We, as an industry, should have the courage to throw away the playbooks we've been working on for the past 20+ years and create new (and better) ones for the AI era.
https://blog.marcolancini.it/2026/blog-ai-sdlc
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
GitLab's CISO argues that agentic AI development requires security, governance, and guardrails embedded in the SDLC execution path. The key metric is time from detection to verified remediation, driven to machine speed using AI-powered triage, constrained agent identities, and continuous scanning.
https://about.gitlab.com/blog/securing-the-software-factory-at-machine-speed
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
Storm-3168 (JADEPUFFER) used compromised Azure service principals to conduct automated reconnaissance, bulk deletion of Storage Accounts, Key Vaults, and Function Apps, and credential harvesting via ListKeys, consistent with ransomware-aligned objectives. Mitigations include least privilege, secret rotation, and resource locks.
https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals
#azure
Please open Telegram to view this post
VIEW IN TELEGRAM
❤2👍1🔥1
DigitalOcean Managed Agents secure autonomous workloads by ensuring agents never hold live credentials directly, utilizing ephemeral execution-time brokering via Action Gateway and strict runtime boundaries. This architecture aligns with NVIDIA's Open Agent Safety Platform and OpenShell policy schemas to prevent data exfiltration and limit blast radii across agent swarms.
https://www.digitalocean.com/blog/how-digitalocean-manages-credentials-for-autonomous-agents
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥2❤1👍1
⚠️ Discovering and exploiting a remote code execution vulnerability in OpenCode
Datadog Security Labs found GHSA-632h-h47v-g4x4 in OpenCode: the unauthenticated /global/upgrade API endpoint accepted arbitrary npm tarball URLs, enabling RCE via a crafted cross-origin HTML form submission bypassing CORS.
https://securitylabs.datadoghq.com/articles/opencode-upgrade-remote-code-execution
#RCE
Datadog Security Labs found GHSA-632h-h47v-g4x4 in OpenCode: the unauthenticated /global/upgrade API endpoint accepted arbitrary npm tarball URLs, enabling RCE via a crafted cross-origin HTML form submission bypassing CORS.
https://securitylabs.datadoghq.com/articles/opencode-upgrade-remote-code-execution
#RCE
👍2❤1🔥1
Atlassian's shared their own version of an AI SDLC playbook, which outlines transforming the full dev lifecycle using agentic AI, requiring two platform investments (context graph, measurement) and workflow shifts across planning, design, development, review, and maintenance, with humans retaining governance and judgment.
https://www.atlassian.com/blog/ai-at-work/ai-sdlc-transformation-playbook
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
Five critical Azure cross-tenant privilege escalation vulnerabilities in API Connections (Logic Apps) were found via path traversal in DynamicInvoke, undocumented Dynamic* endpoints, and the host.api.RuntimeUrl parameter, yielding $200,000 in bug bounties.
https://binsec.no/posts/2026/10/one-root-case
#azure
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
🔶 Introducing Strands Box: AI agent sandboxes powered by Dogwood
Strands Box is an open source (Apache 2.0) developer preview sandbox for AI agents. It combines OS-level isolation (such as macOS Seatbelt) with Dogwood policies that govern actions at egress, Python, Shell, and MCP enforcement points.
https://aws.amazon.com/ru/blogs/opensource/introducing-strands-box-ai-agent-sandboxes-powered-by-dogwood
#aws
Strands Box is an open source (Apache 2.0) developer preview sandbox for AI agents. It combines OS-level isolation (such as macOS Seatbelt) with Dogwood policies that govern actions at egress, Python, Shell, and MCP enforcement points.
https://aws.amazon.com/ru/blogs/opensource/introducing-strands-box-ai-agent-sandboxes-powered-by-dogwood
#aws
❤1👍1🔥1
20 октября в 12:00 (мск) пройдёт бесплатный вебинар «Мониторинг событий безопасности в MWS Cloud Platform».
Разработчики сервиса:
✅ Расскажут про возможности сервиса аудитных логов в облаке MWS Cloud Platform
Покажут в прямом эфире, как экспортировать их в SIEM-системы
✅ Вебинар будет полезен CISO, ИБ-специалистам, DevOps-инженерам и SOC-специалистам. Регистрируйтесь, подключайтесь к прямому эфиру и задавайте вопросы в чате.
🗓 20 октября в 12:00
Разработчики сервиса:
✅ Расскажут про возможности сервиса аудитных логов в облаке MWS Cloud Platform
Покажут в прямом эфире, как экспортировать их в SIEM-системы
✅ Вебинар будет полезен CISO, ИБ-специалистам, DevOps-инженерам и SOC-специалистам. Регистрируйтесь, подключайтесь к прямому эфиру и задавайте вопросы в чате.
🗓 20 октября в 12:00
❤2👍2🔥2