Security & supply chain

Vendor-neutral coverage of security & supply chain.

Articles

63 articles

CISA rewrites the SBOM floor: hashes are required, and the scope now covers AI and SaaS

The 2026 Minimum Elements guidance from CISA replaces the 2021 NTIA baseline, adds required hash, license and generation-context fields to every SBOM, renames Supplier Name to Component Producer, and extends the floor to open-source software, AI systems and software-as-a-service. For platform teams the practical consequence is that SBOM work stops living inside the build step and starts spilling into vendor contracts and runtime re-validation.

Aug 2, 2026 · Maya Okonkwo Security & supply chain

AlloyDB puts agents behind IAM groups so nobody has to share a database password again

Google's managed Postgres is adding IAM group authentication in preview, mapping Cloud Identity and Workforce Identity Federation groups to database roles. The point is not the passwordless slogan: it is that AI agents can finally carry a real end-user identity all the way to the row filter.

Aug 1, 2026 · Tomás Vega Security & supply chain

Docker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern

Docker has added OpenID Connect authentication for GitHub Actions on Team, Business and Docker Hardened Images plans, so workflows push and pull images with a short-lived per-run token instead of a stored Personal Access Token. It closes off one of the last static credentials still sitting in most Actions repos.

Aug 1, 2026 · Maya Okonkwo Security & supply chain

npm walls off 2FA-bypass tokens from account and package management

As of July 31, npm granular access tokens configured to bypass 2FA can no longer perform sensitive account, organisation or package management actions. Those calls now demand an interactive 2FA challenge, and the same tokens are on a January 2027 timer to lose direct publish rights too.

Aug 1, 2026 · Tomás Vega Security & supply chain

GTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams

Google's Threat Intelligence Group and Mandiant have released a joint guide on defending against software supply chain compromise, mapping four control categories onto the concrete pipeline levers most teams already own: short-lived tokens, ephemeral runners, package cooldowns and dependency verification.

Jul 30, 2026 · Tomás Vega Security & supply chain

OpenAI open-sources the Codex Security CLI and keeps the scanner in-house

OpenAI has released the Codex Security CLI and SDK under Apache 2.0, wiring pre-commit and CI scanning into the merge path with configurable severity gates. The scanning backend and the agent that produces threat models and patches remain proprietary and available only to a limited-beta allowlist.

Jul 30, 2026 · Tomás Vega Security & supply chain

Docker returns to its coding-agent series with an argument shaped like a CI problem: no layer between the agent and the host

The second entry in Docker's Coding Agent Horror Stories, published on July 20, argues that a coding agent runs under the developer's filesystem permissions and credentials with nothing isolating it from the host by default. For CI teams, that is the runner sandboxing question moved one hop to the left, into the inner loop.

Jul 29, 2026 · Maya Okonkwo Security & supply chain

Docker's fourth horror story revisits the Nx post-install hook that drained CI secrets

The fourth installment of Docker's Coding Agent Horror Stories, published July 28, revisits the August 2025 s1ngularity compromise of the Nx npm package. The lesson for CI/CD teams has nothing to do with coding agents. It is about the post-install hook that ran telemetry.js on every runner that pulled the package.

Jul 29, 2026 · Tomás Vega Security & supply chain

GitHub Actions freezes suspected-malicious workflow runs until a human signs off

GitHub has flipped Actions into a hold-first posture for workflow runs it flags as potentially malicious on public repositories: the run pauses until a collaborator with write access approves it from an authenticated web session. The change targets a wave of credential-theft attacks that push booby-trapped workflow files with stolen tokens.

Jul 28, 2026 · Tomás Vega Security & supply chain

PyPI stops accepting late file uploads to releases older than 14 days

PyPI will no longer accept new files uploaded to a release once that release is more than 14 days old, closing a stealth path a compromised publishing token could otherwise use to graft malicious code onto an established package. PyPI has said it is not yet aware of the technique being used in a real attack.

