DevSecOps

Your threat feed is someone else’s database: What ingesting malware intel at scale takes

cybersecurity, DevSecOps, Don't miss, Expert analysis, GitHub, Hot stuff, News, opinion, Threat Intelligence /

Your threat feed is someone else’s database: What ingesting malware intel at scale takes 2026-09-03 at 08:30 By Help Net Security The advice is to consume shared threat intelligence. Join the ISAC. Wire the community feeds into your pipeline. This looks like a fine advice and I agree to it. What nobody mentions you is […]

Your threat feed is someone else’s database: What ingesting malware intel at scale takes Read More »

AI supply chain risk is showing up in developer workflows first

agentic AI, AI, CXO, DevSecOps, Don't miss, Features, Hot stuff, News, strategy, supply chain attacks, tips, Zentera Systems, zero trust /

AI supply chain risk is showing up in developer workflows first 2026-08-25 at 09:00 By Mirko Zorz In this Help Net Security interview, Dr. Jaushin Lee, CEO of Zentera Systems, discusses where AI supply chain risk shows up. He says most incidents still hit developer workflows and open-source package repositories, while poisoned model weights and […]

AI supply chain risk is showing up in developer workflows first Read More »

GitHub Dependabot malware alerts now cover eight ecosystems

DevSecOps, GitHub, News, open source, supply chain /

GitHub Dependabot malware alerts now cover eight ecosystems 2026-08-10 at 10:01 By Mirko Zorz GitHub has flagged npm malware since March 2026. Anyone pulling in a bad PyPI, Maven, RubyGems, NuGet, Go, crates.io, or PHP Composer package has had no such warning, because GitHub’s malware detection only ever watched one ecosystem. That changed this month. […]

GitHub Dependabot malware alerts now cover eight ecosystems Read More »

Three in four AI-generated vulnerability patches leave something broken

1Password, agentic AI, AI, CVE, DevSecOps, Don't miss, Hot stuff, News, OpenAI, patching, research, Trail of Bits, vulnerability assessment /

Three in four AI-generated vulnerability patches leave something broken 2026-08-06 at 15:45 By Mirko Zorz Ask a frontier model to patch a real vulnerability and it will hand you something that looks like a fix. It reads like the patch a maintainer would write. When there is a test, it often passes. Roughly one time […]

Three in four AI-generated vulnerability patches leave something broken Read More »

The AI code vulnerabilities that grow with your app

AI, automation, code analysis, cybersecurity, DevSecOps, Don't miss, News, report, Theori, vulnerability assessment /

The AI code vulnerabilities that grow with your app 2026-07-23 at 07:30 By Mirko Zorz Theori built 28 apps with AI coding agents and scanned each one through its pentesting platform. Five models did the building, split between Anthropic and OpenAI, across apps written from a spec, thrown together from a casual prompt, and rewritten […]

The AI code vulnerabilities that grow with your app Read More »

Why SBOMs, signing, and provenance still don’t tell you if software is safe

cybersecurity, DevSecOps, Don't miss, Expert analysis, Expert corner, Hot stuff, News, opinion, strategy, zero trust /

Why SBOMs, signing, and provenance still don’t tell you if software is safe 2026-07-13 at 09:30 By Help Net Security We have made real progress in software supply chain security, improving visibility into software components, authenticity and build integrity. Much of this progress traces back to Executive Order 14028, which pushed agencies, contractors and enterprises […]

Why SBOMs, signing, and provenance still don’t tell you if software is safe Read More »

The Chainguard Athena coalition already shipped 2,000 patches across 500 open source projects

Chainguard, cybersecurity, DevSecOps, Don't miss, News, open source, vulnerability management /

The Chainguard Athena coalition already shipped 2,000 patches across 500 open source projects 2026-06-17 at 12:42 By Mirko Zorz Chainguard launched Athena, an industry coalition that pools open source vulnerability findings and remediates them under embargo before public disclosure. The group went live with more than two dozen member organizations. Founding members include BNY, Chainguard, […]

The Chainguard Athena coalition already shipped 2,000 patches across 500 open source projects Read More »

7 hard truths security pros should know: 2026 DevOps Threats Report

authentication, Cloud, DevOps, DevSecOps, Don't miss, Expert analysis, Expert corner, GitProtect.io, News, threats /

7 hard truths security pros should know: 2026 DevOps Threats Report 2026-05-20 at 09:34 By Help Net Security In 2025, trusted Git hosting platforms became a playground for cyber criminals. This is the main conclusion from the latest “DevOps Threat Unwrapped Report 2026” by GitProtect. If you want to effectively counter attacks targeted at your […]

7 hard truths security pros should know: 2026 DevOps Threats Report Read More »

HEIDI: Free IDE security plugin for open-source vulnerability checks

Connecting Software, DevSecOps, Don't miss, LLMs, News, programming, software, software development, supply chain /

HEIDI: Free IDE security plugin for open-source vulnerability checks 2026-05-12 at 09:28 By Mirko Zorz Open-source dependencies make up a large percentage of the code in production applications, and most vulnerability checks still run late in the pipeline, inside CI/CD systems or after a release ships. Meterian is moving those checks earlier with HEIDI, a […]

HEIDI: Free IDE security plugin for open-source vulnerability checks Read More »

One keypress is all it takes to compromise four AI coding tools

AI, Anthropic, Cursor, cybersecurity, DevSecOps, Don't miss, Features, GitHub, Google, Hot stuff, Microsoft, News, research, vulnerability /

One keypress is all it takes to compromise four AI coding tools 2026-05-08 at 01:14 By Mirko Zorz Developers clone unfamiliar repositories all the time. Open-source projects, work from teammates, sample code from a tutorial, a library someone recommended on a forum. The convention is old and reasonable: you look at what’s inside before you […]

