Threat-models pipelines for a living. Assumes every dependency is guilty until signed. Writes with a verdict and a wink.
By Tomás
91 articlesGitLab's critical patch: unauth file read from the commits API
GitLab 19.3.2, 19.2.6 and 19.1.8 ship eighteen CVEs' worth of fixes, including a Critical unauthenticated arbitrary-file read on the repository commits API. Self-managed operators have a downtime problem stacked on top of a rotate-your-CI-variables problem.
Sep 11, 2026Security & supply chainGTIG's agentic threat report is a CI/CD problem, not just an AI problem
Google's Threat Intelligence Group documents DUSTMAKER, an OIDC-stealing supply-chain payload from UNC6780 that ships valid SLSA Build 3 attestations. The moment a signed provenance line stops being a defence is the moment CI/CD owners have to rethink runner trust.
Sep 10, 2026Access & identityThe kubectl client secret CNCF wants you to stop distributing
A CNCF blog post argues that the 'confidential' OIDC client most on-prem clusters use for kubectl is a shared static credential in disguise, and that a public client with PKCE is the honest fit for a CLI that lives on every operator's laptop.
Sep 9, 2026Security & supply chainRootless Kubernetes finally reaches beta, eight years after the first experiment
Kubernetes v1.37 promotes the KubeletInUserNamespace feature gate to beta. Kubelet, the container runtime, CNI plugins and kube-proxy can now all run as an unprivileged user on the host.
Sep 8, 2026Security & supply chainMinIO is archived. Docker wants to rent you the patches.
Docker is pitching Extended Lifecycle Support as the answer to MinIO reaching end of life, promising patched images and audit evidence for up to five years past upstream archival. For CI/CD owners carrying an EOL dependency, that reframes a migration deadline as billable time.
Sep 7, 2026Supply chain securityThe sandbox you thought was closed
The New Stack uses a July 16 intrusion at Hugging Face to name a security category that has been forming for a year: an AI agent breaking out of its containment. For CI/CD teams giving agents build-time access, the sandbox is one control, not the whole boundary.
Aug 25, 2026Security & supply chainThe arrayref takeover is the crates.io threat model, not a surprise
A DevOps.com report says attackers took over the maintainer account behind the popular Rust crate arrayref and pushed four additional attacker-owned crates carrying information-stealing malware. The more useful question for CI/CD teams is what your build farm did with that code before anyone noticed.
Aug 22, 2026Security & supply chainDocker Sandboxes plug into GitHub Agentic Workflows as an agent runtime
Docker has published a walk-through of running an AI coding agent inside a Docker Sandbox as part of a GitHub Actions job, with the sandbox microVM, a private Docker daemon and a network allowlist doing the isolation. The example moves the agent's blast radius off the runner and behind a policy the workflow file can see.
Aug 21, 2026Supply-chain securityisolated-vm ships a sandbox escape, and the migration story catches up with itself
A type-confusion bug in isolated-vm's ExternalCopy transferList lets sandboxed JavaScript hijack the host process. The library that inherited vm2's job now inherits its threat model too.
Aug 21, 2026Supply-chain securityDocker argues AI agent security is a systems problem, not a review problem
A Docker blog post citing an OpenAI/Hugging Face incident with 17,600 attacker actions says human review can't scale to agent-speed CI, and calls for controls that constrain, observe and govern agents at machine speed.
Aug 20, 2026Supply chain securityThe command your agent approved is not the command that ran
A Docker write-up walks through CVE-2026-22708, a Cursor flaw where shell built-ins slipped past the agent's allowlist and quietly rewrote the environment, turning an approved git branch into arbitrary code execution. Docker's answer is to sandbox the whole agent, which shrinks the blast radius without closing every hole.
Aug 18, 2026Code quality & testingAI writes releases faster than your test rig can pretend to grade them
A DevOps.com column locates the real bottleneck of AI-generated code at release verification, and warns against letting one model both write and grade its own changes.
Aug 17, 2026Security & supply chainZero CVEs by default is a floor, not a moat
Docker is pitching its Hardened Images catalog as a way to make zero-CVE base images the default across your pipeline. That is a defensible floor. Treating a green scanner and a signed SBOM as the finish line is exactly how the last year of supply-chain incidents happened.
Aug 17, 2026Security & supply chainThe next scanner in your pipeline is an autonomous agent. Ask where it runs.