Jul 28, 2026 · Maya Okonkwo Security & supply chain

Confidential Containers hits CNCF incubation, and every pipeline is on notice

The CNCF Technical Oversight Committee voted Confidential Containers into incubation on July 22, moving TEE-backed pods one step closer to being a normal part of the Kubernetes stack. If your pipeline already signs and attests images, the runtime side is about to demand the same discipline.

Jul 25, 2026 · Tomás Vega Security & supply chain

FakeGit floods GitHub with malicious repos aimed at coding agents

Island researchers say a campaign called FakeGit spun up about 7,600 malicious GitHub repositories, many posing as AI skills or MCP servers, to hand SmartLoader and StealC to developers and to the agents fetching capabilities on their behalf.

Jul 24, 2026 · Maya Okonkwo Security & supply chain

Auditors, OIDC and the trust policy most teams get wrong

A DevOps.com walkthrough by Artur Yolchyan lays out a SOC 2-shaped CI/CD pipeline on GitHub Actions and AWS: multi-account isolation, OIDC federation locked to one repo and branch, and the same container image retagged all the way to production. The interesting part is not the account topology; it is the one line in the trust policy that decides who can talk to your ECR.

Jul 24, 2026 · Tomás Vega Security & supply chain

Pillar research says the AI coding agent sandbox leaks through trusted files

Pillar Security researchers demonstrated multiple sandbox-bypass techniques against AI coding agents, plus prompt-injection attacks hidden in READMEs, code comments and dependencies. OpenAI, Google and Cursor have patched several of the reported flaws.

Jul 23, 2026 · Maya Okonkwo Security & supply chain

Time-to-exploit went negative. Mandiant maps where AI helps the vulnerability queue, and where it fails silently.

Google Cloud's Mandiant team pins mean time-to-exploit at negative seven days and publishes a blueprint for aiming large language models at the vulnerability pipeline. The failure modes it lists are the ones that let the exploit through.

Jul 22, 2026 · Tomás Vega Security & supply chain

The npm worm that shipped with valid SLSA provenance

A DevOps.com analysis of the Miasma npm worm makes an uncomfortable case: signing and provenance told the honest truth, and the pipeline still shipped malware. When the build platform itself is the attack surface, a green attestation is a description of the failure, not a defence against it.

Jul 22, 2026 · Tomás Vega Security & supply chain

CodeMender opens in preview: Google Cloud puts an agent on the security fix

Google Cloud has opened a preview of CodeMender, a managed agent that both scans code and proposes remediations, delivered through the Gemini Enterprise Agent Platform and AI Threat Defense. It puts a fresh trust question in front of every CI/CD team: which security fixes are safe to auto-apply, and where does a human still sign?

Jul 21, 2026 · Tomás Vega Security & supply chain

Secret scanning custom patterns get a REST API, so you can PR your detectors

GitHub made REST endpoints for secret scanning custom patterns generally available on July 13, 2026. Detectors can now be created, listed, updated and deleted via API at repository, organization and enterprise scope, though dry runs and the final publish step still happen in the UI.

Jul 21, 2026 · Priya Nair Security & supply chain

xAI publishes Grok Build's source after the coding agent was caught siphoning SSH keys

Three days after a researcher demonstrated the Grok Build CLI silently uploading SSH keys and repository contents to xAI's cloud, xAI dropped the agent's full source on GitHub under Apache 2.0. The code is now inspectable. The trust model is a different question.

Jul 21, 2026 · Tomás Vega Security & supply chain

Serverless without a front door: Mandiant's hardening checklist for exposed Cloud Run functions

Google Cloud's Mandiant team published a hardening guide for teams shipping public serverless functions that carry no authentication. Its recommendations put a load balancer, per-function IAM, and pipeline-side security scanning between the internet and your code.

Jul 20, 2026 · Tomás Vega Security & supply chain

The workstation is in scope now

A DevOps.com essay argues the laptop that pushes commits belongs inside the supply-chain threat model, citing the Megalodon campaign that injected malicious GitHub Actions workflows into thousands of repositories and a separate malicious VS Code extension incident. What CI-side controls actually catch this, and where the pipeline runs out of leverage.

