What Is DevSecOps in 2026? 87% Run Exploitable Code, 4% Pin Actions
DevSecOps explained for 2026: shift-left vs shift-everywhere, what SAST, DAST, SCA, secrets and IaC scanning each catch, SLSA 1.2's new Source Track, and what Datadog, GitGuardian, GitLab, Sonatype and Veracode data say about AI-generated code.
11 minOct 20, 2026Vulnerability Management in 2026: 48,185 CVEs, a Triaged NVD, EPSS v5
Vulnerability management in 2026 explained: 48,185 CVEs in 2025, 67,000+ by September 2026, an NVD that now enriches only KEV and critical software, the CVE funding scare, EPSS v5, CISA KEV at 1,748 entries, VEX and reachability, and a prioritisation order that works.
12 minOct 20, 2026Secrets Sprawl 2026: 28.65M Leaked Keys and 64% Still Valid Years Later
What the 2026 secrets sprawl data says: 28.65M new secrets on public GitHub in 2025, AI service keys up 81%, AI-assisted commits leaking at twice the baseline, 24,008 secrets in MCP configs, 10,456 leaky Docker Hub images, and why 64% of old leaks still work.
13 minOct 20, 2026How to Reduce Docker Image Size: Multi-Stage Builds Guide (2026)
Shrink Docker images with multi-stage builds, distroless or slim bases, .dockerignore, layer ordering and BuildKit cache mounts. Measured Go, Node, Python and Java examples: 343 MB to 3.4 MB, 423 MB to 56 MB, plus a troubleshooting table.
12 minOct 20, 2026How to Fix ImagePullBackOff and ErrImagePull in Kubernetes (2026)
Fix Kubernetes ImagePullBackOff and ErrImagePull step by step: read the real event message, then fix wrong tags, moved Bitnami images, imagePullSecrets, ECR and Artifact Registry node permissions, Docker Hub 429 rate limits and arm64/amd64 mismatches.
13 minOct 20, 2026GitHub Actions Security in 2026: 76 Hijacked Tags and the Fixes That Work
GitHub Actions security in 2026: what tj-actions, trivy-action, TanStack and issues-helper taught us about mutable tags and pull_request_target, plus SHA pinning policy, workflow lockfiles, immutable releases, attestations, zizmor and the new runner prices.
13 minOct 20, 2026Docker in 2026: Engine 29, containerd 2.3 LTS, Podman 6 and the AI Push
The state of Docker and containers in October 2026: Docker Engine 29.9, Desktop 4.96 and its licence terms, Model Runner and the MCP Toolkit, free Hardened Images, Hub pull limits, containerd 2.3 LTS, Podman 6.0, BuildKit 0.34 and OCI artifacts.
12 minOct 20, 2026Hardened Container Images in 2026: DHI Free, Bitnami Gone, 515 CVEs to 0
Container base images in 2026 compared: Docker Hardened Images went free under Apache 2.0, Bitnami moved its catalog to bitnamilegacy, Chainguard cut its free tier to five images, and a grype scan of 12 base images found 515 CVEs in python:3.13 and zero in four minimal images.
12 minOct 20, 2026How to Scan Container Images with Trivy and Grype (2026)
Step-by-step guide to scanning container images with Trivy v0.76 and Grype v0.121: verified installs after the March 2026 Trivy compromise, image and SBOM scans, CI gates on fixable criticals, .trivyignore, VEX, and fixes for DB download errors.
12 minOct 20, 2026AI Gateways in 2026: Six Options Compared After LiteLLM's 40-Minute Backdoor
What an AI gateway (LLM gateway) does in 2026 and how LiteLLM, Portkey, Kong, Cloudflare, Envoy AI Gateway (now Agent Router) and OpenRouter compare on routing, budgets, caching and guardrails, plus the LiteLLM PyPI backdoor, three LiteLLM CVEs on CISA KEV, and build vs buy.
13 minOct 5, 2026CRA Reporting Went Live on 11 September: 24 Hours to ENISA, 3.08 Billion Rekor Entries, 17% of PyPI Attested, 92% SBOM False Positives
Supply-chain compliance in 2026: what the Cyber Resilience Act's Article 14 duty requires since 11 September 2026 (24-hour early warning, 72-hour notification, ENISA's Single Reporting Platform), what waits until 11 December 2027, how the open-source steward role works, where SBOMs stand (CISA's 2026 minimum elements, CycloneDX 1.7, a 92 percent false-positive rate in a 2,414-repo study), how far provenance has got (SLSA 1.2, 20 percent of PyPI uploads via trusted publishing, Rekor at 3.08 billion entries), the US retreat from mandates, and the pipeline I would run.
13 minOct 5, 2026CI/CD in 2026: Agents Opened 1M PRs in 5 Months, Bots Write 1 in 5 Reviews, and Most Agent PRs Get No Human Look
What the pipeline looks like when AI agents open the pull requests: GitHub's coding agent went GA on 25 September 2025 and opened over a million PRs in five months, Copilot code review passed 60 million reviews and one in five on GitHub, CodeRabbit has reviewed 13 million PRs on $88 million raised, and the first studies find most agent PRs get no human review attention. The gates that still hold: the assigner cannot approve, an extra approval for bot authors, path fences, signed commits, SLSA provenance, and a workflow YAML that gives agent PRs their own lane.
13 minSep 8, 2026AI Found the Bugs: 23,000 Findings in a Month, a 3-Day Patch Mandate, and the End of curl's Bounty
From AIxCC's 18 real bugs in August 2025 to Project Glasswing's 23,019 findings by May 2026 and the first AI-written zero-day exploited in the wild. What the cyber reasoning systems, Big Sleep, Codex Security and Mythos Preview actually did, why bug bounties are drowning, why CISA now wants federal patches in three days, and a workflow for a small team that keeps the humans looking only at validated findings.
13 minSep 6, 2026The Worms Learned to Use Your AI Agent: A Year of npm Supply-Chain Attacks
From s1ngularity invoking Claude Code to hunt for wallets, to Shai-Hulud self-publishing across 500 packages, to IronWorm stealing AI API keys — the twelve months that changed how I install software.
13 minSep 6, 2026MCP Security in 2026: The Protocol Got Hardened. The Ecosystem Didn't.
A year of MCP CVEs, a rewritten spec, an NSA guidance sheet and an OWASP Top 10 — what actually changed, what didn't, and the six controls I'd insist on before an MCP server touches production.
12 min