Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

aikido

tensorlake NPM package compromised with Shai Hulud worm

Oct 8, 2026 By Oliver Smith In Aikido
On 8 October 2026 a threat actor published a compromised version of tensorlake to npm. The compromised version is 0.5.144 and contains a variant of the Shai-Hulud worm, which exfiltrates secrets from infected devices and attempts to self-replicate through connected supply chains. Tensorlake is a serverless sandbox for AI agents and its npm package has a reported lifetime install count of over 100,000.
Read Post
miniorange

Application Onboarding in IGA: A Practical Guide

Oct 8, 2026 By Gaurav Singh In miniOrange
Application onboarding is the process of integrating an application with your identity governance and administration platform so its accounts, roles, and entitlements can be governed. Once an application is onboarded, you can: Without onboarding, an application stays outside your controls, and any access inside it is invisible to your security and audit teams.
Read Post
miniorange

Active Directory Governance: How to Know Who Has Access and Why

Oct 8, 2026 By Alankrita Shrivastava In miniOrange
An employee changes roles. Their manager requests access for the new job, and IT grants it quickly. That part works well. The issue appears when access from the previous role stays in place. The same thing happens when a contractor finishes a project, an admin completes urgent work, or a team retires an application. Access often remains because nobody has checked whether it still serves a purpose. Active Directory governance allows IT and security teams to answer three questions.
Read Post
netwrix

The hidden cost of over-permissioned service accounts

Oct 8, 2026 By Dennis Chen In Netwrix
Service accounts, app integrations, and AI agents often have more access than any person, and they get reviewed last. That gives them one of the largest blast radiuses in the environment, meaning they can reach more if they're compromised. The Uber and Cloudflare breaches and the Salesloft Drift campaign against Salesforce customers show how attackers exploit these accounts. Check them for open, stale, orphaned, and privileged access, then cut access back to what they really use.
Read Post
mend

Mend.io upgrades 184 open source organizations to the Renovate Community (OSS) plan

Oct 8, 2026 By Jamie Tanna In Mend
Mend.io has proactively upgraded 184 open source organizations and GitHub users to the Mend Renovate Community (OSS) plan, with no request required. The upgrade covers about 3,000 repositories with roughly 4 million combined GitHub stars. Maintainers get higher resource limits, more concurrency, and access to Merge Confidence.
Read Post
Tines

IT onboarding automation: building a provisioning agent with Tines 3B

Oct 8, 2026 By Why IT onboarding gets delayed In Tines
New hires shouldn't spend their first week waiting on IT. But in most organizations, that's exactly what happens: a Slack account that takes three days to provision, a GitHub invite that falls through the cracks, a hiring manager who has no idea whether security has approved VPN access yet. The result is a frustrating first impression for the employee and a pile of repetitive, error-prone manual work for IT.
Read Post

Proactive Security in Action Across the CrowdStrike Falcon Platform

Oct 8, 2026 By CrowdStrike In CrowdStrike
Proactive security starts with understanding the environment before an attacker can take advantage of it. In this demo, see how the CrowdStrike Falcon platform brings together proactive telemetry and context across endpoint, cloud, identity, network, applications, SaaS, and more to build a connected view of risk.
View Video

Autonomous Pentesting: AI Agents That Test Your App 24/7

Oct 8, 2026 By Astra Security In Astra
Most companies pentest their app once a year. Hackers look for new backdoors every single day. Astra Autonomous Pentesting closes that gap with AI security agents that test your web app continuously, 24/7. Traditional penetration testing gives you a giant report full of jargon that sits on a shelf. Astra works like a friendly hacker that never sleeps. When it finds a security weakness, it doesn't just send a scary alert. It explains the exact problem, with the attack story and proof, so clearly that AI coding tools can fix, test and repair the vulnerability the same day.
View Video

How Modern Threat Actors Are Changing the Defense-in-Depth Playbook - Webinar October 8, 2026

Oct 8, 2026 By GitGuardian In GitGuardian
Ransomware is still growing, but payouts are shrinking. Enterprises got better at backups, so attackers moved to where defenses are thinner: SaaS, identity, and stolen credentials. Infostealers do the collecting at scale, and AI is widening the gap. Credentials for AI services were the fastest growing category of leaked secrets in 2025, up 81% year over year with 1.27 million exposed (State of Secrets Sprawl 2026). Most defense-in-depth programs were not built with this attack chain in mind.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.