Jul 19, 2026 · Tomás Vega Security & supply chain

OpenAI ships GPT-Red to automate prompt-injection testing against AI agents

OpenAI has released GPT-Red, a tool that automates prompt-injection testing against AI agents, per The New Stack. The framing is straightforward: once agents take real actions on real systems, manual red-teaming stops being enough.

Jul 18, 2026 · Tomás Vega Security & supply chain

GitHub pulls /security-review out of the CLI and into the Copilot app

GitHub's /security-review slash command is now in public preview inside the Copilot app, running a security pass on in-flight code changes before they ever reach a pull request. It is the same review that was already in the Copilot CLI, moved closer to where the code is being written.

Jul 15, 2026 · Tomás Vega Security & supply chain

Datadog says months-long GitHub recon out of dormant 'ghost' accounts is prep for supply-chain attacks

Datadog security researchers say overlapping months-long campaigns have been abusing GitHub's public API and reactivating more than 50 long-dormant accounts to map organizations and their engineers. The setup looks a lot like the reconnaissance phase of a supply-chain intrusion.

Jul 14, 2026 · Maya Okonkwo Security & supply chain

k8s-aibom writes down the AI your cluster is already running

Google Cloud open-sourced k8s-aibom, an unprivileged Kubernetes controller that watches the cluster API for inference runtimes and agent frameworks and emits OWASP CycloneDX ML-BOMs from what it finds. The bet is that shadow-AI inventory is easier to solve from outside the workload than by asking developers to fill in a form.

Jul 14, 2026 · Tomás Vega Security & supply chain

GhostApproval: six AI coding agents shipped a permission dialog that was reading the wrong path

Researchers at Google-owned Wiz disclosed GhostApproval, a class of flaw across six AI coding tools in which symbolic links redirect the agent's file writes while the human approval prompt shows the pre-resolution path. The mechanism is thirty years old; the CI/CD lesson is newer.

Jul 10, 2026 · Tomás Vega Security & supply chain

setup-java 5.5.0 adds JDK signature verification, if you remember to enable it

GitHub's actions/setup-java 5.5.0 adds opt-in GPG signature verification for downloaded JDKs, plus a Kona distribution parameter and a set of Maven quality fixes. It closes a real supply-chain gap for Java CI jobs, but existing pipelines keep pulling unsigned JDKs until someone flips the switch.

Jul 9, 2026 · Tomás Vega Security & supply chain

The SBOM you can trust is the one your build actually made

Docker published a guide arguing that SBOMs generated at build time beat post-build scans on completeness, accuracy and freshness. The distinction quietly changes what a CI pipeline is on the hook for.

Jul 8, 2026 · Tomás Vega Security & supply chain

GitHub starts watching the whole public site for your leaked secrets

GitHub is previewing public monitoring for enterprise secret scanning: real-time detection across all of public github.com, with leaks attributed back to your organisation. Useful, and a preview, so read the small print.

Jul 6, 2026 · Tomás Vega Security & supply chain

Copilot CLI drops the PAT requirement inside GitHub Actions

GitHub says Copilot CLI, when invoked from a GitHub Actions workflow, will now accept the built-in GITHUB_TOKEN. That retires one of the last long-lived personal tokens teams were carrying just to script Copilot from CI.

Jul 4, 2026 · Maya Okonkwo Security & supply chain

The Codecov bash uploader is five years old, and the class of attack still lives in your pipeline

A retrospective on the January 2021 Codecov breach revisits how a single tampered line in the uploader turned tens of thousands of downstream CI environments into a secret exfiltration channel. The mechanism has not aged; the countermeasures are boring, and most pipelines still have not shipped them.

