12

Blogs

Shift Left to the Developer’s Machine: Building Local Git Security Gates

Shift left to the developer’s machine. The principle is what matters: Stop secrets before they ship. The tooling is a means to that end.

3 min

Jun05

Agentic DevSecOps: AI Security Co-Pilots for Your CI/CD Pipeline

The emergence of AI has brought endless possibilities and innovative opportunities in today’s ever-changing, fast-paced technology landscape. AI is helping development teams produc…

3 min

May15

Blogs

Widespread Mini Shai-Hulud Campaign Is a Matter of Trust

The latest series of attacks using the notorious Shai-Hulud worm puts into sharp focus the threats facing software developers and their CI/CD pipelines, an issue that has been rais…

3 min