Fork pull requests and runner trust: what Gitea's Actions approval fixes change
Fork pull requests and runner trust: what Gitea's Actions approval fixes change A self-hosted forge holds source code, pipeline definitions and the…
DevOps
⚑ Report a ProblemLatest DevOps news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
cloud
database
devchallenge
devops
docker
javascript
kubernetes
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
Sub-100ms Cargo & Food Safety Triage: Eliminating 72% of Routing LLM Calls in National Supply Chains
Sub-100ms Cargo & Food Safety Triage: Eliminating 72% of Routing LLM Calls in National Supply Chains Part 3 of the "Jev-First Routing for LangGr…
The EDI 997, Decoded: What a Functional Acknowledgment Actually Proves (and What It Doesn't)
The EDI 997, Decoded: What a Functional Acknowledgment Actually Proves (and What It Doesn't) A 997 · Functional Acknowledgment proves one narrow thi…
Verify Audit Evidence with a Signed Payload, Not by Format
When many audit-evidence publishers (the systems that produce signed rows of evidence) each emit a different shape and the consumer checks signature…
57,029 Harbor Registries Online: An Artefact Store Is a Deployment Authority
57,029 Harbor Registries Online: An Artefact Store Is a Deployment Authority A container registry holds the images that a platform will run. Control…
3PL EDI, Decoded: The 940, 943, 944, 945, and 947 Warehouse Family
Short answer: when you hand fulfillment to a 3PL, five X12 documents become the contract of record for your inventory: the 940 (Warehouse Shipping O…
MemTensor: When an AI Memory Plugin Becomes the Credential Collector
MemTensor: When an AI Memory Plugin Becomes the Credential Collector StepSecurity reported that the open-source AI memory framework MemTensor had it…
Build & Release #3: I Deleted Every npm Token I Own
On October 7th I tried to publish @7onic-ui/tokens@0.3.7 and npm told me my own package didn't exist. npm error 404 Not Found - PUT https://regist…
What a build provenance attestation verifies, and what it leaves open
What a build provenance attestation verifies, and what it leaves open Supply chain security has a verification problem. Teams sign artefacts, publis…
Three merged PRs in an MCP security scanner: the review that found my bug, and two more
What happened Three PRs merged into yunaremaia/mcp-guard — a supply-chain/security scanner for MCP servers — in roughly 36 hours: PR What it did The…
CVE-2026-96365 and the Contribution Model: Why Drupal Site Owners Carry the Patch Burden
CVE-2026-96365 and the Contribution Model: Why Drupal Site Owners Carry the Patch Burden Vulnerability overview CVE-2026-96365 belongs to WID-SEC-20…
Verdaccio on 3,336 hosts: private npm registries and the tokens they hand out
Verdaccio on 3,336 hosts: private npm registries and the tokens they hand out Verdaccio is a lightweight private registry for npm packages. Teams ru…
Artifact Repositories Are Trust Anchors: Incident Response for a Compromised Build Pipeline
Artifact Repositories Are Trust Anchors: Incident Response for a Compromised Build Pipeline A software artifact repository is usually described as i…
The Credential Relay Economy: How Supply Chain Attacks Chain Through SaaS Vendors
The Credential Relay Economy: How Supply Chain Attacks Chain Through SaaS Vendors The 2026 Verizon DBIR put third-party involvement in confirmed bre…
The Artifactory Token Chain: Why Build Repositories Are a Credential Store
The Artifactory Token Chain: Why Build Repositories Are a Credential Store An artifact repository is rarely described as a credential store, yet tha…
700 Agents, 25 Actions Each, and Nothing Fired
Somewhere in your SIEM there's a rule that fires when one account does too much, too fast. Every threshold like it is a quiet bet that the attacker…
The Shai-Hulud npm worm showed that opening a folder is enough to run code
The Shai-Hulud npm worm showed that opening a folder is enough to run code In August 2026 an attacker took over the GitHub account of a maintainer w…
One Console, Every Customer: What the N-able N-central Pre-Authentication RCE Says About RMM Concentration Risk
One Console, Every Customer: What the N-able N-central Pre-Authentication RCE Says About RMM Concentration Risk Remote monitoring and management pla…
The Default Join Key That Let Attackers Mint Admin Tokens on JFrog Artifactory
The Default Join Key That Let Attackers Mint Admin Tokens on JFrog Artifactory A package repository that hands out administrator credentials to an u…
AI Supply Chain Compromises: 7 Entry Points Your Security Review Probably Misses
Most of an AI system is made of things you did not build: pretrained weights, public datasets, Python packages, a coding assistant, a handful of MCP…
A Supply-Chain Worm Wrote Itself Into Claude Code's Hook Files to Survive Credential Rotation
Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sur…
Image verification, one layer below admission
Every admission webhook you rely on has an escape hatch. Nothing scandalous about that, it is just how Kubernetes wires them up. A CNCF post on July…
PyPI stops accepting late file uploads to releases older than 14 days
PyPI now rejects new file uploads against any release older than 14 days, closing off a small but useful window that a compromised publishing token…
Innersource security advisories go GA: a private channel for private vulns
Your platform team ships an internal package. Half the org pulls it. Someone finds a bug that in the wrong hands is a full RCE. What do you do next:…
uv audit vs pip-audit, and a gate narrower than it looks
Until now, the tools that install packages have never once stopped to ask, "Are you sure it's okay to take this one?" Whether it's pip install or np…
MCP supply chain attacks are coming — here's how to prepare
The npm incident, but for AI agents Remember when malicious npm packages stole crypto wallets? The same thing is coming for MCP servers. An MCP serv…
From vexctl scripts to a governed VEX platform: building vex-ui with Next.js, keyless signing, and a Trivy-consumable repo
un Trivy against almost any vendor container image and you'll get a wall of findings. Most of them don't matter, the vulnerable code path is never e…
Aikido buys Root to patch open source in place, without the upgrade dance
Every open-source CVE backlog has that one line item you keep sliding into next quarter. The library is a couple of majors behind, the upgrade break…
CI is the wrong place to first hear about your npm dependencies
Your CI catches the npm vulnerability. Your developer is already three branches away and one standup behind. The package is installed, the lockfile…
A Rogue Registry in My Own Backyard: Anatomy of a Two-Line Supply Chain Attack
The previous parts of this series were written from a comfortable distance. I read the Trend Micro diagrams about Shai-Hulud, I theorised about Dock…