DevSecOps

DevSecOps | News, how-tos, features, reviews, and videos

For application security: SCA, SAST, DAST and MAST. What next?

If you think SAST and SCA are enough, you’re already behind. The future of app security is posture, provenance and proof, not alerts.

By Sunil Gentyala

Jan 13, 2026 10 mins

Application Security DevSecOps Security

Rogue MCP servers can take over Cursor’s built-in browser

A new proof-of-concept attack shows that malicious Model Context Protocol servers can inject JavaScript into Cursor’s browser — and potentially leverage the IDE’s privileges to perform system tasks.

By Lucian Constantin

Nov 13, 2025 6 mins

Application Security DevSecOps Vulnerabilities

AI-powered bug hunting shakes up bounty industry — for better or worse

AI tools are democratizing and accelerating vulnerability discovery — and taxing vulnerability management programs with false positives and ‘AI slop.’

By John Leyden

Oct 31, 2025 6 mins

Application Security Artificial Intelligence DevSecOps

Network security devices endanger orgs with ’90s era flaws

Built to defend enterprise networks, network edge security devices are becoming liabilities, with an alarming rise in zero-day exploits of what experts describe as basic vulnerabilities. Can the security device industry correct course?

By Lucian Constantin

Oct 20, 2025 15 mins

Application Security DevSecOps Technology Industry

GitHub Copilot prompt injection flaw leaked sensitive data from private repos

Hidden comments in pull requests analyzed by Copilot Chat leaked AWS keys from users’ private repositories, demonstrating yet another way prompt injection attacks can unfold.

By Lucian Constantin

Oct 8, 2025 5 mins

Application Security Artificial Intelligence DevSecOps

AI coding assistants amplify deeper cybersecurity risks

Although capable of reducing trivial mistakes, AI coding copilots leave enterprises at risk of increased insecure coding patterns, exposed secrets, and cloud misconfigurations, research reveals.

By John Leyden

Sep 25, 2025 10 mins

Application Security DevSecOps Security Practices

How the Marine Corps slashed IT delays by shifting to DevOps and agile development

Operation StormBreaker helped the Marine Corps deliver secure, modern digital services to Marines and their families.

By Shane O'Neill for CSO Events

Sep 15, 2025 8 mins

Agile Development DevSecOps Devops

Critical Docker Desktop flaw allows container escape

Missing authentication on the Docker Engine management API for Docker Desktop on Windows and Mac allows attackers to break out from containers and potentially execute malicious code on the underlying host system.

By Lucian Constantin

Aug 26, 2025 4 mins

Application Security DevSecOps

AI supply chain threats loom — as security practices lag

Recent findings of AI ecosystem insecurities and attacks show how important MLSecOps is to securing AI strategies from complex and often highly concealed risks.

By Lucian Constantin

Jul 1, 2025 7 mins

Application Security Data and Information Security DevSecOps

GitHub Actions attack renders even security-aware orgs vulnerable

Many open-source repositories contain privileged GitHub Actions workflows that execute untrusted code and can be triggered by attackers to expose credentials and access tokens, as MITRE and Splunk found out.

By Lucian Constantin

Jun 18, 2025 7 mins

DevSecOps Version Control Systems Vulnerabilities