#DevSecOps
All CosmicBytez Labs articles tagged #DevSecOps, across news, security advisories, how-to guides, and projects.
- HOWTO
Container Image Signing and Verification with Cosign and Sigstore
Sign your container images with Cosign's keyless Sigstore workflow, verify signatures before deploy, and enforce the policy in Kubernetes so unsigned images never run.
- News
How Financial Services Companies Can Modernize Their Software Supply Chain
AI-accelerated exploits are pushing banks, insurers, and asset managers to modernize software supply chains without costly application rewrites.
- HOWTO
Software Bill of Materials (SBOM) Generation with Syft and Grype
Generate a complete inventory of every package, library, and dependency in your containers and codebases with Syft, then scan that inventory for known...
- News
Chainguard Doubles Output to 1 Billion Build Manifests in Six Months
Chainguard's container image factory doubled its rebuild output from 500 million to over 1 billion manifests, driven by a new agentic pipeline.
- Project
Container Supply Chain Security: SBOMs and Keyless Signing with Syft, Grype, and Cosign
Build a CI pipeline that generates SBOMs with Syft, scans them for vulnerabilities with Grype, and signs container images keylessly with Cosign — closing...
- HOWTO
Detecting Leaked Secrets in Git Repos with Gitleaks
Stop shipping API keys, tokens, and passwords to GitHub. Learn how to scan git history, enforce pre-commit hooks, and integrate Gitleaks into your CI/CD...
- Security
CVE-2026-10053: GitLab CE/EE Path Traversal Enables Remote Code Execution
A path traversal flaw in GitLab's package registry allows authenticated users to achieve RCE. Affects versions 18.8 through 19.2.1.
- News
Critical GitLab GraphQL Flaw Lets Unauthenticated Attackers Delete Public Projects
CVE-2026-19478 (CVSS 9.4) lets unauthenticated attackers delete public GitLab projects via GraphQL. Self-managed CE/EE must patch to 19.2.4 immediately.
- News
OpenAI Models Used Artifactory Zero-Days to Escape to the Internet
JFrog confirmed that OpenAI's GPT-5.6 Sol autonomously discovered and chained 8 zero-day vulnerabilities in self-hosted Artifactory to escape a sandboxed...
- News
New GitHub, PyPI Policies Boost Supply Chain Security
Dependabot gets a three-day cooldown window before opening pull requests, and PyPI now rejects file uploads to releases older than 14 days—two targeted...
- News
Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
Security researcher Yuhang Wu published a working PoC exploiting two Ruby memory corruption vulnerabilities in the Oj JSON parser to achieve RCE as the...
- News
What Changes When AI Writes Your Code: Supply Chain Security in the Age of LLMs
Software supply chain security was already complex. Now that AI coding assistants are writing production code, security teams face new questions about...
- News
Software Is Now Written at the Speed of Thought. Security Isn't.
AI-assisted code generation has collapsed the time between idea and deployment, but security review cycles have not kept pace. The gap between how fast...
- Project
OWASP DefectDojo: Self-Hosted Vulnerability Management Platform
Aggregate, deduplicate, and track security findings from 100+ scanners in a unified dashboard. Build a production-grade vulnerability management pipeline...
- News
New Initiative Tackles Security for End-of-Life Open Source Software
The Open Source Sustainability Initiative launches to help enterprises manage and secure aging open source projects, addressing the growing compliance and...
- News
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Novee Security researchers have identified a critical exploitable CI/CD workflow pattern dubbed Cordyceps that enables attackers to hijack GitHub Actions...
- News
Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking
Security researchers have disclosed a class of exploitable flaws in CI/CD pipeline configurations that allow unauthenticated attackers to take full...
- News
Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way
AI agents can access databases, trigger workflows, deploy code, and interact with critical business systems — often with little oversight. Token Security...
- News
How Software Development's Speed Obsession Enabled TeamPCP's Chaos Crusade
TeamPCP's remarkable success attacking open-source software was no accident — it exploited a cultural vulnerability baked into modern development: the...
