Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

cycognito

Emerging Threat: (CVE-2026-19478) GitLab Unauthenticated Project Deletion via GraphQL Directive

Aug 18, 2026 By Igal Zeifman In CyCognito
CVE-2026-19478 is a code injection vulnerability in GitLab Community Edition and Enterprise Edition, caused by improper handling of a GraphQL directive in the application’s API layer. GitLab disclosed the issue and shipped fixes in an ad hoc critical patch release on August 17, 2026, outside its normal twice-monthly security schedule. The vulnerability carries a CVSS base score of 9.4 (Critical) as assigned by GitLab. Exploitation requires no authentication and no user interaction.
Read Post
cycognito

Emerging Threat: GeoServer Zero-Day SQL Injection via jsonArrayContains

Aug 18, 2026 By Igal Zeifman In CyCognito
An unauthenticated SQL injection vulnerability exists in the jsonArrayContains filter function in GeoTools, the geospatial library that underpins GeoServer. When an OGC filter is evaluated against a PostGIS data store, the value passed to jsonArrayContains is written into the generated SQL statement without escaping, allowing an attacker to alter the query the database executes.
Read Post

Slow Ventures on backing founders before the market catches up - S3E15

Aug 18, 2026 By Persona In Persona
In this episode, we're excited to introduce Yoni Rechtman, Partner at Slow Ventures, a generalist early-stage venture firm that has deployed over $1 billion since 2011 across fintech, SaaS, crypto, consumer, healthcare, and the creator economy, with a portfolio that includes Airtable, Gusto, Robinhood, Venmo, Solana, and Ro. Yoni leads the firm's New York presence and joined as Partner in January 2025 after three years as Principal, following five years at Tusk Ventures where he rose from Analyst to Principal.
View Video
keeper

Keeper Security Issues Cybersecurity Guidance for Education IT Teams As Students Return to Campus

Aug 18, 2026 By Anne Cutler In Keeper
Every fall, school districts and universities across the country race to onboard thousands of new students, faculty and staff, provisioning accounts, issuing credentials and connecting a wave of new devices to institutional networks. It is a moment of organized chaos, and cybercriminals know it.
Read Post
keeper

What To Know About the US Water Cyber Attacks

Aug 18, 2026 By Ashley D'Andrea In Keeper
In late July 2026, over 30 municipal water systems across Minnesota were targeted in coordinated cyber attacks that disrupted the Operational Technology (OT) used to remotely monitor and control water equipment. The attacks initially unfolded on July 26 and 27, striking multiple automated control systems across the state, including those in Plymouth, Braham and South St. Paul.
Read Post
UTMStack

GLBA Security Requirements: A 2026 Compliance Guide

Aug 18, 2026 By cesmng In UTMStack
The most popular advice about GLBA security requirements is also the least useful: review the policy annually, collect signatures, and keep the evidence in an audit folder. That approach may prove that someone approved a program. It doesn't prove that multifactor authentication protects every relevant system, that logs capture unauthorized access, or that the incident response team can identify a reportable event quickly enough to act.
Read Post
gitprotect

SaaS Doesn't Mean Secure: Why You Should Back Up Your Source Code

Aug 18, 2026 By Pawel Socha In GitProtect
Your source code sits on GitHub, GitLab, Bitbucket, or Azure DevOps, along with your pipeline configurations, issue history, permissions, and metadata. Most teams assume it’s safe there because it works. But is it? Financial institutions, technology companies, and software houses all build the systems they run on. Code stopped being a byproduct of the business and became the business. And as it turns out, it needs protection of its own.
Read Post
trustcloud

From Demo to Production: Scaling Continuous Control Monitoring within the ServiceNow and Atlassian ecosystem

Aug 18, 2026 By Abheer Bipin In TrustCloud
Enterprises settled the question:“is my software actually working” about a decade ago. Not by hiring more people to read logs, but by instrumenting the data plane once and letting anyone query it. Observability became infrastructure, and the people who used to read logs went and solved harder problems. GRC has never had that moment. We still read the logs, opine, and complete the attestation. And then it stops. The demo proved the concept and became the ceiling.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.