10 verified briefings on Devsecops. Each story includes a plain-English summary, why it matters, and the concrete action engineering teams should take.
The Rust Foundation has hired an AI Security Engineer in Residence. The new role will help manage the growing number of vulnerability reports generated by AI tools, allowing maintainers to focus on legitimate security threats.
A new guide explains how to secure the entire AI stack, from initial models to production systems. It provides a roadmap for building resilient AI through layered defense, robust MLOps, and integrated governance.
Security firm Minimus released two new tools to help teams manage software supply chain risks and container security together. The products aim to simplify protecting applications from third-party code vulnerabilities and misconfigurations.
An opinion piece argues the traditional model of a centralized security team is obsolete. Citing trends in AI security, it suggests that core responsibilities like managing API exposure and legacy systems are now shifting to engineering teams, requiring a new, shared approach to cybersecurity.
GitHub has enhanced npm security with a new "staged publishing" feature. It requires maintainers to approve new package versions using two-factor authentication (2FA) before they are publicly available. This measure aims to prevent malicious package publications and strengthen the software supply chain against attacks.
Microsoft has uncovered a software supply chain attack using typosquatted npm packages to steal cloud and CI/CD credentials. The attack uses npm lifecycle hooks for execution and abuses the legitimate Bun runtime as a loader to deploy credential-stealing malware, targeting developers and their environments.
Snyk has launched Evo Continuous Offensive Security, a new AI-powered product for penetration testing. It aims to continuously find and fix vulnerabilities in applications, specifically addressing the security challenges posed by the rapid development and deployment of AI-generated code.
Microsoft has launched MDASH, a new AI-powered security platform for large-scale vulnerability discovery. The system uses more than 100 specialized AI agents that work together to automatically scan, validate, and prove security flaws across complex codebases like Windows and other Microsoft software.
GitLab has released version 19.0, a major update focused on strengthening its DevSecOps platform. The release aims to provide a more coordinated and comprehensive toolset for software development, security, and operations, with key enhancements to secrets management.
Attackers are expanding software supply chain attacks to target developer workstations and CI/CD pipelines directly. Recent campaigns on npm, PyPI, and Docker Hub aimed to steal secrets like API keys, cloud credentials, and tokens, shifting the focus from injecting malicious code to stealing developer access.