GitHub Actionsでよくある3つの『見えない』脆弱性を、自前の静的解析で検出してみた

#GitHubActions #CI #Security #DevSecOps #CICD

🧑‍💻 Two days. Deep dives. Workshops. Open source.

Join @allthingsopen.bsky.social 2026 in North Carolina, Oct. 19–20, for sessions on #AI, #DevSecOps, community leadership, & more.

LPI is a Media Partner. Attendees get 20% off #LPI exams!

→ lpi.org/zftx

#AllThingsOpen #LPI #FOSS

GitHub Actions推奨セキュリティ実施率はわずか17.5%！NTT調査で無防備な実態が発覚。

・権限最小化やSHA固定の未実施
・CI/CDがサプライチェーン攻撃の的に
・便利さの裏で設定の形骸化が深刻

ワークフロー防衛も急務！

#GitHubActions #DevSecOps

https://lckhd.eu/FX8CVZ

#Terraform #DriftDetection #GitHubActions #InfrastructureAsCode #DevSecOps

Using Infrastructure as Code (IaC) tools like Terraform to manage your resources is recommended. With IaC, drift is a key concept, and it isn’t watched closely enough. It usually gets noticed at

If your title has "engineer" and AI is in production, this is your track.

AISecENG Study Guide www.amazon.com/dp/B0GXWJ99YC

If this helped, share it with someone who's building or buying AI this year.

#AISecurity #SecurityEngineering #AISecENG #DevSecOps #CyberSecurity

False positives killing your team's productivity? 😵‍💫

Anchore Secure gives you signal, not noise 📡

https://anchore.com/platform/secure/

#SoftwareSupplyChain #SBOM #CyberSecurity #Compliance #DevSecOps

Critical auth flaw in Langflow lets unauthenticated users access private workflows and execute components. Upgrade to 1.10.1 or…

https://dev.to/cverports/cve-2026-105698-cve-2026-105698-missing-authorization-in-deprecated-chat-vertices-endpoints-in-24n0

#appsec #DevSecOps

Herkese merhaba, yeni yazımda Docker Sandboxes mimarisini, AI agent ile Sandbox arasındaki ilişkiyi ve sunduğu izolasyon çözümlerini kaleme aldım. 👩‍💻 🐳 Keyifli okumalar! 📚 #Docker #DockerSandboxes #Security #AIAgent #DevSecOps #Containers #DevOps
www.linkedin.com/pulse/docker...

Parallels Desktop flaw lets unprivileged users escalate to root via appliance installs—a critical risk for developers using the virtualization platform for local testing and…

https://jfrog.com/blog/parallels-desktop-turns-appliance-install-into-root-shell/

#appsec #DevSecOps

"In and Out of Code" just landed. cyberpunk lo-fi for anyone who lives in a terminal, plus everyone who just likes the vibe. also on other https://open.spotify.com/track/1yt4lHdJdJoY0TCynh9TAZ?si=fe606793d46348d6

#Music #Linux #DevSecOps #GitHub #CyberSecurity #CodingMusic #LoFi

Silent security failures don't start where you think. New SAGE research shows most begin turns before vulnerable code is written—in plans #CyberSecurity #AIAgents #AppSec #DevSecOps

https://freegardner.com/synapse/silent-security-failures-start-before-vulnerable-code.html

One argument-injection bug took down OpenAI Codex at Pwn2Own—exposing how AI agents fail where traditional security tooling can't see the attack…

https://dev.to/coridev/one-argument-injection-bug-took-down-openai-codex-at-pwn2own-heres-the-detection-gap-1if1

#appsec #DevSecOps

Nearly 2 million malicious open source packages tracked since 2017—and Q3 2026 alone saw 149K new detections. npm still dominates, but the real threat: 74% of malware…

https://www.sonatype.com/blog/q3-2026-open-source-malware-index-when-compromise-compounds

#appsec #DevSecOps

Your AI governance policy can't stop risky code. Your CI/CD pipeline can catch some of it.

Learn how to automate AI risk checks, detect unauthorized LLMs, and generate NIST AI RMF evidence.

shorturl.at/2Kopa

#AIGovernance #DevSecOps

15K unvetted MCP servers are a ticking supply chain bomb. Remote servers can run code that doesn't match their repos—giving your agents tool access and data…

https://dev.to/coridev/15465-public-mcp-servers-zero-vetting-what-that-means-for-your-agents-5ha0

#appsec #DevSecOps