Elektrine
Log in Register

#devsecops

53 posts · Last used 8d

Back to Timeline
DailyCyberSecurity
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange · Aug 06, 2026
Critical Jenkins vulnerability CVE-2026-70426 lets attackers bypass the JEP-200 filter and run code on the controller. Patch now. #Jenkins #CVE202670426 #RCE #DevSecOps #Deserialization #CyberSecurity https://securityonline.info/jenkins-cve-2026-70426-rce/?utm_source=mastodon&utm_medium=jetpack_social
0
0
0
DailyCyberSecurity
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange · Aug 04, 2026
A new npm supply chain attack hijacked keyv and dozens of packages, spreading Shai-Hulud malware that steals cloud and CI/CD secrets. Rotate keys now. #npm #SupplyChainAttack #ShaiHulud #keyv #CredentialStealer #Malware #DevSecOps #CICD #CyberSecurity #InfoSec https://securityonline.info/npm-supply-chain-attack-keyv-shai-hulud/?utm_source=mastodon&utm_medium=jetpack_social
0
0
0
relayshieldadmin
RelayShieldAdmin @relayshieldadmin@infosec.exchange · Aug 03, 2026
We searched public GitHub for AWS keys leaked against a domain. 4,240 hits. The top five results: a docs table, a literal AKIA.... placeholder, a redaction tool's own README, a link list, and a domain allowlist. Five out of five. Not one contained a credential. Any scanner that treats a search hit as a finding calls all five a CRITICAL exposure. Free local scanner, MIT: #infosec #devsecops #appsec #opensource
0
0
0
DailyCyberSecurity
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange · Jul 30, 2026
The latest GitLab patch release fixes 13 vulnerabilities, including CVE-2026-6267, a high-severity data exposure flaw. Update self-managed GitLab now. #GitLab #CVE20266267 #DevSecOps #Vulnerability #PatchNow #InfoSec https://securityonline.info/gitlab-patch-release-19-2-1/?utm_source=mastodon&utm_medium=jetpack_social
0
0
0
DailyCyberSecurity
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange · Jul 29, 2026
CVE-2026-45293 is an arbitrary code execution flaw in WordPress Coding Standards, rated CVSS 8.6. The dev tool has 49M+ installs. Upgrade to 3.4.1. #WordPressCS #CVE202645293 #WordPress #CodeExecution #PHPCS #DevSecOps #SupplyChain #InfoSec #CyberSecurity https://securityonline.info/wordpresscs-cve-2026-45293/?utm_source=mastodon&utm_medium=jetpack_social
0
0
0
BSidesLuxembourg
BSidesLuxembourg @BSidesLuxembourg@infosec.exchange · Jul 28, 2026
💻 𝗧𝗛𝗢𝗦𝗘 𝗪𝗛𝗢 𝗗𝗢𝗡’𝗧 𝗟𝗘𝗔𝗥𝗡 𝗙𝗥𝗢𝗠 𝗖𝗩𝗘𝗦 𝗔𝗥𝗘 𝗗𝗢𝗢𝗠𝗘𝗗 𝗧𝗢 𝗥𝗘𝗗𝗜𝗦𝗖𝗢𝗩𝗘𝗥 𝗧𝗛𝗘𝗠 💥 - Louis Nyffenegger https://archive.org/details/BSidesLuxembourg2026/d1+t1+10+Those+Who+Don%E2%80%99t+Learn+From+CVEs+Are+Doomed+To+Rediscover+Them+-+Louis+Nyffenegger.mkv Watch Louis Nyffenegger's ( @snyff@infosec.exchange ) session, recorded live at the Digital Learning Hub during BSides Luxembourg 2026. #BSidesLuxembourg #CVE #CodeReview #SecureCoding #PenTest #SecurityEducation #DevSecOps
1
0
2
oliverzehentleitner
Oliver Zehentleitner @oliverzehentleitner@burningboard.net · Jul 28, 2026
Keep the Why started with a simple idea: AI-assisted development already produces valuable reasoning — but most of it disappears when the conversation ends. It has since evolved far beyond rationale capture. The new article explains how Keep the Why became repository-native project memory for humans and AI agents: • continuous capture during development • retrospective recovery for existing codebases • knowledge-transfer interviews • maintenance of stale context • explicit evidence and status labels • abandoned changes without a diff • prompt-injection protection through a clear trust boundary The most important principle: Project knowledge may influence reasoning. It must never grant authority to an agent. And it still needs no database, daemon, dashboard, or external service. Just Markdown, Git, humans, and agents working with the same project knowledge. Read the article: https://blog.technopathy.club/keep-the-why-project-memory-for-humans-and-ai-agents #AI #AIAgents #SoftwareEngineering #OpenSource #DevSecOps #Documentation
0
0
0
gadgetry
Ryan Daws 🤓 @gadgetry@techhub.social · Jul 27, 2026
Hugging Face was forced to switch to an open model to contain a breach from an AI agent. More than 35 major firms have now launched an alliance off the back of that incident. https://www.developer-tech.com/news/open-secure-ai-alliance-open-source-ai-security-defences/ #huggingface #opensource #devsecops #infosec #cybersecurity #ai #technology
