Tag: Software Supply Chain Security
The Agent Proposes, the Pipeline Disposes: Controls for AI-Authored Change
Veera Ravindra Divi | | agent permissions, agentic coding, AI change control, AI code review, AI coding agents, AI Governance, AI pull requests, AI software development, AI-authored code, AI-generated code security, autonomous coding agents, bounded-write agents, change-budget gates, CI/CD security, human-in-the-loop, in-toto, independent evals, least-privilege, policy as code, protected paths, provenance attestation, provenance verification, Secure DevOps, signed attestations, Sigstore, SLSA, Software Supply Chain Security, staged autonomyWhen agents write code and open pull requests faster than humans can read them, ‘the diff looked fine’ stops being a control. The durable controls live outside the agent’s reasoning loop ...
Shift Left Security: 4 Automated Security Gates in GitHub Actions
Zia Ullah | | automated security testing, CI/CD security gates, CodeQL, container image scanning, CVE detection, DAST, dependency scanning, DevSecOps pipeline, Dynamic Application Security Testing, GitHub Actions security, Node.js security, npm audit, OWASP ZAP, SAST, shift left security, Snyk, Software Supply Chain Security, Static Application Security Testing, Trivy, vulnerability scanningLearn how to add four automated security gates to GitHub Actions using npm audit, Snyk, Trivy, CodeQL and OWASP ZAP—without an enterprise licence ...
CISA’s 2026 SBOM Guidance Adds Hash Requirements and AI Coverage
Tom Smith | | AI supply chain security, CISA, CISA SBOM 2026, CMMC, component hashes, component licensing, continuous SBOM validation, CycloneDX, FBI, FedRAMP, NSA, open source security, SaaS security, SBOM automation, SBOM minimum elements, software bill of materials, software procurement, Software Supply Chain Security, software transparency, SPDX, vendor risk managementCISA’s updated 2026 SBOM minimum elements expand software transparency requirements to AI, SaaS and open source while adding hashes, licenses and stronger validation ...
GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks
Tom Smith | | automated updates, CI/CD security, dependency cooldown, dependency pinning, dependency updates, devops security, GitHub Dependabot, lockfiles, malicious packages, open source security, package poisoning, package registry security, platform engineering, PyPi, Python Package Index, scoped access tokens, Software Supply Chain Security, supply chain attacksGitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads ...
Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem
Nigel Douglas | | AI coding agents, AntV packages, behavioural analysis, continuous scanning, dependency security, Developer Security, GitHub Actions compromise, malicious packages, Miasma worm, Mini Shai-Hulud, npm malware, OIDC tokens, open source security, package provenance, package quarantine, policy as code, Red Hat npm attack, registry scanning, Shai-Hulud worm, SLSA provenance, software attestation, Software Supply Chain Security, TanStack compromise, trusted pipeline attacksA developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore ...
Why Endpoint Protection Matters More than Ever in CI/CD Environments
Samuel Ogbonna | | CI/CD security, Developer Workstations, devsecops, Endpoint Security, Software Supply Chain SecurityCI/CD environments depend on far more than repositories and deployment infrastructure. Developer endpoints hold sensitive data: cloud credentials, SSH keys, deployment permissions, direct access to internal systems. Endpoint security and control are ...
GitHub Takes Down 73 Microsoft Repos After Miasma Worm Attack
Tom Smith | | AI coding tools, credential harvesting, Cybersecurity, developer environment, GitHub breach, IDE vulnerabilities, Miasma worm, Microsoft Azure, Shai-Hulud malware, Software Supply Chain SecurityGitHub pulled 73 Microsoft repositories offline after the self-replicating Miasma worm weaponized IDEs and AI coding tools to harvest developer credentials ...
Survey Surfaces Increased Reliance on Open Source Software to Build Apps
Mike Vizard | | AI-Driven Vulnerabilities, Cyber Resilience Act (CRA), DevOps maintenance, DevSecOps best practices, DORA Compliance, Enterprise Open Source Adoption., Open Source Software (OSS), OpenLogic Survey, Software Supply Chain Security, vendor lock-inOpen source adoption is surging, with 49% of IT teams increasing usage. However, 47% of staff spend 75% of their time on maintenance. Explore the impact of AI threats and EU regulations ...
Why AI-Generated Code Is Raising the Stakes for Secrets Management
Following a $50 million funding round, GitGuardian CEO Eric Fourrier discusses why secrets security is becoming a much bigger problem in the age of AI-generated code and autonomous agents. As more organizations ...
Chainguard Expands Repository to Add More Secure Open Source Libraries
Mike Vizard | | AI agents, application security, dependency layer, devops best practices, DevSecOps practices, Open Source Security Foundation, open source vulnerabilities, secure open source libraries, secure repositories, SLSA framework, software artifacts, software builds, Software Supply Chain SecurityLearn how Chainguard is strengthening software supply chains by expanding its secure repository of Java, JavaScript, and Python libraries, enabling DevOps teams to access components compliant with SLSA framework standards ...
Software Supply Chain Threats Are on the OWASP Top Ten—Yet Nothing Will Change Unless We Do
Joseph M. Saunders | | open source security, OWASP Top 10, SBoM, Software Supply Chain Security, supply chain attacksSoftware supply chain security is steadily moving to the forefront of cybersecurity conversations. In the past, it has been overshadowed by a focus on malware outbreaks, ransomware, endpoint protection, and application vulnerabilities ...
Checkmarx Acquisition of Tromzo Accelerates Plan to Apply AI to Application Security
Mike Vizard | | AI agents, AI in cybersecurity, AI-powered security, application security, Application Security Posture Management, ASPM, DAST, devsecops, devsecops automation, SAST, SCA, SDLC security, secure software development lifecycle, Software Supply Chain Security, zero-day vulnerabilitiesCheckmarx accelerates its AI-driven DevSecOps strategy after acquiring Tromzo, integrating AI agents to automate application security across the software development lifecycle ...
