CI/CD Security Best Practices: A 2026 Checklist
CI/CD security best practices for 2026: secrets management, scoped access, dependency scanning, signed artifacts, and audit logging in one checklist.
Operations | Monitoring | ITSM | DevOps | Cloud
The Place Where Modern Operations & Technology Come Together
The latest News and Information on CyberSecurity for Applications, Services and Infrastructure, and related technologies.
From SOCI Compliance to Continuous Infrastructure: How Puppet Helps Protect Critical Infrastructure
Australia’s critical infrastructure landscape has changed significantly. The Security of Critical Infrastructure Act 2018 (SOCI Act) has evolved from a framework focused primarily on identifying critical assets and reporting incidents into a broader risk-management and operational-resilience regime. The 2024 reforms reinforced that direction, increasing the focus on the systems, data, and technology dependencies that underpin Australia’s essential services.
Mongoid 7.6.2 Patches Four Real Security Gaps, Not Just Bugs
A patch release that never says the word “security” just closed four real security gaps in Mongoid. If your Rails app runs on MongoDB, 7.6.2 is the kind of release that’s easy to auto-merge and easy to regret not reading first.
CT alerts: know when someone gets a certificate for your domains
A couple days ago, I told you how a spammer got a certificate for dev-docs.trackjs.com, and that we only found out because Google emailed us. Google knew because the spammer claimed the hostname in Search Console. An attacker running a phishing page wouldn’t have done that, but they would still need a certificate. Every publicly trusted certificate gets written to a public log, and we track that log in our database. We just weren’t watching it. Now we are, and you can too.
The Clearinghouse For AI Agents Has A Blind Spot
Jamin Ball’s recent piece, “Systems of Record Won the SaaS Era — Clearinghouses Will Win the Agents Era,” is the cleanest articulation I’ve seen of where the durable moat goes next. His argument is simple and, I think, correct: the SaaS era rewarded whoever owned the system of record, and the agent era will reward whoever owns the clearinghouse.
How Harness orchestrates LLM security scanning
Large language models are effective at security review for the same reason they are effective at many other tasks: they reason rather than pattern match. In plain terms, a traditional scanner checks code against a list of known bad patterns, the way a spell checker flags a misspelled word, regardless of what the sentence means. An LLM can instead follow the program's logic: trace a piece of attacker-controlled input through several layers of application code to determine whether it is reachable.
Why FIPS Mode Is Not Enough: What Federal Teams Should Expect Their Vendors to Prove
Federal teams need more than a system setting. They need defensible evidence that the cryptography protecting federal information is validated, correctly configured, and actually used. For platforms such as ScienceLogic, that product-level evidence should come from the vendor, not be reconstructed by the customer.
How a ten-year-old dangling DNS record handed one of our subdomains to spammers
On August 27, Google sent us an email. We did not. We barely recognized the hostname. None of us had thought about dev-docs.trackjs.com in about ten years.
SOC automation solution guide 2026 with examples
SOC automation can be a confusing category as there is no single type of SOC automation solution or tool, and most security teams use several different approaches at the same time. However, the need for SOC automation is much clearer with recent data on SOC automation showing that 93% of organizations are using or planning to use automation in their security workflows.
Creating Secure and Reliable Digital Signing Processes
Digital signing works best when it is designed as part of a complete business process. Organizations building signing into their own software can evaluate an esignature API from Blueink, a provider focused on developer-led document workflows with REST API tools, SDK resources, embedded signing, webhooks, tracking, and identity-verification options. Its services are relevant to integrated workflows in areas including government, insurance, education, and healthcare. A signature request is only one moment in a longer journey.