Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos.
Hackers accessed roughly 1,900 GitHub accounts, then used them to slip credential-stealing workflows into more than 30,000 repositories. The malicio…
Open Source
⚑ Сообщить о проблемеПоследние новости Open Source от Tech News
Все темы
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Anthropic built its own git replacement for AI-scale coding. But you can’t have it.
This week, Anthropic revealed it built an in-house version control system to handle exploding code merges. It says Claude was both part Th…
66% of billion-dollar companies leave critical bugs unpatched — the part the AI bug-hunting hype leaves out
Chainguard has launched an AI-powered security harness that uses frontier models, including Anthropic’s restricted Claude Mythos 5.1, to find…
CloudBees just committed to an AI-first pivot. Here’s why it matters for enterprise DevOps teams
When new CloudBees CEO Mo Plassnig took the job earlier this year, his board of directors handed him a mandate The post CloudBees just committed to…
Shai-Hulud: Whoever controls your package registry controls your pipeline
On September 15, 2025, npm’s registry did something unprecedented: Packages began updating themselves.  No maintainer ran npm publish. No…
JetBrains told everyone to patch. It didn’t patch itself.
JetBrains is urging users of its Cadence cloud development service to rotate credentials and treat previous executions and their outputs The post Je…
The npm attack that turned provenance attestations into camouflage
⁠Security researchers this week disclosed an npm supply-chain attack affecting more than 400 packages, including projects connected to Keyv an…
Why traditional CI/CD fails for LLMs (and the release gates we built to fix it)
This article explains why traditional CI/CD gates are not enough for production AI systems. I share a practical release-gating approach The post Why…
Cordyceps flaw pattern is more proof CI/CD is part of the attack surface
On June 24, research from Novee Security was released, reporting a CI/CD weakness that could enable anyone with an unauthenticated The post Cordycep…
GitLab 19.0 trades its string section for a full DevSecOps orchestra
There are orchestras… and then there are mere string, horn, or woodwind sections. As the self-styled intelligent orchestration platform for Th…
As agentic dev tools boom, workflow auditability becomes the constraint
Recently, I was working with a senior engineering leader at a large financial institution to review their DevSecOps platform engineering The post As…
Improving token efficiency in GitHub Agentic Workflows
Agentic workflows that run on every pull request can quietly accumulate large API bills. Here's how we instrumented our own production workflows, fo…
The agent code explosion is here. We need to rethink our pipelines, fast.
GitHub recently published an update on availability following a couple of rough incidents in April. The article opened with a The post The agent cod…
Взлом Bitwarden CLI на npm: 1,5 часа кражи токенов и SSH-ключей
Bitwarden CLI 2026.4.0 на npm 22 апреля около 1,5 часа содержал малварь, крадущую GitHub/npm-токены, SSH-ключи и конфиги ИИ-ассистентов. Что делать.…