Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Application Security including monitoring, testing, and open source.

How attackers use AI models to find code vulnerabilities

Sep 24, 2026 By Mend In Mend
AI models accelerate software development, but attackers use those same capabilities to hunt for pipeline vulnerabilities. Asaf Saar (EVP and Chief Product Officer, Mend.io) and Christian Jensen (VP Engineering, Tricentis) break down why full visibility is required to secure AI-native software.
View Video
aikido

Cyber Resilience Act is here! Myth busting and first impressions

Sep 23, 2026 By Jens Gellynck In Aikido
The first deadline of the Cyber Resilience Act went live last week. The Cyber Resilience Act (CRA) is the new EU regulation that defines minimum cybersecurity requirements for all products with digital elements, including their building blocks (hardware and software). It applies to anyone placing products on the EU market, not just companies based there. The full requirements won’t go into effect until the end of next year.
Read Post
aikido

Graphalgo campaign spreads to Terraform providers and Go Modules

Sep 22, 2026 By Oliver Smith In Aikido
We’ve identified Go malware distributed via at least two Terraform providers and at least two Go Modules. This is the first time we’ve observed malware distributed via Terraform providers. The following packages contain the malware: The malware overlaps with the Graphalgo NPM malware campaign, first reported by ReversingLabs in February 2026, and also reported on in the last week by Safedep, CheckMarx, and JFrog.
Read Post
veracode

Aligning Application Security Software with Business Growth Objectives

Sep 22, 2026 By Natalie Tischler In Veracode
AppSec teams know application risk is growing, but budget conversations are often won and lost outside the security team, in rooms full of executives who speak the language of revenue and delivery velocity, not CVSS scores. The core argument: application security software is easier to fund when it is tied to growth, resilience, compliance, and delivery outcomes… not just technical findings.
Read Post

Datadog Apps: Build and Ship Apps Securely and Natively

Sep 22, 2026 By Datadog In Datadog
In today’s AI-first world, anyone can build an app. The hard part is shipping it securely where your teams already work. Datadog Apps lets you build and deploy apps natively in Datadog, with your existing data, integrations, permissions, governance, and observability built in. The next chapter of app development starts now.
View Video
aikido

Compromised Flutter package on pub.dev contains XCSSET malware

Sep 8, 2026 By Ilyas Makari In Aikido
Today, pub.dev joins the list of package registries we have found malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with around 500 downloads. This is the first compromised package we have detected on pub.dev, the official package repository for Dart and Flutter. Unlike the recent npm supply chain attacks you might be familiar with, this was not a case of someone deliberately targeting this package.
Read Post
aikido

Jason Haddix: Stop fearing AI pentesting

Sep 8, 2026 By Nicholas Thomson In Aikido
This post is based on Mackenzie's conversation with Jason Haddix on The Secure Disclosure podcast. Listen to the full episode or watch below. Jason Haddix has topped the Bugcrowd leaderboards, run security as CISO of Ubisoft, and wrote The Bug Hunter's Methodology, the playbook a lot of working pentesters learned from, so his read on the direction of the field is worth listening to. He believes that “90% of pen tests will be done by AI” in the near future.
Read Post

Securing autonomous AI agents: regulatory risk and governance for modern AppSec

Sep 7, 2026 By Mend In Mend
Autonomous AI agents writing and executing code at machine speed present an urgent compliance challenge for modern software organizations. As global regulations tighten, engineering leaders must establish clear governance layers over agentic workflows, external tool calls, and Model Context Protocol integrations to ensure full accountability. In this session, Mend.io experts Asaf Saar and Ben Goldberg unpack the intersection of AI compliance, software supply chain security, and enterprise risk management. Learn how to bridge the accountability gap without sacrificing development velocity.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.