Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

armo

Runtime Observability for AI Agents: What to Instrument and Why

May 22, 2026 By Ben Hirschberg In ARMO
Every guide to AI agent observability tells you what to capture — prompts, tool calls, token usage, traces, syscalls. Almost none address which of those signal sources you can still trust when the agent itself is part of the threat model. That distinction is the entire difference between observability that helps your SRE team debug a slow reasoning chain and observability that helps your security team investigate a breach.
Read Post
teleport

How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs

May 21, 2026 By Jeffrey Ellin In Teleport
Our previous post, How to Secure Microservices with SPIFFE and Istio, showed how to secure Kubernetes microservices using Istio policy and SPIFFE identities, with Teleport issuing the identities that the mesh trusts. The question teams face next is: How do you extend that identity-driven security model to workloads outside Kubernetes — such as VMs, edge gateways, and legacy services — without creating a massive certificate-management project?
Read Post
certkit

Certificate Audit logs are live

May 20, 2026 By Todd H. Gardner In CertKit
Certificate automation does a lot of work on your behalf. Agents running on your servers, talking to certificate authorities, deploying certs to your infrastructure. At some point someone (your CISO, your auditor, or your own brain at 3am) is going to ask: what exactly happened, and when? Today we’re shipping audit logs. Every action taken in CertKit is now recorded: logins, invitations, certificates added, issued, renewed, revoked, and deployed. Agent registrations, approvals, and config changes.
Read Post

An inside look at finding Leaked CISA AWS GovCloud Admin Keys on Github

May 20, 2026 By GitGuardian In GitGuardian
In this interview, GitGuardian security researcher Guillaume Valadon breaks down how GitGuardian discovered a public GitHub repository exposing CISA-related secrets, including plain-text passwords, AWS tokens, SAML certificates, CI/CD files, Kubernetes manifests, and internal operational documentation. We discuss how the leak was identified, why exposed secrets can create immediate risk, and how GitGuardian helped escalate the disclosure until the repository was taken offline within 26 hours.
View Video
teleport

How to Eliminate Static Credentials from Trading Infrastructure

May 20, 2026 By Gus Luxton In Teleport
Tatu Ylonen, the inventor of the SSH protocol, has long warned that a single stolen SSH key "can in many cases lead to compromise of the entire server environment." But in the bare-metal and private cloud infrastructure of high-frequency or quantitative trading firms, privileged access to trading infrastructure often depends on shared or static credentials like SSH keys or hardcoded API tokens.
Read Post
mend

Mini Shai-Hulud Hits @antv: 323 npm Packages Compromised Through the atool Maintainer Account

May 19, 2026 By Alina Podoba In Mend
An active supply chain attack has compromised 323 npm packages published under the atool npm maintainer account. The wave sweeps the entire @antv data-visualization organization alongside standalone libraries with wide independent adoption: echarts-for-react, timeago.js, size-sensor, and canvas-nest.js. With echarts-for-react pulling roughly 1.1 million weekly downloads, any project that auto-updates these packages is in scope.
Read Post
armo

How to Reduce Alert Fatigue in AI Agent Detection: Why It's a Unit-of-Detection Problem, Not a Triage Problem

May 18, 2026 By Shauli Rozen In ARMO
When AI agent workloads start generating more alerts than your SOC can keep up with, the instinct most teams reach for is to deploy more triage on top of what they already have. If the SIEM is producing thousands of atomized alerts, plug in something downstream that can cluster, prioritize, and auto-resolve them faster than a human can. The market has consolidated around exactly this answer.
Read Post

Mini Shai-Hulud: The Most Sophisticated NPM Supply Chain Attack of 2026

May 18, 2026 By Snyk In Snyk
On May 11, 2026, the TanStack namespace was hit by a "Mini Shai-Hulud" supply chain attack. Unlike typical attacks, this did not involve stolen credentials; instead, the threat group TeamPCP hijacked the legitimate GitHub Actions release pipeline. This video covers the technical details of the OIDC token extraction, the "Dead Man's Switch" that triggers a rm -rf / upon credential revocation, and the mandatory remediation order you must follow to save your data. We also discuss how to harden your workflow using release-age cooldowns and OIDC pinning.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.