Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

mend

Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave

May 12, 2026 By Tom Abai In Mend
The Mini Shai-Hulud supply chain campaign has resurfaced with its largest wave yet. Over a 48-hour window on May 11-12, 2026, attackers compromised 172 unique packages across 403 malicious versions on npm and PyPI, including high-profile scopes like @tanstack, @uipath, @mistralai, and @opensearch-project.
Read Post

The Teleport Agentic Identity Framework in 3 minutes

May 12, 2026 By Teleport In Teleport
AI agents are rapidly moving into production, but most organizations are still deploying them on top of legacy identity systems built around passwords, secrets, and fragmented access models. In this video, we introduce the Teleport Agentic Identity Framework, a standards-driven approach for deploying AI agents securely across infrastructure using cryptographic identity, governed access, and continuous visibility.
View Video

Hacking LLMs using LinkedIn #aisecurity #ai #llm

May 12, 2026 By Mend In Mend
Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.
View Video
Best VPS Under $2 Per Month in 2026: What's Real, What's Worth It

Best VPS Under $2 Per Month in 2026: What's Real, What's Worth It

May 12, 2026 By SecuritySenses In SecuritySenses
The sub-$2 VPS market exists, and some of it is genuinely useful. Budget hosting at this price tier has a real use case: lightweight bots, personal projects, VPN endpoints, learning Linux, or running a single low-traffic service without paying Hetzner prices for a production-grade machine. This guide covers what's actually available in 2026, what to watch out for, and one option that gives you access to enterprise-grade infrastructure for less than a cup of coffee per month.
Read Post
teleport

Multi-Site Data Center Audit and Compliance Best Practices

May 11, 2026 By Mayur Pipaliya In Teleport
Most multi-site infrastructure teams manage access and audit logging site by site, using stacks that have been built up over time through different tools, different owners, and thousands of static credentials or standing admin privileges. This makes org-wide auditability nearly impossible to produce on demand, and adds complexity to regional compliance requirements.
Read Post
teleport

How to Secure Third-Party Remote Access to Data Centers (Without SSH Keys)

May 7, 2026 By Mayur Pipaliya In Teleport
Whether it’s vendors diagnosing GPU driver failures or network technicians troubleshooting switch configurations, organizations are often ready to do whatever it takes to get their infrastructure back to normal. For some, that may mean defaulting to the fastest access path available for third-party access, such as shared SSH keys, VPN credentials, or screen-sharing sessions.
Read Post
CalCom

How to Talk to Your Board About System Hardening

May 7, 2026 By Joan Levin In CalCom
You know your servers need hardening. Getting leadership to prioritise, fund, and support the effort is the harder challenge. Here’s our experts’ best advice for how to talk to the C-suite and board about the need for automated server hardening. You already know the servers are drifting. Configurations change. Exceptions pile up. Standards slip over time. The hard part is not identifying the problem.
Read Post

How Attackers Use Developer Machines to Breach the Software Supply Chain - May 07, 2026

May 7, 2026 By GitGuardian In GitGuardian
In April, three major supply chain campaigns hit npm, PyPI, and Docker Hub in just 48 hours, and while the ecosystems were different, the objective was the same: steal credentials from developer environments and CI/CD pipelines. The malware targeted API keys, cloud credentials, SSH keys, GitHub tokens, npm tokens, environment variables, and more, turning developer machines and build systems into high-value credential vaults for attackers.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.