a Futurum companyTag
37 articles
Blogs
AI coding agents are driving up CI workloads and costs. Discover five ways to accelerate monorepo pipelines while protecting software quality.
Showing 1–24 of 37
Blogs
Two separate GitHub attack campaigns, Gheist and Testmetest, exploited stolen developer credentials to steal secrets, compromise workflows and target software supply chains. The at…
Blogs
CI/CD cache poisoning can turn untrusted code into compromised releases. Learn how to secure caches, isolate workflows and protect software supply chains.
AI
The evolving Gheist campaign uses stolen GitHub tokens and malicious Actions workflows to extract repository secrets and cloud credentials. While GitHub protections have blocked ob…
Blogs
Stale dependency mocks can make CI/CD pipelines pass while production integrations fail. Learn how mock drift undermines reliability and how to prevent it.
Blogs
GitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detectio…
AI
GitHub’s AI Scan brings AI-powered vulnerability detection to pull requests involving languages, scripts and infrastructure files beyond CodeQL’s existing coverage. Paired with the…
Blogs
GitHub is rebuilding its Git infrastructure as AI coding agents drive billions of commits, promising up to 35x faster writes while exposing new DevOps bottlenecks.
Blogs
Claude Statuspane gives developers real-time visibility into Claude Code context use, rate limits, costs and CI status, highlighting a growing need for agent observability.
Blogs
GitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security.
Blogs
CI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern…
Blogs
GitHub’s August 2026 report details five outages tied to Actions and Copilot growth outpacing infrastructure. Here’s what platform teams should know.
API
GitHub, the Microsoft Corp.-owned code hosting platform serving more than 180 million developers, is still reeling from a widespread outage on Monday that severely disrupted softwa…
API
A major technical outage struck GitHub on Monday morning, disrupting workflows for millions of developers worldwide for several hours as critical services, automated testing pipeli…
Blogs
Researchers at Aikido Security and Endor Labs are tracking a fast-spreading supply-chain attack that is compromising a wide range of npm software packages that combined have more t…
AI
GitHub’s Copilot cloud agent integration with Linear is now generally available, adding model, branch and team-level controls for delegated coding work.
AI
A newly discovered supply chain security flaw is once again putting a spotlight on inherent weaknesses in CI/CD pipelines and the growing interest among cyberthreat actors to explo…
AI
GitHub Agentic Workflows can now use GitHub Actions’ built-in GITHUB_TOKEN instead of a personal access token (PAT). That means developers no longer need to create, store, or rotat…
AI
AI coding agents are reshaping software development—but they’re also expanding the attack surface. Researchers uncovered a now-patched vulnerability in Anthropic’s Claude Code GitH…
CI/CD
The threat group behind the notorious Mini Shai-Hulud worm last month put the complete source code for the malware into a GitHub repository, essentially open sourcing the threat so…
Blogs
A critical vulnerability in a popular Microsoft GitHub repository could allow a threat actor to easily exploit its CI/CD infrastructure to run arbitrary code in the repository and…
AI
The supply chain attack that compromised Aqua Security’s Trivy open source security vulnerability scanner and its associated GitHub Actions earlier this month continues to expand,…
AI
Anthropic pulls security into the inner dev loop with new Claude Code tools that scan for vulnerabilities in the terminal and on every pull request—before insecure code ever ships.
Best of 2025
The attacker introduced malicious Python code that would expose secrets like authentication credentials in public repositories.