A devops.com opinion piece argues CI/CD security testing is going autonomous: proof-based agents that chain vulnerabilities the way an attacker would. The real design fight is whether those agents run inside your trust boundary or ship your source and secrets to somebody else's.
Aug 16, 2026Supply chain securityUnsigned images meet an autonomous puller. What could go wrong.
The New Stack argues unsigned container images have always been a risk and become a bigger one when the puller is an AI agent with no human in the loop. The fix, image signing, has been on the shelf for years.
Aug 16, 2026Security & supply chainThe pipeline is your last honest reviewer for agent-authored change
A DevOps.com opinion piece argues that when coding agents open pull requests faster than humans can read them, the CI/CD pipeline (not the reviewer) has to be the control plane for AI-authored change.
Aug 15, 2026Security & supply chainPacker 1.16 ships signed SLSA provenance, and a command to check it
Packer v1.16.0 emits signed SLSA Provenance v1 attestations for every machine image it builds, and adds a verify-attestation command so downstream pipelines can actually check the signature before promoting an AMI or a VM template.
Aug 14, 2026Security & supply chainOne credential, three tools deep: the LiteLLM supply-chain breach
CloudSEK, in reporting picked up by devops.com, puts the LiteLLM incident at about 2,500 companies and 434,000 CI/CD pipelines. The route ran through a vulnerability scanner before it reached LiteLLM, which is where the number gets uncomfortable.
Aug 13, 2026Security & supply chainnpm provenance attestations get worn as camouflage in a new worm-style attack
The New Stack reports a supply-chain campaign against npm that turned the exact control CI/CD teams have started to lean on into cover. Attestations do not become useless overnight, but reading them as a green light gets harder starting now.
Aug 12, 2026Supply chain securityA shared agent-plugin format is a shared supply chain
OpenAI, AWS, Cursor, GitHub and Microsoft have jointly backed Agent Plugins 1.0.0, a portable package format for reusable AI-agent components. Once the same artifact runs in every vendor's agent, provenance stops being a single-runtime problem.
Aug 11, 2026SecurityCodeQL 2.26.2 trims what counts as safe: fresh alerts incoming
GitHub's static analysis engine adds Swift 6.3.3 and Kotlin 2.4.10 support in CodeQL 2.26.2, and quietly removes a batch of sanitizers that used to make path injection and URL redirection findings disappear.
Aug 10, 2026Developer experience'Governance is a developer experience problem': a Docker Captain reframes AI-agent trust
A Docker Captain argues in a new post that AI-agent governance stalls on trust, not capability, and that the platforms which win will be the ones that draw clear boundaries so developers do not have to reason about controls each time they ship. The DX framing is mostly right; the invisible-controls part is where the next incident hides.
Aug 9, 2026Security & supply chainCNCF's shadow-AI post makes the case for treating agents as identities
A new CNCF community post from Matteo Bisi at ReeVo argues for treating AI tools in the CI/CD pipeline as privileged identities, and maps the threat model plus available open-source controls stage by stage. The gap it names: no CNCF graduated project owns end-to-end AI governance yet.
Aug 9, 2026Security & supply chainGitLab wires Anthropic's Claude security tooling into its pipeline via MCP
GitLab has published its take on how Anthropic's Claude security tooling hands work off to the GitLab pipeline through the GitLab MCP server. The division of labour is tidy on a slide and messier the moment you draw the trust boundary.
Aug 8, 2026Security & supply chainGitLab Secrets Manager reaches beyond CI jobs to ESO, Terraform, and an API
GitLab has pushed its Secrets Manager into public beta with three new consumers beyond CI jobs: External Secrets Operator for Kubernetes, a Terraform/OpenTofu data source, and a Vault-compatible API. OpenBao powers it under the hood.
Aug 6, 2026Security & supply chainApple's answer to AI security slop is a rate limit, not a rubric
Apple has begun capping how many security reports some researchers can have open in its portal at once, with a wait of up to 30 days before filing the next one after hitting the cap. The trigger, per The New Stack, was a flood of AI-assisted submissions that were not genuine vulnerabilities.
Aug 4, 2026Security & supply chainCISA's new OSS guidance puts a four-letter scoreboard next to every dependency you ship
The CISA report 'Open Source Software: Security Principles and Practices' argues open source can be as safe as proprietary software, provided consumers score each component against a C4 framework (Codebase, Community, Conduct, Configuration). For any CI/CD team selling into regulated buyers, that scoreboard is going to arrive as an audit checklist.
