Blog
How a managed AI DevOps team replaces platform-engineering labor: capability tiers, approval gates, audit trails, and the economics of autonomous infrastructure.
CVE-2026-0257 is a CVSS 7.8 auth bypass in PAN-OS GlobalProtect. When the cert encrypting the override cookie is shared with another feature, an unauthenticated attacker can forge it and open a VPN session. Some victims got full internal-network access.
CVE-2026-0257 is a CVSS 7.8 auth bypass in PAN-OS GlobalProtect. When the cert encrypting the override cookie is shared with another feature, an unauthenticated attacker can forge it and open a VPN session. Some victims got full internal-network access.
GitGuardian's annual report: 28.65M new hardcoded secrets in public GitHub in 2025 (+34% YoY). AI-service leaks surged 81%. Claude Code co-authored commits leak at 3.2% — more than double the 1.5% baseline. 24,008 secrets sit in public MCP config files.
CISA added n8n CVE-2025-68613 (CVSS 9.9 RCE) to KEV on March 11. ~24,700 unpatched instances were exposed. n8n now ships MCP Server Trigger and MCP Client Tool nodes — making the control plane agent-callable on both sides.
CVE-2026-3854 let any authenticated user inject internal headers via push options. One git push, RCE on the backend, access to every public and private repo on the same instance. Patch is GHES 3.19.3.
A trojanized Nx Console extension (2.2M+ installs) was live on VS Code Marketplace for 18 minutes — long enough to ship a credential stealer that took 1Password vaults, Claude Code configs, GitHub tokens, and AWS keys.
CVE-2026-41089 is a stack-based buffer overflow in Windows Netlogon. Unauthenticated RCE on a domain controller — the identity authority for every Windows host. Microsoft is ~24% of the entire KEV catalog. The watch has to be concentration-aware.
Argo CD CVE-2026-42880 is an authorization bypass in ServerSideDiff. Read-only users can pull plaintext Kubernetes Secrets — API keys, DB credentials, TLS certs — by abusing the Server-Side Apply dry-run. The read-only threat model just broke.
NGINX Rift is a heap buffer overflow in ngx_http_rewrite_module that's been in the project for eighteen years. Affects every release from 0.6.27 through 1.30.0. AI vulnerability research found it in six hours after eighteen years of human review missed it.
Microsoft disclosed CVE-2026-41091 (LPE to SYSTEM via Defender's Malware Protection Engine) and CVE-2026-45498 (Defender DoS) on May 19. Both actively exploited. CISA added both to KEV with a June 3 deadline.
May 2026 Patch Tuesday shipped a cluster of cloud-side-remediated Azure CVEs: DevOps (CVSS 10), Cassandra (CVSS 9.9 and 9.0), Cloud Shell (CVSS 9.6). Microsoft patched all of them without customer action. What's left on the customer-obligation list?
CVE-2026-20182 is a CVSS 10 authentication bypass in the Cisco Catalyst SD-WAN Controller. Actively exploited by UAT-8616. CISA added it to KEV with a three-day federal deadline.
Copy Fail is a nine-year-old logic bug in the Linux kernel's authencesn template that lets an unprivileged local user write four bytes into any readable file's page cache. From inside a container, it's a host takeover.
CVE-2026-32173 is a multi-tenant authentication gap in Azure SRE Agent Gateway that let any Entra ID account observe live command streams, LLM reasoning, tool calls, and credentials across other tenants. The AI agent itself is now a due-diligence category.
CVE-2026-3854 is the largest source-control RCE in years. A single authenticated git push with crafted push-options executes arbitrary commands on the GitHub.com or GHES backend. At disclosure, 88% of GHES instances were still vulnerable.
Three coordinated supply-chain attacks hit npm, PyPI, and Docker Hub between April 21-23. Checkmarx KICS, CanisterSprawl, xinference — all targeting the same prize: CI/CD credentials and cloud tokens.
Copy Fail (CVE-2026-31431) is a Linux kernel LPE in algif_aead. CISA gave FCEB until May 15 to patch. It affects Red Hat, SUSE, Ubuntu, Amazon Linux — and millions of Kubernetes worker nodes.
Microsoft shipped 120+ CVE fixes on May 13. Two carry the cloud story: Azure DevOps CVE-2026-42826 (CVSS 10, fixed server-side, no customer action) and Hyper-V CVE-2026-40402 (CVSS 9.3, you patch).
LMDeploy CVE-2026-33626 is an SSRF in the vision-LLM image loader. Sysdig saw the first exploit attempt 12 hours and 31 minutes after disclosure. The attacker used it to port-scan the internal network and steal IAM credentials.
ThreatModeler closed its $100M+ acquisition of IriusRisk at the end of 2025, merging the two largest enterprise threat-modeling platforms. If you were running both, or mid-evaluation, you have a procurement decision to make.
Threat modeling stopped being a quarterly Visio session in 2026. Post-IriusRisk acquisition, the combined platform pushes continuous AI-assisted modeling into the SDLC. Here's what that looks like for daily shippers.
AI coding assistants ship code faster than humans can review it. Secrets reach git faster too. The 2026 landscape converged on pre-commit detection. Here's the comparison that matters.
DevSecOps has shifted from "shift left" to autonomous remediation. Here are the 12 tools that actually move the needle in 2026 — by use case, with the trade-offs.
Most teams don't know what's in their repos — leaked secrets, outdated dependencies, misconfigured CI. Here's how to run a thorough audit and fix what you find.
Your first enterprise customer will send a security questionnaire that assumes you're a Fortune 500. Here's what to fix, what to document, and what to leave alone.
A monorepo CI pipeline runs fifty workflows a day across a dozen services. One over-privileged token compromises them all. Here's the 2026 playbook.
Terraform Cloud is the backbone of most platform teams in 2026 — and the single largest blast radius in your infrastructure. Here's how to secure it.
Zero trust isn't a product. It's an architecture. For DevOps, it means treating every pipeline, service, and engineer as untrusted by default. Here's what that looks like.
Sealed Secrets was fine with one cluster. At twelve, it isn't. Here's the decision guide for when each option earns its keep — and how to combine them without an operator zoo.
The software supply chain is the new attack surface. SBOMs, SLSA, build provenance — moving from nice-to-have to regulatory requirement. Here's what to implement.
A monorepo with Go, Python, Node, and Rust doesn't produce one SBOM. It produces four, and they don't agree. Here's the 2026 playbook for getting them aligned.
4-in-1
scan layers
Most scanners generate noise. The best ones in 2026 combine static analysis, runtime context, and AI prioritization to surface the findings that matter.
4,000+
vulns found
GitHub Actions is the most popular CI/CD platform — and one of the most targeted. Here are the security risks teams ignore and how to lock the pipelines down.
99%
misconfig
Terraform and CloudFormation misconfigurations are the #1 cause of cloud breaches. Catch them in the PR, not in production.
5+ days
detection lag
Hardcoded secrets are the easiest vulnerability to exploit and the hardest habit to break. Here's the practical path from .env to automated rotation.
65d→hrs
remediation
The average vulnerability takes 65 days to fix. AI-generated remediation PRs cut that to hours. Here's how they actually work.
30 minutes with the team. We'll look at your cloud together, show you what we'd take off your plate, and scope a first month if it's a fit.