Silent security failures don't start where you think. New SAGE research shows most begin turns before vulnerable code is written—in plans #CyberSecurity #AIAgents #AppSec #DevSecOps

https://freegardner.com/synapse/silent-security-failures-start-before-vulnerable-code.html

One argument-injection bug took down OpenAI Codex at Pwn2Own—exposing how AI agents fail where traditional security tooling can't see the attack…

https://dev.to/coridev/one-argument-injection-bug-took-down-openai-codex-at-pwn2own-heres-the-detection-gap-1if1

#appsec #DevSecOps

Nearly 2 million malicious open source packages tracked since 2017—and Q3 2026 alone saw 149K new detections. npm still dominates, but the real threat: 74% of malware…

https://www.sonatype.com/blog/q3-2026-open-source-malware-index-when-compromise-compounds

#appsec #DevSecOps

Your AI governance policy can't stop risky code. Your CI/CD pipeline can catch some of it.

Learn how to automate AI risk checks, detect unauthorized LLMs, and generate NIST AI RMF evidence.

shorturl.at/2Kopa

#AIGovernance #DevSecOps

15K unvetted MCP servers are a ticking supply chain bomb. Remote servers can run code that doesn't match their repos—giving your agents tool access and data…

https://dev.to/coridev/15465-public-mcp-servers-zero-vetting-what-that-means-for-your-agents-5ha0

#appsec #DevSecOps

AI code generation is outpacing traditional security scanning. Manicode Security's Ron Perris explains why embedding secure coding patterns into LLM context is more…

https://absolute-appsec-eps.s3.us-west-1.amazonaws.com/episodes/Absolute_AppSec_Ep_335.mp3

#appsec #DevSecOps

A compromised release of the Tensorlake npm SDK (v0.5.144) delivered an obfuscated credential-stealing worm with an active dead-man switch.

The ChainDrop supply chain attack steals cloud tokens, developer keys, and wipes hosts if GitHub access is revoked.

#infosec #cybersecurity #appsec #devsecops

Read more:https://lnkd.in/p/evvmGGTq #DevSecOps

Fake Terraform provider delivers back-doors across macOS, Windows & Linux. #Terraform #SupplyChain #Malware #Web3 #Cybersecurity #DevSecOps https://thedailytechfeed.com/attackers-hijack-terraform-workflows-to-deploy-cross-platform-malware/

SPEAKER SPOTLIGHT ⚡

Catch Yunus Aydın from Trendyol at #BSidesBerlin as he presents "Your AI Just Leaked a Secret"—revealing how "vibe coding" & commit metadata expose leaked secrets across thousands of GitHub repos.

👉 Schedule & Tickets: bsides.berlin
#AISecurity #DevSecOps #AppSec

Security Exceptions Are Architecture Decisions with Expiration Dates secdoc.tech/security-exc...

#security-architecture #risk-management #governance #policy-as-code #devsecops #open-source #cybersecurity

AWS released Strands Box for AI agent sandboxing. Policies can block HTTP requests after sensitive file access, limit API calls, and keep credentials outside the agent process. macOS-only developer preview. Test enforcement boundaries before production. #AWS #DevSecOps

Wiz leads for cloud-context IaC risk, Snyk owns PR fixes—Checkov keeps OSS strong. #IaC #CloudSecurity #DevSecOps #OpenSource #SecurityTools #Governance https://thedailytechfeed.com/top-iac-security-tools-in-2026-whats-rising-above-the-rest/

Google Cloud announced Gemini agents with individual identities, audit trails, network policies, and project spending caps. Agents can also create sub-agents. Test permission inheritance, unauthorized tool calls, and budget exhaustion before production. #GoogleCloud #DevSecOps

A hardcoded AWS key in a helper script got scraped off GitHub in 90 seconds. Detection, rotation, and prevention that scale:
https://www.valtersit.com/guides/security/hardcoded-passwords-in-scripts-thats-not-automation-thats-a-breach/
#secretsmanagement #devsecops

Two questions most IT teams can't answer: How many AI agents are running? Which ones can delete data? @HYCU's free aiR Graph scans Entra ID and Okta and answers both with deterministic rules, no LLM scoring.
coderlegion.com/30339/hycus-... #AgenticAI #AISecurity #DevSecOps #DataResilience

Security Tip: Stop hardcoding secrets in your source code! 🛡️ Hardcoded API keys are easily leaked via version control. Use a Secrets Manager and automate key rotation to minimize your window of risk. Learn more at https://cvedatabase.com #InfoSec #CyberSecurity #API #DevSecOps

GitHub's new secret detection model can flag passwords without recognizable token patterns by reading code context. Existing alerts are upgraded now. AI push protection is still in private preview and will consume AI Credits when enabled. #GitHub #DevSecOps