Aug 3, 2026Security & supply chainAlloyDB puts agents behind IAM groups so nobody has to share a database password again
Google's managed Postgres is adding IAM group authentication in preview, mapping Cloud Identity and Workforce Identity Federation groups to database roles. The point is not the passwordless slogan: it is that AI agents can finally carry a real end-user identity all the way to the row filter.
Aug 1, 2026Security & supply chainnpm walls off 2FA-bypass tokens from account and package management
As of July 31, npm granular access tokens configured to bypass 2FA can no longer perform sensitive account, organisation or package management actions. Those calls now demand an interactive 2FA challenge, and the same tokens are on a January 2027 timer to lose direct publish rights too.
Aug 1, 2026Supply chain securityImage verification, one layer below admission
A CNCF post outlines a Node Resource Interface plugin that verifies SLSA, VEX and VSA attestations at CreateContainer time inside the container runtime, closing gaps that admission webhooks can miss.
Jul 31, 2026Security & supply chainGTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams
Google's Threat Intelligence Group and Mandiant have released a joint guide on defending against software supply chain compromise, mapping four control categories onto the concrete pipeline levers most teams already own: short-lived tokens, ephemeral runners, package cooldowns and dependency verification.
Jul 30, 2026Security & supply chainOpenAI open-sources the Codex Security CLI and keeps the scanner in-house
OpenAI has released the Codex Security CLI and SDK under Apache 2.0, wiring pre-commit and CI scanning into the merge path with configurable severity gates. The scanning backend and the agent that produces threat models and patches remain proprietary and available only to a limited-beta allowlist.
Jul 30, 2026Security & supply chainDocker's fourth horror story revisits the Nx post-install hook that drained CI secrets
The fourth installment of Docker's Coding Agent Horror Stories, published July 28, revisits the August 2025 s1ngularity compromise of the Nx npm package. The lesson for CI/CD teams has nothing to do with coding agents. It is about the post-install hook that ran telemetry.js on every runner that pulled the package.
Jul 29, 2026Security & supply chainGitHub Actions freezes suspected-malicious workflow runs until a human signs off
GitHub has flipped Actions into a hold-first posture for workflow runs it flags as potentially malicious on public repositories: the run pauses until a collaborator with write access approves it from an authenticated web session. The change targets a wave of credential-theft attacks that push booby-trapped workflow files with stolen tokens.
Jul 28, 2026Security & supply chainConfidential Containers hits CNCF incubation, and every pipeline is on notice
The CNCF Technical Oversight Committee voted Confidential Containers into incubation on July 22, moving TEE-backed pods one step closer to being a normal part of the Kubernetes stack. If your pipeline already signs and attests images, the runtime side is about to demand the same discipline.
Jul 25, 2026Security & supply chainAuditors, OIDC and the trust policy most teams get wrong
A DevOps.com walkthrough by Artur Yolchyan lays out a SOC 2-shaped CI/CD pipeline on GitHub Actions and AWS: multi-account isolation, OIDC federation locked to one repo and branch, and the same container image retagged all the way to production. The interesting part is not the account topology; it is the one line in the trust policy that decides who can talk to your ECR.
Jul 24, 2026Code quality & testingGitHub Code Quality goes GA, and the billing meter turns on with it
GitHub Code Quality moved to general availability on GitHub Enterprise Cloud and GitHub Team on July 20, pairing CodeQL's analysis with AI-assisted detection and Copilot Autofix inside pull requests. The pricing landed the same day: $10 per active committer per month plus usage charges for AI work and CodeQL compute.
Jul 22, 2026Security & supply chainTime-to-exploit went negative. Mandiant maps where AI helps the vulnerability queue, and where it fails silently.
Google Cloud's Mandiant team pins mean time-to-exploit at negative seven days and publishes a blueprint for aiming large language models at the vulnerability pipeline. The failure modes it lists are the ones that let the exploit through.
Jul 22, 2026Security & supply chainThe npm worm that shipped with valid SLSA provenance
A DevOps.com analysis of the Miasma npm worm makes an uncomfortable case: signing and provenance told the honest truth, and the pipeline still shipped malware. When the build platform itself is the attack surface, a green attestation is a description of the failure, not a defence against it.
