Devops

Devops | News, how-tos, features, reviews, and videos

A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove

The vulnerability impacts self-managed CE and EE instances and provides an unauthenticated path to arbitrary file reads. It’s already being probed in the wild.

By Taryn Plumb

Sep 14, 20265 mins

CI/CDDevopsGitLab

How the Marine Corps slashed IT delays by shifting to DevOps and agile development

By Shane O'Neill for CSO Events

Sep 15, 20258 mins

Agile DevelopmentDevSecOpsDevops

Building scalable secrets management in hybrid cloud environments: Lessons from enterprise adoption

By Shilpi Mittal

Jul 18, 20256 mins

Build AutomationCloud SecurityCyberattacks

Salesforce Industry Cloud riddled with configuration risks

By Lucian Constantin

Jun 16, 20258 mins

Cloud SecurityData and Information SecurityDevops

Articles

Developers: apply these 10 mitigations first to prevent supply chain attacks

Current cybersecurity development risk frameworks don’t cover all of the tactics hackers used to compromise SolarWinds, log4j, or XZ Utils, says report, which offers a 'starter kit' of critical tasks.

By Howard Solomon

Mar 20, 2025 1 min

DevopsSoftware DevelopmentThreat and Vulnerability Management

Top 10 cybersecurity misconfigurations: Nail the setup to avoid attacks

Misconfigured cybersecurity products can be gateways to a breach – this guide from the NSA and CISA identifies key weak spots in software configuration that can be corrected.

By Chris Hughes

Dec 17, 2024 10 mins

DevopsSecurity PracticesThreat and Vulnerability Management

Warning to ServiceNow admins: Block publicly available KB articles

AppOmni finds thousands of articles containing sensitive information are open to the internet.

By Howard Solomon

Sep 17, 2024 6 mins

DevopsPrivacySecurity Practices

GitHub Actions typosquatting: A high-impact supply chain attack-in-waiting

Developers who mistype names and owners of GitHub Actions expose their repositories and accounts to malicious code execution, with significant software supply chain implications, researchers have found.

By Lucian Constantin

Sep 5, 2024 6 mins

CyberattacksDevopsVersion Control Systems

Software risk is business risk—now is the time for C-Suite to act

While software introduces new ways of doing business, it can also introduce serious new risks. When it comes to digital transformation, don’t let inherit risks stand in the way of the competitive advantage your business seeks.

By Jason Schmitt, General Manager, Synopsys Software Integrity Group

Mar 13, 2023 4 mins

DevopsSoftware Development

CrowdStrike was not the only security vendor vulnerable to hasty testing

Rushing through patches and pushing them directly to global environments has become mainstream making it likely that another vendor does this again.

By Shweta Sharma

Jul 29, 2024 4 mins

App TestingVulnerabilities

Open-source scanner can identify risky Microsoft SCCM configurations

Researcher that helped compile the knowledge base of common misconfigurations in SCCM releases scanner MisconfigurationManager.ps1.

By Lucian Constantin

Apr 15, 2024 3 mins

DevopsThreat and Vulnerability Management

New knowledge base compiles Microsoft Configuration Manager attack techniques

Researchers from SpecterOps have put together a comprehensive resource that catalogs SCCM attacks and provides defensive strategies and hardening guidance.

By Lucian Constantin

Mar 15, 2024 6 mins

DevopsThreat and Vulnerability ManagementWindows Security

Google offers free access to fuzzing framework

The AI-powered OSS-Fuzz tool can help find vulnerabilities and be combined with an auto-patching pipeline.

By John P. Mello Jr.

Feb 2, 2024 5 mins

App TestingDevSecOpsVulnerabilities

Group permission misconfiguration exposes Google Kubernetes Engine clusters

It's easy for admins to misunderstand what GKE considers authenticated users and set permissions that could allow anyone with a Google account to access their systems.

By Lucian Constantin

Jan 24, 2024 7 mins

Access ControlDevops

Understanding OWASP’s Bill of Material Maturity Model: Not all SBOMs are created equal

The push to create more detailed, reliable, and mature BOMs with sufficient detail and depth to counter supply chain attacks continues to advance with the latest OWASP model.

By Chris Hughes

Nov 15, 2023 9 mins

DevSecOpsDevopsSecurity Practices

Secure from the get-go: top challenges in implementing shift-left cybersecurity approaches

An approach that builds cybersecurity into software and platforms can create stronger security, reducing vulnerabilities and risks. But implementation often comes with challenges.

By Mary K. Pratt

Nov 7, 2023 12 mins

DevSecOpsDevopsSecurity Infrastructure

Orca’s new LLM tool to help detect Log4j-like exploits

Orca Security’s new search tool takes natural language queries to hunt for Log4j-like vulnerabilities.

By Shweta Sharma

Sep 8, 2023 3 mins

Cloud SecurityDevops

View all

A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove

Practical lessons from deploying AI securely at scale

OpenAI to acquire Promptfoo to strengthen AI agent security testing

Notepad++ author says fixes make update mechanism ‘effectively unexploitable’

The mistold story of a software failure that grounded 6,000 jets

AI in CI/CD pipelines can be tricked into behaving badly

How the Marine Corps slashed IT delays by shifting to DevOps and agile development

Building scalable secrets management in hybrid cloud environments: Lessons from enterprise adoption

Salesforce Industry Cloud riddled with configuration risks

Articles

Developers: apply these 10 mitigations first to prevent supply chain attacks

Top 10 cybersecurity misconfigurations: Nail the setup to avoid attacks

Warning to ServiceNow admins: Block publicly available KB articles

GitHub Actions typosquatting: A high-impact supply chain attack-in-waiting

Software risk is business risk—now is the time for C-Suite to act

CrowdStrike was not the only security vendor vulnerable to hasty testing

Open-source scanner can identify risky Microsoft SCCM configurations

New knowledge base compiles Microsoft Configuration Manager attack techniques

Google offers free access to fuzzing framework

Group permission misconfiguration exposes Google Kubernetes Engine clusters

Understanding OWASP’s Bill of Material Maturity Model: Not all SBOMs are created equal

Secure from the get-go: top challenges in implementing shift-left cybersecurity approaches

Orca’s new LLM tool to help detect Log4j-like exploits

Resources

Managing modern identity complexity and reducing executive risk

The new era of executive risk: Why identity security must be continuous

5 identity security questions CISOs must be ready to answer