Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Within 24 hours, three new high-severity vulnerabilities were disclosed in runc, the low-level runtime that underpins most container platforms, including Docker, containerd, Kubernetes, and nearly every major cloud provider’s managed Kubernetes service. These vulnerabilities (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) allow a malicious container image to break out of the container boundary and affect the host machine directly.

Over this last year, we’ve seen significant attacks like the Shai-Hulud worm, the Nx build system compromise, and secrets being leaked to public GitHub Actions logs via the tj-actions/changed-files compromise, but I could spend the entirety of this article only listing different attacks, let alone talking about them.

Application Security Testing (AST) services use automated tools and manual techniques to find and fix security vulnerabilities in software, integrating security into the entire development lifecycle (SDLC) to prevent threats and protect applications from attacks. Key services include Static Application Security Testing (SAST) for code-level analysis, Dynamic Application Security Testing (DAST) for runtime testing, and Interactive Application Security Testing (IAST) which combines both.

DevOps and security teams often operate with conflicting goals: one pushes for speed, the other for safety. This friction creates bottlenecks, slows innovation, and builds security debt. But what if you could align these functions with a clear, actionable framework? Instead of just talking about “shifting left,” you could implement a structured process that embeds security into every stage of development: DevSecOps best practices.

Hi there, We’ve just dropped a fresh batch of updates to help you cut through the noise, stay in control, and secure your cloud-native environments with more precision. Here’s what’s new in the ARMO Platform this month.

When people talk about securing software, they typically refer to two distinct aspects. The code itself, or the servers it runs on. That makes sense. Those are the most visible parts. But what actually holds everything together isn’t either of those. It’s the pipeline in between the system that moves code from an idea in a developer’s head to something running in production. CI/CD pipeline can be easy to overlook because it often feels invisible.