DevOps Pulse

GitHub discovered massive CFOR vulnerability allowing permanent access to deleted private repositories and commit data

creating critical security risks for leaked credentials. GitLab exposed sophisticated npm supply chain attack harvesting credentials from GitHub, AWS, and Azure with automatic propagation mechanisms. Cohesity launched DSPM partnership with Cyera targeting AI security convergence, while Commvault integrated anomaly detection with CrowdStrike SIEM. DevOps market reaches $19.57B with 21.33% growth as NIS2 compliance deadlines force immediate backup strategy implementation by October 2026.

Signals
27
Sections
5/5
Threats
7
Fresh
12
Updated
94d ago
Show

DevOps Platform Updates

scanned 95d ago8

Latest announcements and changes from GitHub, GitLab, Azure DevOps, Bitbucket, and Atlassian.

GitHub Expands AI-Powered Security Detections Across Languages

<cite index="3-5,3-11,3-7">GitHub is introducing AI-powered security detections in GitHub Code Security to expand application security coverage across more languages and frameworks beyond CodeQL's traditional coverage. These detections complement CodeQL by surfacing potential vulnerabilities in areas that are difficult to support with traditional static analysis alone, with public preview availability planned for early Q2.</cite>

githubGitHub Blog·23 MarRecent

GitHub Actions 2026 Security Roadmap: Secure-by-Default Automation

<cite index="2-2,2-15,2-23">GitHub is shifting Actions toward secure-by-default, verifiable automation with a focus on disrupting supply chain attacks. The 2026 roadmap introduces workflow execution protections built on GitHub's ruleset framework, allowing centralized policies that control actor permissions, event rules, and workflow triggers to reduce security configuration overhead.</cite>

githubGitHub Blog·26 MarNEW

hackerbot-claw AI Bot Exploited GitHub Actions in Supply Chain Attacks

<cite index="6-1,6-8,6-5">Between February 21 and March 2, 2026, an AI bot called hackerbot-claw systematically exploited GitHub Actions workflows through pull request injection attacks. The campaign resulted in a full repository takeover of trivy-action, deletion of years of releases, and malicious artifacts pushed to extension marketplaces, affecting high-profile projects including Microsoft, DataDog, and CNCF repositories.</cite>

githubStepSecurity·2 Mar

GitHub Secret Protection Launches 28 New Detectors, Expands Push Protection

<cite index="1-1,1-25,1-32">On March 10, GitHub added 28 new secret detectors across 15 providers and expanded push protection to 39 token types. Vercel alone received six new token types with automatic detection and revocation of leaked tokens in public repos, gists, and npm packages, significantly strengthening automated secret scanning capabilities.</cite>

githubBuildMVPFast·10 Mar

Azure DevOps Now Offers Standalone GitHub Secret Protection and Code Security

<cite index="8-1,8-2,8-18">Azure DevOps now provides GitHub Secret Protection and GitHub Code Security as standalone products. Secret Protection includes secret scanning, push protection, and security overview experiences, while Code Security provides dependency scanning, code scanning, and security overview capabilities for enhanced DevOps protection.</cite>

azure-devopsMicrosoft Learn·25 MarNEW

Atlassian Patches 21 High-Severity Vulnerabilities in March Security Bulletin

<cite index="24-4,21-7,21-8">Atlassian's March 17, 2026 security bulletin addresses 21 high-severity vulnerabilities affecting self-hosted Jira and Confluence products. Notable issues include CVE-2025-64756, a high-severity OS Command Injection vulnerability in Confluence Data Center and Server that allows authenticated attackers to execute arbitrary commands on target systems.</cite>

confluenceAtlassian Security·17 Mar

Atlassian Updates Cloud App Security Requirements for AI and Supply Chain

<cite index="22-9,22-11,22-14">Atlassian published its annual 2026 Cloud App Security Requirements update, introducing new provisions for AI security, data protection, and supply chain security. Key additions include requirements for apps using Forge Rovo actions and agents, strict tenant isolation during runtime, and application logs that exclude PII, credentials, and sensitive data.</cite>

jiraAtlassian Developer·20 Mar

GitLab Discovers Widespread npm Supply Chain Attack with Credential Harvesting

<cite index="37-1,37-2,37-20">GitLab discovered a sophisticated npm supply chain attack that harvests credentials from GitHub, npm, AWS, GCP, and Azure, exfiltrates data to attacker-controlled repositories, and propagates by automatically infecting other packages. The campaign represents an evolution where the threat of collateral damage becomes the primary defense mechanism for the attacker's infrastructure.</cite>

gitlabGitLab Blog·24 MarRecent