DevSecOps | Breaking Cybersecurity News | The Hacker News

Security is fundamentally about knowing what a system is supposed to do, then catching it when it does something else. For software with deterministic execution paths, that is a tractable problem. For AI agents, it is not. An agent does not follow a fixed code path. It reasons toward a goal, selects tools based on that reasoning, and adapts its next action based on what those tools return. The same input can produce a different sequence of actions depending on context, session history, and what an external tool happened to return. Behavior is the attack surface, and behavior changes. Traditional proxies and AI firewalls were built to inspect content: what a user sent, what a model returned. Intent security asks a different question: is this agent doing what it was built to do, in this context, for this user, right now? Answering that requires building a behavioral baseline for every agent and measuring deviation from it continuously. That is the problem Lasso was built to solve....

Attackers prefer the path of least resistance. Why break in when you can log in? That is what makes working credentials so valuable. A leaked password, token, or API key does more than reveal sensitive data; it offers a way in. No vulnerability or privilege escalation chain necessary. If the credential is valid, the attacker can simply use it, and the session will look like ordinary activity. This shifts the questions from "where can attackers break in?" to "where do usable keys tend to accumulate? Increasingly, the answer is the developer laptop: one of the most instrumented machines most companies own, and one of the easiest places for credentials to go unnoticed. The endpoint is watched for malware, behavior, posture, and configuration. But a valid plaintext credential is something else: a door an attacker may not need to force. A fully patched fleet can still have usable keys scattered across its devices, enough to turn one foothold into something much larger....

The structural flaw in detection-only security postures runs deeper than tooling choices. Every hour a security team spends triaging runtime alerts is an hour not spent governing what entered the pipeline in the first place. And in modern CI/CD environments, that means the handful of alerts that represent genuine software supply chain compromise arrive only after the malicious dependency has already executed its payload, exfiltrated credentials, or established persistence inside the environment. The industry built an entire market category on that backwards logic, and enterprises are now paying for it in breach costs, developer burnout, and regulatory exposure that carries personal liability for the security leaders whose names appear on the program. The shift that actually reduces risk is not better monitoring at the end of the pipeline; it is governing the point of ingestion before code ever enters your lifecycle, which is a fundamentally different problem requiring a fundamental...

Most application security (AppSec) teams know their OWASP Top 10, the industry-standard list of the most critical software security risks. Fewer know which of those categories their organization actually fixes. In conversations with security teams, I hear the same story: "We prioritize criticals, so the important stuff gets handled." The data tells a different story. Fix rates vary dramatically by OWASP vulnerability class, and not in the ways most teams expect. The data comes from Semgrep's Remediation at Scale report , which analyzed anonymized remediation patterns across 50,000+ repositories and hundreds of organizations during 2025. The methodology is straightforward: group organizations into two cohorts by fix rate (top 15% as "leaders," remaining 85% as "field"), then compare what each group actually does differently. The gap between leaders and the field isn't about detection quality or prioritization frameworks. Both cohorts apply the s...

While AI reduces some coding flaws, credential sprawl accelerates, expanding the non-human identity attack surface, and making remediation the new security bottleneck. AI is changing software development faster than most security teams can adapt. As coding assistants and autonomous agents become embedded in daily workflows, many assume traditional application security controls will steadily lose relevance. If machines can scan code, catch flaws, and even suggest safer alternatives in real time, then software risk should start to shrink. But that's not what is happening in the real world, according to GitGuardian's security research. The battle isn't in the code anymore, because AI is shifting where the control point is. It's in the credentials, tokens, service accounts, and machine identities that AI systems need in order to access data and take action. This matters because the attack surface has fundamentally changed. AI-assisted commits grew exponentially in 2025 and leaked secr...

When Shai-Hulud 2.0 hit in late 2025, it was a brutal, expensive wake-up call for DevSecOps teams. It showed that the industry's direction of shifting left, where teams pass security onto developers, wasn't the silver bullet everyone hoped for. Pushing that responsibility was fine in theory, but it crumbled quickly because the foundation it was built on was inherently flimsy. As we move further into 2026, we need a more definitive fix to the structural weakness in the pipelines in light of a potential Shai-Hulud 3.0. A major lesson from 2.0 was that internal CI/CD runners were easily hijacked and turned into attack botnets. Teams need to take that finding and come back with a truly proactive defense. A curated catalog is a way for security teams to control exactly what code and components enter their environment, while still giving engineering teams a fast, secure way to build - it is the key to creating a sustainable solution. More on a curated catalog later. The Anatomy o...

The transition to container-first infrastructure is complete, with microservices now powering production-critical workloads and driving digital innovation for most enterprises. While 100% of DevSecOps leaders view containerization as critical to their production strategy, this shift has been accompanied by a crisis in security frameworks. According to the ActiveState 2026 State of Vulnerability Management & Remediation Report , respondents' organizations faced a staggering 82% container breach rate over the past year. Many companies have tried to mitigate risk by "shifting left", empowering developers to build security into their code from the start while still leveraging containers and open-source software from public registries. But in 2026, the reality of shifting left has often meant shifting a mountain of undifferentiated remediation work (i.e., fixing someone else's code) onto already overextended engineering teams. How should Security Leaders think about container se...