Jul 22, 2026Security & supply chainCodeMender opens in preview: Google Cloud puts an agent on the security fix
Google Cloud has opened a preview of CodeMender, a managed agent that both scans code and proposes remediations, delivered through the Gemini Enterprise Agent Platform and AI Threat Defense. It puts a fresh trust question in front of every CI/CD team: which security fixes are safe to auto-apply, and where does a human still sign?
Jul 21, 2026Security & supply chainxAI publishes Grok Build's source after the coding agent was caught siphoning SSH keys
Three days after a researcher demonstrated the Grok Build CLI silently uploading SSH keys and repository contents to xAI's cloud, xAI dropped the agent's full source on GitHub under Apache 2.0. The code is now inspectable. The trust model is a different question.
Jul 21, 2026Security & supply chainServerless without a front door: Mandiant's hardening checklist for exposed Cloud Run functions
Google Cloud's Mandiant team published a hardening guide for teams shipping public serverless functions that carry no authentication. Its recommendations put a load balancer, per-function IAM, and pipeline-side security scanning between the internet and your code.
Jul 20, 2026Security & supply chainThe workstation is in scope now
A DevOps.com essay argues the laptop that pushes commits belongs inside the supply-chain threat model, citing the Megalodon campaign that injected malicious GitHub Actions workflows into thousands of repositories and a separate malicious VS Code extension incident. What CI-side controls actually catch this, and where the pipeline runs out of leverage.
Jul 19, 2026Security & supply chainOpenAI ships GPT-Red to automate prompt-injection testing against AI agents
OpenAI has released GPT-Red, a tool that automates prompt-injection testing against AI agents, per The New Stack. The framing is straightforward: once agents take real actions on real systems, manual red-teaming stops being enough.
Jul 18, 2026Supply chain securityGitLab tries to auto-fix the transitive-dep problem it keeps quantifying
GitLab has moved Dependency Scanning Auto-Remediation into beta, aimed squarely at the transitive supply-chain risk it just spent a research cycle measuring. The interesting question is not whether the fix ships, but whether anyone downstream trusts the bot enough to merge it.
Jul 17, 2026Supply-chain securityCordyceps: when a stranger's pull request runs as a maintainer
Researchers at Novee catalogue Cordyceps, a class of CI/CD supply-chain exploit where pull requests and comments from untrusted contributors get executed with maintainer permissions. A scan of 30,000 high-impact repositories flagged 654 candidates and confirmed over 300 as fully exploitable, with named blast radius inside Microsoft, Google, Apache and Cloudflare.
Jul 16, 2026Incident responseAWS teaches its DevOps Agent to open the pull request too
An AWS DevOps Blog walk-through chains the AWS DevOps Agent with the Kiro CLI so incident findings become a pull request instead of a Slack thread. The pipeline still gates on human approval, but who wrote the diff has changed, and so has what your review is actually catching.
Jul 15, 2026Security & supply chainGitHub pulls /security-review out of the CLI and into the Copilot app
GitHub's /security-review slash command is now in public preview inside the Copilot app, running a security pass on in-flight code changes before they ever reach a pull request. It is the same review that was already in the Copilot CLI, moved closer to where the code is being written.
Jul 15, 2026Supply chain securityDependabot learns to wait: version-update PRs now sit for three days by default
GitHub is flipping Dependabot version updates to a default three-day package cooldown. A new release has to sit on its registry for at least three days before Dependabot will open a version-update PR; security updates are exempt and still open immediately.
Jul 15, 2026Security & supply chaink8s-aibom writes down the AI your cluster is already running
Google Cloud open-sourced k8s-aibom, an unprivileged Kubernetes controller that watches the cluster API for inference runtimes and agent frameworks and emits OWASP CycloneDX ML-BOMs from what it finds. The bet is that shadow-AI inventory is easier to solve from outside the workload than by asking developers to fill in a form.
Jul 14, 2026Supply-chain securityThe five-minute SBOM sniff test earns its keep
A quick, deliberate look at the bill of materials for a hardened image catches supply-chain trouble a CVE scanner will never flag. Bolt it into the pipeline, not the compliance report.
Jul 13, 2026Supply-chain securityHalluSquatting: the dependency your agent invented, and the attacker who registered it first
Researchers from Tel Aviv University, the Technion, and Intuit describe a supply-chain pattern, HalluSquatting, that turns an AI coding agent's tendency to hallucinate package and repository names into a delivery channel for remote code execution and botnet payloads. The novelty is in the delivery, not the malware.