- News
Novo Nordisk Breach Exposes Software Development Pipeline Risk
A leaked GitHub token at Novo Nordisk has exposed a fundamental flaw in how organizations approach secrets management — treating it as a tooling problem...
- HOWTO
Docker Security Hardening: Locking Down Container Environments
A practical, step-by-step guide to hardening Docker deployments — from non-root users and read-only filesystems to capability drops, resource limits, and...
- News
OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds
OWASP has launched CVE Lite CLI, a free open-source command line tool that scans software projects in seconds to identify packages with known CVE…
- News
Open Source DockSec Uses AI to Cut Through Vulnerability
DockSec, an OWASP incubator project, combines multiple container security scanners with AI-generated plain-English remediation guidance and exact Dockerfile.
- News
Megalodon GitHub Attack Targets 5,561 Repos with Malicious
Cybersecurity researchers have uncovered Megalodon, an automated attack campaign that pushed 5,718 malicious commits to over 5,500 GitHub repositories in...
- News
Living Off the Pipeline: Defending Against CI/CD Subversion
Adversaries are increasingly weaponizing CI/CD pipelines as a living-off-the-land vector — abusing trusted build infrastructure to execute attacks without...
- News
Build Application Firewalls Aim to Stop the Next Supply
A new class of security tooling called Build Application Firewalls inspects runtime behavior inside software build pipelines rather than just scanning...
- News
Chainguard Unveils Factory 2.0 to Automate Hardening the Software Supply Chain
The rebuilt Chainguard Factory platform adds deeper security automation designed to continuously reconcile open source artifacts across containers,...
- News
Claude Source Code Leak Highlights Big Supply Chain Missteps
The accidental exposure of Anthropic's Claude Code source code via an npm packaging error is the latest reminder that software supply chains need...
- News
Cisco Source Code Stolen in Trivy-Linked Dev Environment
Cisco has suffered a major cyberattack after threat actors leveraged stolen credentials from the recent Trivy supply chain compromise to breach its...
- News
The State of Secrets Sprawl 2026: 9 Takeaways for CISOs
GitGuardian's State of Secrets Sprawl 2026 report found 29 million new hardcoded secrets in public GitHub repositories in 2025 alone — a 34%...
- HOWTO
Container Security Scanning with Trivy: Images, IaC, and CI/CD
Learn how to use Trivy to scan container images, Dockerfiles, Kubernetes manifests, and Terraform for vulnerabilities and misconfigurations — then...
- HOWTO
HashiCorp Vault: Centralized Secrets Management for Modern
Deploy and configure HashiCorp Vault to securely store, rotate, and audit secrets across your infrastructure — covering installation, auth methods,...
- HOWTO
How to Deploy Falco for Kubernetes Runtime Security
Step-by-step guide to deploying Falco as a Kubernetes runtime security engine. Covers Helm installation, custom rule authoring, Falcosidekick alerting...
- News
Betterleaks: New Open-Source Secrets Scanner Built to Replace Gitleaks
Betterleaks is a new open-source tool that scans directories, files, and git repositories for valid secrets — and validates them against live APIs before...
- Project
HashiCorp Vault: Secrets Management for Your Homelab and Apps
Deploy HashiCorp Vault to centrally manage secrets, certificates, and dynamic credentials — eliminating hardcoded passwords from your infrastructure with...
- Project
Securing AI-Assisted Development with Claude Code
Build guardrails around AI-generated code with Claude Code hooks, security-scanning agents, OWASP-aware prompting, and automated secret detection. A...
- Checklist
Application Deployment Security Checklist
Pre-deployment checklist for launching new applications into production — security review gates, monitoring setup, rollback procedures, dependency...
- HOWTO
How to Secure GitHub Actions Workflows with OIDC, SHA
Harden your CI/CD pipeline by replacing long-lived secrets with OIDC short-lived tokens, pinning third-party actions to commit SHAs, enforcing...
- HOWTO
Docker Security Fundamentals: Protecting Your Containers
Learn essential Docker security practices including image scanning, runtime protection, network isolation, and secrets management for production environments.