Tag: devops security
9 articles
Binance Crypto Heist Traced to North Korean Hackers
Binance's investigation reveals that the massive crypto heist, valued at $6.3 billion, was a sophisticated attack involving a compromised DevOps laptop and unauthorized access to a service container, rather than a simple one-click exploit. The exchange is still gathering facts, but has found no evidence of a leaked wallet private key.
GitLab Flaw Enables Remote Code Execution Across 12 Years of Releases
A critical GitLab flaw, tracked as CVE-2026-110264, allows unauthenticated users to execute arbitrary code on the server, posing a severe threat to organizations running self-managed infrastructure. This vulnerability has been affecting GitLab releases for a staggering 12 years, from version 7.0 to the current 19.x branches.
GitLab Fixes Code Execution Flaw with Maximum Severity Rating
GitLab has patched a critical vulnerability that could have let hackers run malicious code on its servers, thanks to a flaw in its CI/CD configuration that wasn't properly validating regular expressions. This maximum-severity bug, tracked as CVE-2026-97229, could be exploited by unauthenticated users, making it a major security risk.
Credential Layer Expands Faster Than Security Teams Can Contain
The software landscape is evolving at a breakneck pace, with GitHub's commit count skyrocketing from 1 billion in 2025 to 2.9 billion by August 2026 - a staggering rate that hints at an explosion of credentials and identities that need to be secured. This rapid growth leaves security teams scrambling to keep up with the expanding attack surface.
GitLab patches RCE flaw in AI Gateway service
GitLab has patched a critical remote-code-execution flaw in its AI Gateway service, known as CVE-2026-90970, which could have allowed attackers to run arbitrary commands on vulnerable instances. Even users with basic privileges could exploit this vulnerability, making it essential to apply the patch ASAP.
Mass-Scanning Campaign Exploits Vite Flaw to Harvest Cloud Credentials
A high-severity flaw in Vite, tracked as CVE-2026-39364, has been exploited in a mass-scanning campaign, allowing attackers to bypass security restrictions and harvest cloud credentials. By manipulating query parameters, unauthenticated attackers can leak sensitive files that were meant to be blocked.
Microsoft Azure DevOps Flaw Exposes AI Review Agents to Hidden Attacks
Imagine a hidden sentence that only AI sees, turning a reviewer's own AI agent into a vulnerability that lets attackers access projects they shouldn't - a chilling security flaw discovered in Microsoft Azure DevOps. This flaw, known as a confused-deputy vulnerability, was cleverly exploited in a proof of concept by Manifold Security.
Miasma Malware Targets npm, GitHub in Expanded Supply Chain Attack
Over 550 GitHub repositories have been compromised in a massive supply-chain attack, with malware harvesting developer credentials and spreading across package registries and workflows. The attack has already infected numerous npm packages and one Go module, putting developer data at risk.
AI Coding Adoption Outpaces Governance, Raises Security Risks
The rapid adoption of AI coding tools has outpaced governance, with 97% of teams using AI assistants, but only 30% having a fully governed approach to oversight, leaving a significant security risk gap. This disconnect raises concerns about where risks are accumulating and how work is getting done.