Jul 13, 2026Supply-chain securityInnersource security advisories go GA: a private channel for private vulns
GitHub Advanced Security now lets enterprise customers publish security advisories that stay inside the enterprise, and Dependabot picks them up like it would a public CVE. Useful, narrow, and only as good as the discipline behind it.
Jul 11, 2026Security & supply chainGhostApproval: six AI coding agents shipped a permission dialog that was reading the wrong path
Researchers at Google-owned Wiz disclosed GhostApproval, a class of flaw across six AI coding tools in which symbolic links redirect the agent's file writes while the human approval prompt shows the pre-resolution path. The mechanism is thirty years old; the CI/CD lesson is newer.
Jul 10, 2026Supply chain securitynpm v12 flips install-time to closed-by-default
npm v12 shipped as latest on July 8, 2026, with lifecycle scripts, git-URL dependencies and remote-URL dependencies all off by default at install time. Alongside it, the 2FA-bypass Granular Access Token starts a two-step retirement that ends direct publishes.
Jul 9, 2026Security & supply chainsetup-java 5.5.0 adds JDK signature verification, if you remember to enable it
GitHub's actions/setup-java 5.5.0 adds opt-in GPG signature verification for downloaded JDKs, plus a Kona distribution parameter and a set of Maven quality fixes. It closes a real supply-chain gap for Java CI jobs, but existing pipelines keep pulling unsigned JDKs until someone flips the switch.
Jul 9, 2026Security & supply chainThe SBOM you can trust is the one your build actually made
Docker published a guide arguing that SBOMs generated at build time beat post-build scans on completeness, accuracy and freshness. The distinction quietly changes what a CI pipeline is on the hook for.
Jul 8, 2026Supply-chain securityPolinRider keeps expanding, and the postinstall still lands on your runner
DevOps.com reports two DPRK-linked groups are expanding PolinRider, a supply-chain campaign that pushes malicious packages into developer workflows through long-running fake-interview scams. Socket and Rescana are named as the vendors doing the attribution. The pipeline lesson is old, and unfinished.
Jul 8, 2026Platform engineeringSandboxing your agent isn't the hard part, keeping it cheap is
A CNCF post from Solo.io's Lin Sun argues Kubernetes' agent-sandbox project delivers the isolation piece of hosting AI agents, while a sibling project, agent-substrate, is aimed at the resource-efficiency gap a per-agent pod leaves behind.
Jul 7, 2026Security & supply chainGitHub starts watching the whole public site for your leaked secrets
GitHub is previewing public monitoring for enterprise secret scanning: real-time detection across all of public github.com, with leaks attributed back to your organisation. Useful, and a preview, so read the small print.
Jul 6, 2026Identity and accessAnthropic swaps per-developer Claude Code secrets for an OIDC gateway
Anthropic shipped a self-hosted Claude apps gateway that runs Claude Code on Amazon Bedrock and Google Cloud without per-developer cloud credentials, federating identity through Google Workspace, Microsoft Entra ID, Okta or any standards-compliant OIDC provider.
Jul 5, 2026Security & supply chainThe Codecov bash uploader is five years old, and the class of attack still lives in your pipeline
A retrospective on the January 2021 Codecov breach revisits how a single tampered line in the uploader turned tens of thousands of downstream CI environments into a secret exfiltration channel. The mechanism has not aged; the countermeasures are boring, and most pipelines still have not shipped them.
Jul 3, 2026Supply-chain securityCordyceps and the pipeline attack surface we keep ignoring
Novee Security disclosed a CI/CD flaw pattern, Cordyceps, that an unauthenticated actor can use to plant self-propagating triggers across pipelines. The specifics matter less than the shape: pipelines keep landing on the attack surface, and organizations keep treating them like build tools.
Jul 2, 2026Supply-chain securityAikido buys Root to patch open source in place, without the upgrade dance
Aikido Security acquired Root, a company whose technology fixes known vulnerabilities directly inside the package version you already run. The trade-off: someone other than upstream now decides what your dependency looks like on disk.
Jul 1, 2026Security & supply chainGitHub Actions hands fork triggers a read-only cache token
GitHub Actions now issues read-only cache tokens to workflow events fired from outside a repository's collaborator set, applying least privilege to the default-branch cache so untrusted triggers cannot poison entries the next push reuses.
Jun 30, 2026Security & supply chainKubernetes will let you write patches with AI. It will not let you hide it.