0
1
0
psoheil
Pedram @psoheil@c.im · Jul 27, 2026
One small change can make a big difference in software supply chain security. PyPI has introduced a new safeguard that rejects uploads of new files to package releases older than 14 days. This helps prevent attackers who compromise a maintainer’s account or publishing pipeline from silently adding malicious files to a long-trusted package version months after it was released. While this doesn’t eliminate all supply chain threats, it significantly reduces the risk of “package poisoning” attacks against pinned dependencies and encourages immutable releases, a security best practice every ecosystem should strive for. Security isn’t about a single silver bullet, it’s about layering defenses that make attacks increasingly difficult. Could we see similar protections become the standard across other package registries like npm, NuGet, and RubyGems? https://cybersecuritynews.com/pypi-14-day-release-lock/amp/ #CyberSecurity #AppSec #SupplyChainSecurity #PyPI #Python #DevSecOps #SoftwareSecurity #OpenSource #SecureByDesign #SoftwareSupplyChain #Infosec
0
0
0
Cloud 🤖 @cloud@infosec.exchange · Jul 22, 2026
🤖 Microsoft Azure DevOps MCP flaw: invisible PR comments hijack AI review agents via prompt injection. The official MCP server lacked guardrails on one tool, allowing data exfiltration across projects. 🔗 https://thehackernews.com/2026/07/microsoft-azure-devops-mcp-flaw-lets.html #AISecurity #DevSecOps #PromptInjection #CyberSec
0
0
0
JimGuckin
Jim Guckin @JimGuckin@infosec.exchange · Jul 22, 2026
"Ship it." Those might be the most dangerous words in software development when AI writes the code. My latest article explores why vibe coding is accelerating development... but can also accelerate security mistakes if we're not careful. Read it here: https://jimguckin.com/2026/07/21/you-vibe-coded-your-way-into-a-security-nightmare/ #CyberSecurity #AI #AppSec #DevSecOps #InfoSec
0
0
0
DailyCyberSecurity
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange · Jul 20, 2026
Gitea vulnerability CVE-2026-58443 (CVSS 9.6) lets public-only tokens write to private repos. Details and PoC code are public. Update to v1.27.0. #Gitea #CVE202658443 #DevSecOps #PoC #InfoSec https://securityonline.info/gitea-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social
0
0
0
thecybersecguru @thecybersecguru@infosec.exchange · Jul 20, 2026
🚨 15 years. Millions of servers. One hidden bug. CVE-2026-42533 is a critical NGINX heap buffer overflow lurking since 2011 that can crash worker processes and, under specific conditions, may enable Remote Code Execution (RCE) via specially crafted HTTP requests. Attackers don't just target software versions. They target vulnerable configurations. Upgrade now. 🔥 ✅ Deep technical breakdown: • Why the bug survived for 15 years • Heap buffer overflow explained • LEN vs VALUE script engine flaw • PCRE capture overwrite • Vulnerable nginx configurations • Affected versions • Patch analysis • Mitigations • RCE conditions 📖 Read the full analysis: https://thecybersecguru.com/news/cve-2026-42533-nginx-rce-vulnerability/ #CVE202642533 #NGINX #CyberSecurity #InfoSec #Linux #RCE #HeapOverflow #MemoryCorruption #WebSecurity #DevSecOps #CloudSecurity #Kubernetes #ReverseProxy #Vulnerability #ZeroDay #Exploit #AppSec #BlueTeam #RedTeam #F5
0
0
0
getobserver
Observer @getobserver@phpc.social · Jul 19, 2026
Observer v0.4.0 is out 🎉 No command line needed anymore — double-click the binary and a dashboard opens in your browser. Paste a folder, hit Scan, read the report. Offline security + production-health scanner. One file, no account, free & MIT. PHP/JS/Python/Go/Java/Ruby → one HTML report with a Security Rating (A–E). #PHP #DevSecOps #golang
0
0
0
anchore
anchore @anchore@mstdn.business · Jul 18, 2026
What is CompOps? It's Compliance Operations, and it replaces painful manual audits with continuous, automated governance. ✅ Automate continuous evidence ✅ Give devs real-time feedback ✅ Reclaim engineering hours Learn more in our latest whitepaper: https://go.anchore.com/Modern-Blueprint-for-Continuous-Compliance.html #DevSecOps
0
0
0