One keypress is all it takes to compromise four AI coding tools Read More »

Amazon sends AI agents into pen testing and DevOps

agentic AI, Artificial Intelligence, AWS, cybersecurity, DevSecOps, News /

Amazon sends AI agents into pen testing and DevOps 2026-03-31 at 20:31 By Sinisa Markovic Amazon’s latest AI capabilities bring on-demand penetration testing through the AWS Security Agent, alongside the AWS DevOps Agent. “These agents are changing the way we secure and operate software. AWS Security Agent compresses penetration testing timelines from 2-6 weeks to […]

Amazon sends AI agents into pen testing and DevOps Read More »

Betterleaks: Open-source secrets scanner

Aikido Security, DevSecOps, Don't miss, GitHub, Hot stuff, News, open source, scanner, scanning, software /

Betterleaks: Open-source secrets scanner 2026-03-19 at 09:02 By Anamarija Pogorelec Secrets scanning has become standard practice across engineering organizations, and Gitleaks has been one of the most widely used tools in that space. The author of that project has now released a new tool called Betterleaks, which is designed to scan git repositories, directories, and […]

Betterleaks: Open-source secrets scanner Read More »

Your dependencies are 278 days out of date and your pipelines aren’t protected

CISO, cyber risk, cybersecurity, Datadog, DevSecOps, Don't miss, News, report, survey /

Your dependencies are 278 days out of date and your pipelines aren’t protected 2026-03-02 at 09:00 By Mirko Zorz Applications continue to ship with known weaknesses even as development workflows speed up. A new Datadog State of DevSecOps 2026 report examines how dependency management and pipeline practices are influencing exposure across cloud native environments. Across […]

Your dependencies are 278 days out of date and your pipelines aren’t protected Read More »

Bandit: Open-source tool designed to find security issues in Python code

code analysis, cybersecurity, DevSecOps, Don't miss, GitHub, News, open source, Python, scanning, software /

Bandit: Open-source tool designed to find security issues in Python code 2026-01-21 at 08:04 By Sinisa Markovic Bandit is an open-source tool that scans Python source code for security issues that show up in everyday development. Many security teams and developers use it as a quick way to spot risky coding patterns early in the […]

Bandit: Open-source tool designed to find security issues in Python code Read More »

CISO Assistant: Open-source cybersecurity management and GRC

CISO, Compliance, cybersecurity, DevSecOps, Don't miss, framework, GitHub, GRC, Hot stuff, News, open source, Risk Management, software, strategy /

CISO Assistant: Open-source cybersecurity management and GRC 2026-01-14 at 13:25 By Mirko Zorz CISO Assistant is an open-source governance, risk, and compliance (GRC) platform designed to help security teams document risks, controls, and framework alignment in a structured system. The community edition is maintained as a self-hosted tool for organizations that want direct access to […]

CISO Assistant: Open-source cybersecurity management and GRC Read More »

StackRox: Open-source Kubernetes security platform

containers, cybersecurity, DevOps, DevSecOps, Don't miss, Kubernetes, News, open source, security operations, software, StackRox /

StackRox: Open-source Kubernetes security platform 2026-01-08 at 08:31 By Anamarija Pogorelec Security teams spend a lot of time stitching together checks across container images, running workloads, and deployment pipelines. The work often happens under time pressure, with engineers trying to keep clusters stable while meeting internal policy requirements. The StackRox open source project sits in […]

StackRox: Open-source Kubernetes security platform Read More »

Docker makes hardened images free open and transparent for everyone

containers, DevSecOps, Docker, Don't miss, News, open source /

Docker makes hardened images free open and transparent for everyone 2025-12-22 at 15:09 By Sinisa Markovic Docker has made its open source Docker Hardened Images project available at no cost for every developer and organization. The catalog contains more than 1,000 container images built on open source distributions such as Debian and Alpine and is […]

Docker makes hardened images free open and transparent for everyone Read More »

cnspec: Open-source, cloud-native security and policy project

automation, cloud security, DevSecOps, Don't miss, GitHub, News, open source, software /

cnspec: Open-source, cloud-native security and policy project 2025-11-24 at 08:32 By Sinisa Markovic cnspec is an open source tool that helps when you are trying to keep a sprawling setup of clouds, containers, APIs and endpoints under control. It checks security and compliance across all of it, which makes it easier to see what needs […]

cnspec: Open-source, cloud-native security and policy project Read More »

AI is rewriting how software is built and secured

Artificial Intelligence, Censuswide, CISO, cybersecurity, Cycode, DevSecOps, News, report, strategy /

AI is rewriting how software is built and secured 2025-11-10 at 11:28 By Anamarija Pogorelec AI has become part of everyday software development, shaping how code is written and how fast products reach users. A new report from Cycode, The 2026 State of Product Security for the AI Era, explores how deeply AI now runs […]

AI is rewriting how software is built and secured Read More »

PortGPT: How researchers taught an AI to backport security patches automatically

Artificial Intelligence, automation, Canonical, CISO, cybersecurity, DevSecOps, Don't miss, Features, Git, Hot stuff, Linux, LLMs, News, open source, patching, research, strategy, tips /

PortGPT: How researchers taught an AI to backport security patches automatically 2025-11-05 at 09:07 By Mirko Zorz Keeping older software versions secure often means backporting patches from newer releases. It is a routine but tedious job, especially for large open-source projects such as the Linux kernel. A new research effort has built a tool that […]

PortGPT: How researchers taught an AI to backport security patches automatically Read More »

Scroll to Top