Forget shiny new features; the real news in tech is often how the bad guys are figuring out new ways to mess with our stuff. A recent GitHub attack, Megalodon, shows just how vulnerable our automated development pipelines have become.
Forget the fancy code; the real news is that the tools you trust to build your software might now be the ones stealing your secrets. A clever hijacking of popular GitHub Actions means your CI/CD pipelines could be quietly coughing up credentials.
Just when you thought CI/CD pipelines were safe, Checkmarx’s Jenkins plugin gets roped into a supply-chain attack. TeamPCP strikes again.
For years, software development has had discipline. Security detection? Not so much. Rapid7 is trying to fix that with 'Detection as Code,' a move that’s long overdue.