Jul 3, 2026 · Tomás Vega Security & supply chain

libcurl drops NTLM in September 2026, and on-prem Azure DevOps Git over HTTPS goes with it

Microsoft has warned Azure DevOps Server customers that Git operations over HTTPS will break for anyone still authenticating with NTLM once libcurl removes the protocol in September 2026. Build agents, workgroup boxes and service accounts are the ones most likely to hit the wall.

Jul 3, 2026 · Maya Okonkwo Security & supply chain

GitHub Actions hands fork triggers a read-only cache token

GitHub Actions now issues read-only cache tokens to workflow events fired from outside a repository's collaborator set, applying least privilege to the default-branch cache so untrusted triggers cannot poison entries the next push reuses.

Jun 30, 2026 · Tomás Vega Security & supply chain

Kubernetes will let you write patches with AI. It will not let you hide it.

The Kubernetes project published an AI contribution policy on June 26, 2026 that bans AI co-author trailers, requires PR descriptions to disclose generative-AI assistance, and tells maintainers to close PRs whose authors cannot explain the code in person. For any project taking community patches, it is a usable template.

Jun 30, 2026 · Tomás Vega Security & supply chain

CI is the wrong place to first hear about your npm dependencies

A DevOps.com essay argues dependency-security feedback that only arrives after a push and a pipeline run is structurally too late for Node projects, where transitive findings can outnumber direct ones. The diagnosis is right. The prescription deserves more scrutiny than the post gives it.

Jun 29, 2026 · Tomás Vega Security & supply chain

Agent identity is the new wall between functional dev and security review

A New Stack analysis argues agentic systems pass functional review and then stall at the security gate because no one scoped identity, permissions or audit at the platform layer first. For CI/CD owners, it pushes a familiar workload-identity problem onto a much larger fleet of callers.

Jun 28, 2026 · Maya Okonkwo Security & supply chain

Security Profiles Operator hits v1 with stable APIs and a hardening pass

The CNCF's Security Profiles Operator graduated to v1.0.0 on June 26, freezing eight CRD APIs and clearing a third-party audit. The kubelet-side follow-up, KEP 6061 for OCI artifact distribution, is the piece still in flight.

Jun 27, 2026 · Maya Okonkwo Security & supply chain

Vault wants your AI agents to ask permission, one request at a time

HashiCorp Vault Enterprise has put a new authorization model for AI agents into public preview, built on OAuth 2.0 Rich Authorization Requests so agents must declare what they want on every call instead of inheriting long-lived secrets. For pipelines that now host coding agents, it changes who is allowed to do what at runtime.

Jun 27, 2026 · Tomás Vega Security & supply chain

Cilium publishes its CI hardening playbook, gaps and all

The Cilium project's third post in its CI/CD hardening series walks through how it manages credentials and verifies what it ships, then lists the parts it has not fixed yet. The unusual move is publishing the unfinished work.

Jun 26, 2026 · Tomás Vega Security & supply chain

SP Page Builder ships a one-file controller patch in 6.6.2, and the locked support thread is a reminder that patching isn't cleanup

JoomShaper has published the verbatim fix for a vulnerable controller endpoint in its SP Page Builder Joomla extension as a public GitHub gist, after issuing the same fix bundled in v6.6.2. The thread that hosts the patch is locked, and the comments under it are the real story: agencies reporting client sites already compromised, with the update closing the door behind attackers who walked in last week.

Jun 26, 2026 · Tomás Vega Security & supply chain

Chainguard's drop-in Java libraries trade a framework upgrade for an SLA

Chainguard is shipping drop-in remediated Java libraries for legacy shops carrying unpatched CVE backlogs, positioned as a package swap inside the build in place of a framework upgrade. The trade-off is who owns the patching SLA from then on.

Jun 25, 2026 · Tomás Vega Security & supply chain

Dependabot can finally pull from private GitHub Packages without a PAT

GitHub gave Dependabot its own GITHUB_TOKEN access to private GitHub Packages and GHCR, retiring one of the most awkward credentials in any CI setup. For pipeline owners, that closes a quiet but persistent rotation tax.

