FedRAMP 20x - The Shift to Continuous Monitoring
FedRAMP 20x → continuous monitoring. Moving from point-in-time audits to real-time visibility.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
CVE-2026-0968: The libssh Heap Read That Isn't as Scary as Scanners Say
A missing null check in libssh’s SFTP directory listing code lets a malicious server crash clients, but real-world exploitability is extremely constrained. CVE-2026-0968 is an out-of-bounds heap read in sftp_parse_longname(), triggered when an SFTP client processes a crafted SSH_FXP_NAME response with a malformed longname field. Red Hat, which serves as the CNA (CVE Numbering Authority) for this vulnerability, scored it 3.1 (Low), while Amazon Linux independently scored it 4.2 (Medium).
From Plaintext, to BLESS, to Identity: The Evolution of Secure Remote Access
My first introduction to UNIX remote access was via telnet and rsh protocols in college, which was the standard method at the time. But I soon started reading articles about how easy it was for someone to sniff the network and capture passwords since they were being transmitted in plaintext. On the shared network segments common to university campuses and early enterprise environments, the tools to intercept traffic were freely available, well-documented, and required very little skill to use.
Anthropic's Project Glasswing: How Claude Mythos is Changing the Rules for AppSec
An AI just found critical vulnerabilities that survived decades of human review. If your security program isn’t built for this moment, it’s already behind. Surprise! An AI just did what your security team couldn’t.
How To Build Your DevOps Toolchain Effectively
What can bring together development and operation teams better than DevOps, a prevalent agile methodology? It involves new management principles, cultural change, and technology tools that boost the team’s development, collaboration, and productivity while they cooperate on software development.
A CISO's Guide to Deploying AI Agents in Production Safely
Your CNAPP shows green across every posture check—hardened clusters, compliant configurations, no critical CVEs—but when your board asks "Are our AI agents safe in production?", you cannot answer with confidence because your tools see the infrastructure, not what the agents actually do at runtime.
NIST 800-171 and Agentic AI: What Autonomous Systems Mean for CUI Protection
NIST Special Publication 800-171 defines a precise set of security requirements for organizations that handle Controlled Unclassified Information (CUI) outside of federal systems. For defense contractors, subcontractors, and their engineering teams, these controls are non-negotiable with the advent of the Cybersecurity Maturity Model Certification (CMMC) program, which dictates how CUI must be accessed, logged, transmitted, and protected across every system in scope. That scope is shifting.
CI/CD security: How to secure your GitHub ecosystem
In Part 1 of this series, we discussed the CI/CD security boundary, mapped out potential attack vectors with a CI/CD threat matrix, and introduced a simple threat model focused on ideating detection workflows. In this post, we’ll apply these principles to a real-world source code management (SCM) tool example that every developer is familiar with: GitHub. In addition to threat modeling, we’ll also be taking a closer look at historical attacks on GitHub and GitHub Actions ecosystems.
Stop Drowning in Container CVE Alerts: Reachable Risk & Docker VEX with Mend.io
Developers are often overwhelmed by thousands of container CVE alerts, most of which are unfixable base image noise. This walk-through covers how to use reachable risk factors and Docker VEX statements within the Mend.io platform to streamline your vulnerability management.
Secret Scanning For AI Coding Tools With ggshield
Introducing ggshield AI hooks from GitGuardian to help stop AI coding assistants from leaking secrets. See how ggshield can scan prompts, tool calls, file reads, MCP calls, and tool output inside AI coding tools like Cursor, Claude Code, and VS Code with GitHub Copilot. When a secret is detected, ggshield can block the action before sensitive data is sent or exposed. You will also see how simple the setup is, with flexible install options for local or global use. This adds practical guardrails to AI-assisted development and helps teams move fast without increasing secret sprawl.