Tag

devsecops

883 articles

Latest in devsecops

GitHub Brings AI Security Scanning to Pull Requests CodeQL Can’t Cover

GitHub’s AI Scan brings AI-powered vulnerability detection to pull requests involving languages, scripts and infrastructure files beyond CodeQL’s existing coverage. Paired with the general availability of agentic autofix, the rele…

Oct 20, 20263 min

All devsecops Articles

Showing 1–24 of 883

Oct19

Cohere Plans to Acquire Aisle to Add AI-Powered Code Security

Enterprise AI platform provider Cohere announced it has signed a letter of intent to acquire Aisle, a cybersecurity startup whose AI agent platform discovers source-code vulnerabil…

3 min

Oct19

Chainguard Debuts a Security-First Agent Platform

Open source security company Chainguard has released Workspaces, a service designed to provide a safe space for agents to do their thing without disrupting the security of existing…

3 min

Oct19

Blogs

From Static Scans to Runtime Awareness: The Next Phase of Software Supply Chain Security

A growing wave of software supply chain attacks, including Shai-Hulud, Axios and LiteLLM, is exposing weaknesses in conventional security tooling. Malicious open-source packages ca…

3 min

Oct14

Blogs

npm Puts a 48-Hour Clock on Unused Trusted Publishing Configurations

GitHub has added an expiration date to unused npm trusted publishing configurations. Any configuration that doesn’t complete a successful publish within 48 hours of creation now ex…

3 min

Oct14

Noma Security Discloses Claude Code Desktop Exploit

Security researchers at Noma Security uncovered SneakPeek, a vulnerability in Anthropic’s Claude Code Desktop that allowed malicious JavaScript embedded in large HTML files to bypa…

3 min

Oct14

Blogs

GitHub Ties Every Commit to the Account That Pushed It

GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer informat…

3 min

Oct08

Secrets Sprawl and Rotation: A Practical Vault Management Playbook

In 2025 alone, security firm GitGuardian detected 28.65 million new hardcoded secrets exposed in public GitHub commits — a 34% increase year over year and the largest single-year j…

3 min

Oct07

Blogs

HackerOne Report Surfaces Massive Increase in Vulnerability Backlogs

HackerOne research shows vulnerability remediation is getting faster, but AI-driven discovery is expanding exposure debt even more quickly, putting DevSecOps teams under growing pr…

3 min

Oct06

Blogs

Security Teams Are Fixing Vulnerabilities Faster Than Ever. So Why Is Software Getting Riskier?

AI is speeding up dependency decisions, making point-of-selection security essential for reducing vulnerable components, downstream tickets and avoidable rework.

3 min

Oct05

Blogs

GitHub Slams the Brakes on Private Vulnerability Reports

Drowning in AI-generated bug reports? GitHub has a radical answer: Stop accounts from reporting them. GitHub’s new limits on bug reports aren’t a solution to the AI bug-report floo…

3 min

Oct01

Blogs

DevOps Dozen 2026 Nominations Are Open: Recognizing the People and Technology Moving DevOps Forward

When we launched the DevOps Dozen in 2015, we wanted to recognize the people, projects and companies helping this community move forward. We saw the work happening across DevOps ev…

3 min

Sep30

AWS Benchmark Aims to Reduce Number of False Positives Found by AI Vulnerability Scanners

Amazon Web Services (AWS) has developed a benchmark that can be used to test whether a model can distinguish real vulnerabilities from code that looks risky but is actually safe. T…

3 min

Sep28

Blogs

Survey: Lack of Confidence in Software Supply Chain Security Runs High

A survey of 400 platform and security engineers in the U.S and United Kingdom (UK), finds nearly three quarters (73%) are either only moderately confident (58%) or not confident (1…

3 min

Sep28

Blogs

GitHub’s Security Autofix Agent Now Remembers What It Fixed

GitHub’s agentic autofix now uses Copilot Memory to reuse repository-specific security fix patterns, helping Copilot apply lessons from past vulnerabilities across future alerts, r…

3 min

Sep25

Blogs

Leaked GitLab Email Tokens Can Reach Code, Secrets and CI/CD Pipelines

Security researchers have uncovered a GitLab behavior that could let attackers use a leaked project email address to push code, trigger CI/CD jobs and reach other repositories acce…

3 min

Sep25

Blitzy Makes Sandbox for Reverse Engineering Code Available at No Cost

Blitzy has made available a sandbox where DevOps teams can reverse-engineer up to one million lines of code, generate up to 25,000 lines of tested end-to-end code, and identify sec…

3 min

Sep25

Blogs

Why Old Azure DevOps Releases Survive a Pipeline Cutover

Old Azure DevOps Classic releases can retain retired deployment tasks, Helm names, image paths and variables long after a pipeline cutover, leaving stale redeploy paths active.

3 min

Sep25

Blogs

DevSecOps Teams as Partners in Secure Software Delivery

DevSecOps teams can reduce last-minute release delays by shifting security decisions earlier, improving guardrails, clarifying ownership and making findings actionable.

3 min

Sep24

Why Software Supply Chain Security Is Moving to the Gate

March 2026: malicious versions of axios get published directly to npm. May 2026: attackers forge valid provenance for 42 TanStack packages on npm, with 84 malicious versions shippe…

3 min

Sep24

Blogs

GitHub Gives Enterprises a Full Count of Who Holds the Keys

GitHub Enterprise Cloud now lets organizations export a full inventory of credentials, helping security teams identify stale, overprivileged and forgotten access across users, apps…

3 min

Sep23

Cycode Extends DevSecOps Reach to Software Packages Developers Download

Cycode is adding workstation-level protection to stop developers and AI coding agents from downloading malicious or insufficiently vetted software packages.

3 min

Sep23

Blogs

Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters

ZCode’s default-on indexing feature reportedly uploaded entire developer workspaces to cloud storage, highlighting why AI coding assistants should be treated as privileged software…

3 min

Sep23

Blogs

Why Shift Left is Dead

AI-driven development is exposing risks before code is written, forcing security teams to move beyond shift-left and govern agents, prompts, tools and data across the entire develo…

3 min

Latest in devsecops

GitHub Brings AI Security Scanning to Pull Requests CodeQL Can’t Cover

Oct 20, 20263 min