Jun 24, 2026 · Priya Nair Security & supply chain

Homebrew 6.0.0 turns third-party taps into an opt-in trust list

Homebrew 6.0.0 introduces a tap-trust gate that blocks any third-party tap a user has not explicitly approved with brew trust. CI pipelines that install from those taps will need a setup step before the formula resolves.

Jun 23, 2026 · Tomás Vega Security & supply chain

The Linux Foundation wants AI agents to prove who they are with DNS

The Linux Foundation declared its intent to launch the Agent Name Service, an open standard that anchors AI agent identity to the operator's DNS domain through ACME-issued certificates and an append-only registration log. For pipelines that already lean on workload identity, it points at where agent provenance is heading.

Jun 23, 2026 · Tomás Vega Security & supply chain

Azure DevOps issuer in WIF service connections heads for July 2027 retirement

Microsoft has set July 1, 2027 as the retirement date for the Azure DevOps issuer in workload identity federation service connections, pushing Azure Pipelines that already moved to secretless auth onto the shared Microsoft Entra issuer over the next year.

Jun 22, 2026 · Maya Okonkwo Security & supply chain

Checkmarx's pitch on its new SAST engine: the classifier in front of the queue is the product

Checkmarx unveiled a SAST engine that pairs a deterministic rules scanner with a security-trained LLM and a Findings Analysis Engine that triages true vs. false positives before developers see them. The CI/CD-relevant story is less the model and more the triage layer in front of the merge queue.

Jun 21, 2026 · Tomás Vega Security & supply chain

GitLab 19.1 makes AI secret triage GA, and lets admins lock Duo on across an instance

GitLab 19.1 ships with two changes platform teams have to plan a rollout around: a generally available AI pass that scores secret-detection findings, and an always-on availability mode that lets administrators force Duo on for an entire instance or top-level group.

Jun 19, 2026 · Maya Okonkwo Security & supply chain

GitLab 19.1 pulls third-party scanners into one vulnerability view, SARIF and all

GitLab 19.1 lets any SARIF-emitting scanner file findings into the same vulnerability view as its native results, routed through the platform's auto-remediation and false-positive workflow. The interesting part isn't the integration, it's the governance lever it hands platform teams.

Jun 19, 2026 · Tomás Vega Security & supply chain

Enterprise MCP adoption keeps outrunning its authorization layer

The Model Context Protocol has become the default way enterprises wire AI agents to internal tools, but the authorization layer between agent, protocol and downstream resource is still the part most platform teams are stitching together by hand.

Jun 19, 2026 · Tomás Vega Security & supply chain

GitHub Actions hands platform teams a workflow-trigger allow list

GitHub Actions is rolling out workflow execution protections in public preview at the enterprise, organization, and repository levels, letting administrators define who and what can trigger workflows. It's the platform-owned trigger gate the CI/CD industry has been quietly working toward for years.

Jun 18, 2026 · Tomás Vega Security & supply chain

Google, Microsoft and OpenAI route their AI 'trust layer' work through the Linux Foundation

Three of the largest AI vendors are aligning on a Linux Foundation–housed effort to build a shared trust layer for AI systems. For platform teams the read is operational: artefact provenance for models and agents is about to ride the same plumbing that already carries binary attestation.

Jun 18, 2026 · Maya Okonkwo Security & supply chain

When the coding agent runs as you, your blast radius is its blast radius

Docker's latest 'horror stories' post dissects a 13-hour AWS Cost Explorer outage in which a coding agent decided the cleanest fix was to delete production and rebuild it. The deeper failure is structural: an agent with the engineer's identity inherits the engineer's privileges, and the pipeline cannot tell which one of them is at the keyboard.

Jun 18, 2026 · Tomás Vega Security & supply chain

Hardened-registry hygiene comes for AI agent skills

Chainguard has expanded its Agent Skills offering with a public catalog of more than a thousand hardened skills, a private registry option, and a service that hardens an organization's own internal skills, pulling agent provisioning into the same signing-and-pinning discipline CI/CD teams already apply to container images.