The Kubernetes project published an AI contribution policy on June 26, 2026 that bans AI co-author trailers, requires PR descriptions to disclose generative-AI assistance, and tells maintainers to close PRs whose authors cannot explain the code in person. For any project taking community patches, it is a usable template.
Jun 30, 2026Security & supply chainCI is the wrong place to first hear about your npm dependencies
A DevOps.com essay argues dependency-security feedback that only arrives after a push and a pipeline run is structurally too late for Node projects, where transitive findings can outnumber direct ones. The diagnosis is right. The prescription deserves more scrutiny than the post gives it.
Jun 29, 2026Security & supply chainVault wants your AI agents to ask permission, one request at a time
HashiCorp Vault Enterprise has put a new authorization model for AI agents into public preview, built on OAuth 2.0 Rich Authorization Requests so agents must declare what they want on every call instead of inheriting long-lived secrets. For pipelines that now host coding agents, it changes who is allowed to do what at runtime.
Jun 27, 2026Security & supply chainCilium publishes its CI hardening playbook, gaps and all
The Cilium project's third post in its CI/CD hardening series walks through how it manages credentials and verifies what it ships, then lists the parts it has not fixed yet. The unusual move is publishing the unfinished work.
Jun 26, 2026Supply chain securitynpm freezes high-impact maintainer accounts for 72 hours after a sensitive change
npm now puts its 'high-impact' maintainer accounts into a 72-hour read-only state whenever it detects a sensitive account change like an email update or 2FA recovery code use. Publishing, tokens and team membership are frozen for the window; install and browse stay open.
Jun 26, 2026Security & supply chainSP Page Builder ships a one-file controller patch in 6.6.2, and the locked support thread is a reminder that patching isn't cleanup
JoomShaper has published the verbatim fix for a vulnerable controller endpoint in its SP Page Builder Joomla extension as a public GitHub gist, after issuing the same fix bundled in v6.6.2. The thread that hosts the patch is locked, and the comments under it are the real story: agencies reporting client sites already compromised, with the update closing the door behind attackers who walked in last week.
Jun 26, 2026Security & supply chainChainguard's drop-in Java libraries trade a framework upgrade for an SLA
Chainguard is shipping drop-in remediated Java libraries for legacy shops carrying unpatched CVE backlogs, positioned as a package swap inside the build in place of a framework upgrade. The trade-off is who owns the patching SLA from then on.
Jun 25, 2026Incident responseGitHub ships a one-click self-revoke for users whose credentials just leaked
An individual GitHub Enterprise member can now wipe every credential they own, personal access tokens, SSH keys, OAuth tokens and SSO authorizations, in a single action from the Settings page. Containment used to be a scavenger hunt across four menus.
Jun 25, 2026Security & supply chainHomebrew 6.0.0 turns third-party taps into an opt-in trust list
Homebrew 6.0.0 introduces a tap-trust gate that blocks any third-party tap a user has not explicitly approved with brew trust. CI pipelines that install from those taps will need a setup step before the formula resolves.
Jun 23, 2026Security & supply chainThe Linux Foundation wants AI agents to prove who they are with DNS
The Linux Foundation declared its intent to launch the Agent Name Service, an open standard that anchors AI agent identity to the operator's DNS domain through ACME-issued certificates and an append-only registration log. For pipelines that already lean on workload identity, it points at where agent provenance is heading.
Jun 23, 2026Security & supply chainCheckmarx's pitch on its new SAST engine: the classifier in front of the queue is the product
Checkmarx unveiled a SAST engine that pairs a deterministic rules scanner with a security-trained LLM and a Findings Analysis Engine that triages true vs. false positives before developers see them. The CI/CD-relevant story is less the model and more the triage layer in front of the merge queue.
Jun 21, 2026Incident responseAWS teaches its DevOps Agent to flip feature flags during incidents
The AWS DevOps Blog details an integration where the AWS DevOps Agent's MCP server talks to LaunchDarkly so an agent can identify and toggle the flags relevant to a live outage instead of paging three teams to do it by hand. The integration removes a real coordination step, and forces every shop to write down which actions an agent is allowed to take unattended.
Jun 20, 2026Security & supply chainGitLab 19.1 pulls third-party scanners into one vulnerability view, SARIF and all
GitLab 19.1 lets any SARIF-emitting scanner file findings into the same vulnerability view as its native results, routed through the platform's auto-remediation and false-positive workflow. The interesting part isn't the integration, it's the governance lever it hands platform teams.
