Last trap: a Kyverno PolicyException must also list the autogen- rule name, or the Deployment stays blocked.

Full workflow, policy, and break-glass:
https://devtocash.com/blog/2026-09-19-cosign-keyless-signing-github-actions-sbom-kyverno-verify
#DevSecOps #Kubernetes

A new AI supply chain vulnerability called #Plugin4Shell highlights a serious weakness in how AI coding agents handle plugins.

#Cybersecurity #AISecurity #ArtificialIntelligence #SupplyChainSecurity #DevSecOps #GitHub #ClaudeCode #OpenAI #Copilot #SoftwareSecurity

thehackernews.com/2026/09/plug...

OWASP's 2026 LLM Top 10 reveals where AI security risks really live—and it's not always in the model. Incident data shows the bigger threat is in the systems around it.

https://www.resilientcyber.io/p/the-2026-owasp-llm-top-10-and-the

#appsec #DevSecOps

The latest update for #Harness includes "#AI #DevSecOps: how #machinelearning is reshaping the secure SDLC" and "Governance is the platform problem worth solving".

#DevOps #CICD https://opsmtrs.com/4hhDUoO

Laravel Scalpel: A New Way to Detect Filesystem Intrusions in Laravel.

#Laravel #PHP #Cybersecurity #ApplicationSecurity #DevSecOps #WebSecurity #SoftwareDevelopment #CI_CD

laravel-news.com/laravel-scal...

JFrog Artifactory under active attack: researchers confirm in-the-wild exploitation of three critical vulns chained for admin access. If you're serving…

https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201

#appsec #DevSecOps

Found the same local admin password on every workstation? The real risk isn't weak entropy—it's the blast radius. Here's how to write a finding…

https://dev.to/rockyyy/you-found-the-same-local-admin-password-on-every-workstation-now-what-do-you-write-223k

#appsec #DevSecOps

HTTP request smuggling exploits disagreements between proxies and app servers on request framing. When your front-end and back-end parse HTTP differently, attackers…

https://dev.to/rockyyy/the-bug-that-hides-between-two-servers-that-disagree-about-http-3760

#appsec #DevSecOps

A critical CVE sat in production for 11 days because the image scan was moved after deploy to speed up pipelines. One team's costly lesson in why…

https://www.reddit.com/r/devsecops/comments/1wfj03i/a_critical_cve_sat_in_production_for_eleven_days/

#appsec #DevSecOps

AI agents getting real API keys is a security disaster. One developer built capbroker to prove it and show how…

https://dev.to/suryanshu_singh_91afc11dd/capbroker-i-gave-an-ai-agent-a-fake-github-key-then-watched-it-get-tricked-into-trying-to-delete-21ah

#appsec #DevSecOps

Deleted your S3 bucket but forgot to update DNS? An attacker can claim the bucket name in seconds and serve malicious content under your…

https://dev.to/bala_paranj_059d338e44e7e/the-bucket-you-deleted-is-still-in-your-dns-s3-bucket-takeover-at-bime-2hka

#appsec #DevSecOps

Аналоги GitHub в 2026 году: российские, мировые и self-hosted решения

Если GitHub больше не подходит из-за локализации данных, оплаты или регул…

Подробнее: https://gruzdevv.ru/stati/analogi-github-rossijskie-mirovye-self-hosted/

#аналогиGitHub #git #selfhosted #российскоеПО #DevSecOps #IT #SaaS

With #DevSecOps tools that integrate security & speed throughout development, we help agencies meet Federal Fiscal Year-End goals. Contact us for a quick quote & expert support: https://carah.io/DevSecOpsFFYE26 #CountOnCarahsoft #ITgovernance

Un cache CI empoisonné peut compromettre vos builds.

Avec cache-mode, limitez les droits du cache GitHub Actions : lecture pour les PR, écriture réservée aux jobs fiables.

cryptolab.re/posts/2026/g...

#GitHubActions #DevSecOps #Cybersecurite

AI agents are writing code before AppSec can see it. Shift-left security may need a complete rethink as the control point moves further upstream than most programs can reach.

https://www.resilientcyber.io/p/the-left-in-shift-left-moved

#appsec #DevSecOps