14 verified briefings on Devsecops. Each story includes a plain-English summary, why it matters, and the concrete action engineering teams should take.
AWS launched an AI security tool called Continuum that it claims can automatically find and fix 89% of code vulnerabilities. The service integrates with code repositories and proposes fixes through pull requests for developers to review.
Fitness tracker company WHOOP was drowning in security alerts. They built a system to automate filtering, letting engineers focus only on critical threats while still having the final say on fixes, tackling widespread alert fatigue.
Large language models can find security flaws in code that traditional pattern-based scanners miss. GitLab's analysis shows the best approach is using both, with LLMs for nuanced checks and SAST for broad, fast coverage.
Pulumi has launched Neo Security, an AI-powered tool that acts like an agent to find complex security vulnerabilities in cloud infrastructure that traditional code scanners often miss. It aims to secure systems by analyzing the entire setup.
The Rust Foundation has hired an AI Security Engineer in Residence. The new role will help manage the growing number of vulnerability reports generated by AI tools, allowing maintainers to focus on legitimate security threats.
A new guide explains how to secure the entire AI stack, from initial models to production systems. It provides a roadmap for building resilient AI through layered defense, robust MLOps, and integrated governance.
An opinion piece argues the traditional model of a centralized security team is obsolete. Citing trends in AI security, it suggests that core responsibilities like managing API exposure and legacy systems are now shifting to engineering teams, requiring a new, shared approach to cybersecurity.
Security firm Minimus released two new tools to help teams manage software supply chain risks and container security together. The products aim to simplify protecting applications from third-party code vulnerabilities and misconfigurations.
GitHub has enhanced npm security with a new "staged publishing" feature. It requires maintainers to approve new package versions using two-factor authentication (2FA) before they are publicly available. This measure aims to prevent malicious package publications and strengthen the software supply chain against attacks.
Microsoft has uncovered a software supply chain attack using typosquatted npm packages to steal cloud and CI/CD credentials. The attack uses npm lifecycle hooks for execution and abuses the legitimate Bun runtime as a loader to deploy credential-stealing malware, targeting developers and their environments.
Snyk has launched Evo Continuous Offensive Security, a new AI-powered product for penetration testing. It aims to continuously find and fix vulnerabilities in applications, specifically addressing the security challenges posed by the rapid development and deployment of AI-generated code.
Microsoft has launched MDASH, a new AI-powered security platform for large-scale vulnerability discovery. The system uses more than 100 specialized AI agents that work together to automatically scan, validate, and prove security flaws across complex codebases like Windows and other Microsoft software.
GitLab has released version 19.0, a major update focused on strengthening its DevSecOps platform. The release aims to provide a more coordinated and comprehensive toolset for software development, security, and operations, with key enhancements to secrets management.
Attackers are expanding software supply chain attacks to target developer workstations and CI/CD pipelines directly. Recent campaigns on npm, PyPI, and Docker Hub aimed to steal secrets like API keys, cloud credentials, and tokens, shifting the focus from injecting malicious code to stealing developer access.