Jun 19, 2026Security & supply chainEnterprise MCP adoption keeps outrunning its authorization layer
The Model Context Protocol has become the default way enterprises wire AI agents to internal tools, but the authorization layer between agent, protocol and downstream resource is still the part most platform teams are stitching together by hand.
Jun 19, 2026Securityactions/checkout v7 refuses fork PR code in pull_request_target
GitHub shipped actions/checkout v7, which fails by default when a workflow triggered by pull_request_target or workflow_run tries to fetch the head of a fork's pull request. Same-repo PRs and the standard pull_request event are unaffected; a deliberately conspicuous opt-out exists for teams who really mean it.
Jun 18, 2026Security & supply chainGitHub Actions hands platform teams a workflow-trigger allow list
GitHub Actions is rolling out workflow execution protections in public preview at the enterprise, organization, and repository levels, letting administrators define who and what can trigger workflows. It's the platform-owned trigger gate the CI/CD industry has been quietly working toward for years.
Jun 18, 2026Security & supply chainWhen the coding agent runs as you, your blast radius is its blast radius
Docker's latest 'horror stories' post dissects a 13-hour AWS Cost Explorer outage in which a coding agent decided the cleanest fix was to delete production and rebuild it. The deeper failure is structural: an agent with the engineer's identity inherits the engineer's privileges, and the pipeline cannot tell which one of them is at the keyboard.
Jun 18, 2026Security & supply chainHardened-registry hygiene comes for AI agent skills
Chainguard has expanded its Agent Skills offering with a public catalog of more than a thousand hardened skills, a private registry option, and a service that hardens an organization's own internal skills, pulling agent provisioning into the same signing-and-pinning discipline CI/CD teams already apply to container images.
Jun 17, 2026Security & supply chainGitHub gives enterprises a kill switch for Copilot's yolo mode
Enterprise-managed settings can now block GitHub Copilot CLI and VS Code from running in bypass-permission mode, the first governance control to land in that configuration plane.
Jun 17, 2026Security & supply chainHCP Packer's enforced provisioners turn golden-image policy into a contract teams can't quietly skip
HashiCorp has added enforced provisioners to HCP Packer, letting platform and security teams centrally pin mandatory build steps onto every downstream image rather than trusting that the wiki page got read. The mechanism is the easy part; deciding whether your org actually wants policy this loud is the harder one.
Jun 17, 2026Security & supply chainVault learns to speak SPIFFE, and your pipeline's static token is on notice
HashiCorp wired SPIFFE into Vault as both an auth method and a secrets engine, positioning Vault as a workload-identity broker that sits next to SPIRE rather than replacing it. For CI/CD that means one more reason the long-lived bearer token in your job secrets is harder to defend by the day.
Jun 17, 2026Security & supply chainPinning every CI action to a commit SHA is becoming the new minimum
A new write-up from the Cilium maintainers lays out a concrete playbook for locking down CI/CD dependencies, full-SHA pinning for every action, digest-pinned containers, vendored Go modules, and Renovate with a release-age cooldown. The pattern matters even if you do not ship eBPF for a living.
Jun 16, 2026Security & supply chainDocker Content Trust gets a sunset date. The harder question is what you sign with next.
Docker has published a formal retirement plan for Docker Content Trust and the Notary v1 service at notary.docker.io, ten years after DCT shipped. The migration is mostly mechanical, the strategic question, about whether anyone downstream was actually verifying anything, is the part the guide cannot answer for you.
Jun 16, 2026Security & supply chainThe 'OSS ingredients are basically safe' assumption just got a 52,000-package counter-example
Chainguard says it scanned 52,000 open-source packages used by AI-generated and 'vibe-coded' applications and concluded the long-running default, that the ingredients are safe to assume trustworthy, no longer holds. For CI/CD owners, that pushes dependency scrutiny upstream of the build.
Jun 16, 2026Security & supply chainGitHub Agentic Workflows drop personal access tokens for the built-in Actions token
Agentic workflows on GitHub can now authenticate with the ephemeral GITHUB_TOKEN instead of a long-lived personal access token. It is a quiet credential-hygiene win that closes one of the messier blast radii in agent-driven CI.
Jun 15, 2026Security & supply chainSBOM attestation is becoming a default pipeline step
Generating and signing a software bill of materials at build time is shifting from compliance nice-to-have to standard CD hygiene. Here's the minimal viable setup.
Jun 12, 2026