Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

teleport

How Two Small Bugs Led to a Critical Vulnerability and a Cryptography Audit of Go's SSH Library

Aug 10, 2026 By Rob Picard In Teleport
Last summer we found a critical vulnerability in Teleport, our first in a decade. It was assigned CVE-2025-49825. This vulnerability allowed Teleport SSH certificates, issued to users of a cluster, to sign other SSH certificates which would then be incorrectly accepted by Teleport as valid. Once you can sign your own certificates, you can escalate privileges and bypass authentication controls. This is why we classified it as a critical vulnerability.
Read Post
mend

That's a wrap: Mend.io at Black Hat USA 2026

Aug 7, 2026 By Stephanie Broyles In Mend
Another Black Hat USA is in the books, and what a week it was. From a main stage keynote at the AI Summit to candid podcast conversations, a video interview with Cyber Defense Magazine, and a booth game that just wouldn’t quit, Mend.io showed up in Las Vegas ready to talk about the question every security leader is wrestling with right now: as AI reshapes both the software we ship and the systems we have to defend, who do we trust to verify that it’s safe?
Read Post

Developer Endpoint Protection: Stop Secrets Leaking From Laptops | GitGuardian

Aug 7, 2026 By GitGuardian In GitGuardian
Every developer laptop is a credential store: secrets hide in.env files, config files, and shell history, and every AI agent on the machine keeps adding more. Most teams already scan repositories and CI pipelines for secrets, but a secret lands on the laptop long before it reaches either one, and that's the place nobody scans. GitGuardian's Developer Endpoint Protection closes that gap.
View Video

How to Use Teleport and GitHub Actions to Deploy to Kubernetes Without Shared Secrets

Aug 5, 2026 By Noah Stride In Teleport
We live in the era of Kubernetes. And if you are using Kubernetes, you are probably using CI/CD to deploy your applications into it. However, as CI/CD and Kubernetes have grown in popularity, the number of bad actors looking to exploit weaknesses in them has also grown. It is critical that modern security techniques keep your Kubernetes clusters, and the sensitive data and services within them, safe from attack.
Read Post
mend

Patch faster isn't the answer. Patch smarter is.

Aug 4, 2026 By Shannon Davis In Mend
The 30-day patch cycle is dead. Most security teams already know this. What they haven’t fully reckoned with is why it died, and what has to replace it. SC Media recently gathered a range of security leaders on exactly this shift, and the picture they described is stark. AI didn’t just add more vulnerabilities to the pile. It collapsed the time between disclosure and exploitation from weeks to hours.
Read Post
mend

Mini Shai-Hulud Hits keyv: Trojanized Release Exfiltrates CI Secrets via GitHub

Aug 4, 2026 By Alina Podoba In Mend
On August 4, 2026, a malicious version of keyv was published to npm as keyv@6.0.0, one of a number of npm packages affected across the Keyv and Cacheable ecosystem. The release follows the Mini Shai-Hulud pattern: a trojanized version of a heavily depended-on package, with an install-time hook that reaches cloud and CI credentials. It leaves the compiled library untouched and instead adds a preinstall hook and two files.
Read Post

Why Traditional SAST Fails on AI-Generated Code

Aug 3, 2026 By Mend In Mend
AI didn't just speed up software development, it changed what application security programs must defend. As AI coding assistants generate code at machine speed and developers integrate AI agents, models, and RAG pipelines into production, traditional scanners generate endless backlogs of unprioritized alerts.
View Video

AppSec: When Bandwidth Isn't the Bottleneck

Jul 31, 2026 By Mend In Mend
AppSec teams are frequently told that a lack of bandwidth is why vulnerability backlogs keep growing. In reality, the bottleneck is not team size, it is the lack of contextual prioritization and agentic triage. When traditional scanners hand security teams thousands of findings without reachability context, developer velocity stalls. In this webinar, Mend.io security experts unpack why bandwidth is not the real bottleneck in modern software security and show you how to streamline triage, automate remediation, and secure code at AI speed.
View Video
teleport

Guide: Certificate-Based Authentication for Payment & Banking Infrastructure

Jul 31, 2026 By Chris De La Garza In Teleport
Payment and banking infrastructure continues to grow. Bare-metal servers and mainframes now sit alongside Kubernetes clusters, microservice architectures, and CI/CD pipelines running across multiple clouds and on-prem data centers. Every new environment adds its own accounts, tokens, and access paths to manage. But because this infrastructure powers live transactions, there is no room for downtime or disruptions.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.