Tag

#ci-cd-security

Tagged “ci-cd-security”

8 articles

Omdia's 2026 supply-chain survey puts the annual-incident rate at 77 percent

A Docker-sponsored Omdia report pegs the twelve-month software supply-chain incident rate at 77 percent of surveyed organizations, with AI technology now ranked as the top supply-chain risk. The tool-effectiveness table rewards the sponsor's product category.

Aug 4, 2026 · Maya Okonkwo Security & supply chain

GTIG and Mandiant publish a supply-chain hardening playbook aimed at CI/CD teams

Google's Threat Intelligence Group and Mandiant have released a joint guide on defending against software supply chain compromise, mapping four control categories onto the concrete pipeline levers most teams already own: short-lived tokens, ephemeral runners, package cooldowns and dependency verification.

Jul 30, 2026 · Tomás Vega Security & supply chain

OpenAI open-sources the Codex Security CLI and keeps the scanner in-house

OpenAI has released the Codex Security CLI and SDK under Apache 2.0, wiring pre-commit and CI scanning into the merge path with configurable severity gates. The scanning backend and the agent that produces threat models and patches remain proprietary and available only to a limited-beta allowlist.

Jul 30, 2026 · Tomás Vega Security & supply chain

GitHub Actions freezes suspected-malicious workflow runs until a human signs off

GitHub has flipped Actions into a hold-first posture for workflow runs it flags as potentially malicious on public repositories: the run pauses until a collaborator with write access approves it from an authenticated web session. The change targets a wave of credential-theft attacks that push booby-trapped workflow files with stolen tokens.

Jul 28, 2026 · Tomás Vega Supply-chain security

Cordyceps and the pipeline attack surface we keep ignoring

Novee Security disclosed a CI/CD flaw pattern, Cordyceps, that an unauthenticated actor can use to plant self-propagating triggers across pipelines. The specifics matter less than the shape: pipelines keep landing on the attack surface, and organizations keep treating them like build tools.

Jul 2, 2026 · Tomás Vega Security & supply chain

CI is the wrong place to first hear about your npm dependencies

A DevOps.com essay argues dependency-security feedback that only arrives after a push and a pipeline run is structurally too late for Node projects, where transitive findings can outnumber direct ones. The diagnosis is right. The prescription deserves more scrutiny than the post gives it.

Jun 29, 2026 · Tomás Vega Security & supply chain

Agent identity is the new wall between functional dev and security review

A New Stack analysis argues agentic systems pass functional review and then stall at the security gate because no one scoped identity, permissions or audit at the platform layer first. For CI/CD owners, it pushes a familiar workload-identity problem onto a much larger fleet of callers.

Jun 28, 2026 · Maya Okonkwo Security & supply chain

Cilium publishes its CI hardening playbook, gaps and all

The Cilium project's third post in its CI/CD hardening series walks through how it manages credentials and verifies what it ships, then lists the parts it has not fixed yet. The unusual move is publishing the unfinished work.

Jun 26, 2026 · Tomás Vega