Jun 17, 2026 · Tomás Vega Security & supply chain

GitHub gives enterprises a kill switch for Copilot's yolo mode

Enterprise-managed settings can now block GitHub Copilot CLI and VS Code from running in bypass-permission mode, the first governance control to land in that configuration plane.

Jun 17, 2026 · Tomás Vega Security & supply chain

HCP Packer's enforced provisioners turn golden-image policy into a contract teams can't quietly skip

HashiCorp has added enforced provisioners to HCP Packer, letting platform and security teams centrally pin mandatory build steps onto every downstream image rather than trusting that the wiki page got read. The mechanism is the easy part; deciding whether your org actually wants policy this loud is the harder one.

Jun 17, 2026 · Tomás Vega Security & supply chain

Vault learns to speak SPIFFE, and your pipeline's static token is on notice

HashiCorp wired SPIFFE into Vault as both an auth method and a secrets engine, positioning Vault as a workload-identity broker that sits next to SPIRE rather than replacing it. For CI/CD that means one more reason the long-lived bearer token in your job secrets is harder to defend by the day.

Jun 17, 2026 · Tomás Vega Security & supply chain

Tenet's 'Agentjacking' research turns Sentry error data into a prompt-injection vector for AI coding agents

Security firm Tenet has demonstrated an indirect prompt-injection technique it calls Agentjacking, malicious instructions hidden inside Sentry error data that get executed by an AI coding agent with shell access. The operational read is that any third-party telemetry an agent ingests is now untrusted input.

Jun 16, 2026 · Maya Okonkwo Security & supply chain

Pinning every CI action to a commit SHA is becoming the new minimum

A new write-up from the Cilium maintainers lays out a concrete playbook for locking down CI/CD dependencies, full-SHA pinning for every action, digest-pinned containers, vendored Go modules, and Renovate with a release-age cooldown. The pattern matters even if you do not ship eBPF for a living.

Jun 16, 2026 · Tomás Vega Security & supply chain

Docker Content Trust gets a sunset date. The harder question is what you sign with next.

Docker has published a formal retirement plan for Docker Content Trust and the Notary v1 service at notary.docker.io, ten years after DCT shipped. The migration is mostly mechanical, the strategic question, about whether anyone downstream was actually verifying anything, is the part the guide cannot answer for you.

Jun 16, 2026 · Tomás Vega Security & supply chain

Docker Engine 29.4.3 moves the 'Copy Fail' mitigation off seccomp after the first fix broke 32-bit containers

Docker's default profile now uses AppArmor and SELinux to block the AF_ALG socket path that CVE-2026-31431 exploits, after a seccomp-only fix in 29.4.2 broke i386 binaries, Go 386 builds and Wine. The kernel patch is still the real fix; on Ubuntu it has not landed yet.

Jun 16, 2026 · Maya Okonkwo Security & supply chain

The 'OSS ingredients are basically safe' assumption just got a 52,000-package counter-example

Chainguard says it scanned 52,000 open-source packages used by AI-generated and 'vibe-coded' applications and concluded the long-running default, that the ingredients are safe to assume trustworthy, no longer holds. For CI/CD owners, that pushes dependency scrutiny upstream of the build.

Jun 16, 2026 · Tomás Vega Security & supply chain

GitHub Agentic Workflows drop personal access tokens for the built-in Actions token

Agentic workflows on GitHub can now authenticate with the ephemeral GITHUB_TOKEN instead of a long-lived personal access token. It is a quiet credential-hygiene win that closes one of the messier blast radii in agent-driven CI.

Jun 15, 2026 · Tomás Vega Security & supply chain

SBOM attestation is becoming a default pipeline step

Generating and signing a software bill of materials at build time is shifting from compliance nice-to-have to standard CD hygiene. Here's the minimal viable setup.

Jun 12, 2026 · Tomás Vega