@getpacketai.bsky.socialNearly 2 million malicious open source packages tracked since 2017—and Q3 2026 alone saw 149K new detections. npm still dominates, but the real threat: 74% of malware…
https://www.sonatype.com/blog/q3-2026-open-source-malware-index-when-compromise-compounds
@cyberlifecoach.bsky.socialYour AI governance policy can't stop risky code. Your CI/CD pipeline can catch some of it.
Learn how to automate AI risk checks, detect unauthorized LLMs, and generate NIST AI RMF evidence.
@getpacketai.bsky.social15K unvetted MCP servers are a ticking supply chain bomb. Remote servers can run code that doesn't match their repos—giving your agents tool access and data…
https://dev.to/coridev/15465-public-mcp-servers-zero-vetting-what-that-means-for-your-agents-5ha0
@getpacketai.bsky.socialAI code generation is outpacing traditional security scanning. Manicode Security's Ron Perris explains why embedding secure coding patterns into LLM context is more…
https://absolute-appsec-eps.s3.us-west-1.amazonaws.com/episodes/Absolute_AppSec_Ep_335.mp3
@gadgetry.bsky.socialA compromised release of the Tensorlake npm SDK (v0.5.144) delivered an obfuscated credential-stealing worm with an active dead-man switch.
The ChainDrop supply chain attack steals cloud tokens, developer keys, and wipes hosts if GitHub access is revoked.
@infrajump.bsky.socialRead more:https://lnkd.in/p/evvmGGTq #DevSecOps
@thedailytechfeed.comFake Terraform provider delivers back-doors across macOS, Windows & Linux. #Terraform #SupplyChain #Malware #Web3 #Cybersecurity #DevSecOps https://thedailytechfeed.com/attackers-hijack-terraform-workflows-to-deploy-cross-platform-malware/
@bsidesberlin.bsky.socialSPEAKER SPOTLIGHT ⚡
Catch Yunus Aydın from Trendyol at #BSidesBerlin as he presents "Your AI Just Leaked a Secret"—revealing how "vibe coding" & commit metadata expose leaked secrets across thousands of GitHub repos.
👉 Schedule & Tickets: bsides.berlin
#AISecurity #DevSecOps #AppSec
@secdoc.bsky.socialSecurity Exceptions Are Architecture Decisions with Expiration Dates secdoc.tech/security-exc...
#security-architecture #risk-management #governance #policy-as-code #devsecops #open-source #cybersecurity
@infrajump.bsky.socialAWS released Strands Box for AI agent sandboxing. Policies can block HTTP requests after sensitive file access, limit API calls, and keep credentials outside the agent process. macOS-only developer preview. Test enforcement boundaries before production. #AWS #DevSecOps
@thedailytechfeed.comWiz leads for cloud-context IaC risk, Snyk owns PR fixes—Checkov keeps OSS strong. #IaC #CloudSecurity #DevSecOps #OpenSource #SecurityTools #Governance https://thedailytechfeed.com/top-iac-security-tools-in-2026-whats-rising-above-the-rest/
@infrajump.bsky.socialGoogle Cloud announced Gemini agents with individual identities, audit trails, network policies, and project spending caps. Agents can also create sub-agents. Test permission inheritance, unauthorized tool calls, and budget exhaustion before production. #GoogleCloud #DevSecOps
@hugovalters.bsky.socialA hardcoded AWS key in a helper script got scraped off GitHub in 90 seconds. Detection, rotation, and prevention that scale:
https://www.valtersit.com/guides/security/hardcoded-passwords-in-scripts-thats-not-automation-thats-a-breach/
#secretsmanagement #devsecops
@ctsmithiii.bsky.socialTwo questions most IT teams can't answer: How many AI agents are running? Which ones can delete data? @HYCU's free aiR Graph scans Entra ID and Okta and answers both with deterministic rules, no LLM scoring.
coderlegion.com/30339/hycus-... #AgenticAI #AISecurity #DevSecOps #DataResilience
@cvedatabase.bsky.socialSecurity Tip: Stop hardcoding secrets in your source code! 🛡️ Hardcoded API keys are easily leaked via version control. Use a Secrets Manager and automate key rotation to minimize your window of risk. Learn more at https://cvedatabase.com #InfoSec #CyberSecurity #API #DevSecOps
@infrajump.bsky.socialGitHub's new secret detection model can flag passwords without recognizable token patterns by reading code context. Existing alerts are upgraded now. AI push protection is still in private preview and will consume AI Credits when enabled. #GitHub #DevSecOps
@cyberlensai.bsky.socialTrust check pattern for any new devtool: 1. Who maintains it? 2. What permissions does it request? 3. Does the repo expose secrets/config? 4. Are deps pinned and current? 5. Does the website pass basic browser hardening? Speed is great. Blind trust is how you get owned. #DevSecOps
@osde8info.bsky.socialred hat summit connect @ @tobaccodock ansible roadmap #devsecops
@thedailytechfeed.comGitHub’s ModernBERT flags hidden passwords pre-push—real-time secret protection goes live in October. #Security #GitHub #AI #SecretScanning #DevSecOps #ModernBERT https://thedailytechfeed.com/githubs-new-ai-flags-hidden-passwords-before-code-push/
@osde8info.bsky.socialred hat summit connect @ @tobaccodocks @openshift.bsky.social virtualisation #devsecops
