Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

mend

199 RubyGems, two techniques, zero working payloads: Inside a cryptomining campaign that never ran

Jul 22, 2026 By Maciej Mensfeld In Mend
Mend.io’s research team caught this campaign before most of the open source community ever saw it. Continuous monitoring of RubyGems flagged a batch of gems that looked, at a glance, like an ordinary cryptomining squat, and Mend.io reported the full batch to RubyGems for takedown. Every gem was pulled within hours. Mend.io’s team also pulled two of the samples apart in full, because knowing a campaign exists isn’t the same as knowing how it works.
Read Post
mend

Independence is the moat

Jul 14, 2026 By Asaf Saar In Mend
Why the independent layer keeps winning as the models get better, not despite them. This series has been building to one question, and it is the objection every honest reader has been holding since the first piece. If the frontier models keep getting better this fast, why does an independent security layer keep winning? Why not wait for the model that writes safe code and verifies its own work?
Read Post
mend

Dependency management tools: Key features and 6 tools to know in 2026

Jul 9, 2026 By Tiffany Jennings In Mend
Dependency management tools are software solutions designed to automate and streamline the process of handling external libraries, modules, or packages that a project relies on. These tools help developers specify, install, update, and track dependencies, ensuring that all required components are present and compatible.
Read Post

Why Project Glasswing Changes the Rules of AppSec

Jul 8, 2026 By Mend In Mend
The old application security playbook is broken. With Anthropic’s Claude Mythos and the release of Project Glasswing, AI agents can now autonomously chain low-severity bugs into working zero-day exploits, collapsing the time between vulnerability discovery and active exploitation. In this video, Mend.io's Saoirse Hinksmon (Head of Product Marketing) and Daniel Wyrzykowski (Product Manager) break down the structural shifts in the threat landscape and what security teams must do to keep pace.
View Video
mend

The ECB just gave banks four months to fix AI vulnerability gaps. Most of the work starts in the software supply chain.

Jul 8, 2026 By Tiffany Jennings In Mend
On July 7, 2026, the European Central Bank sent a letter to the CEO of every bank it directly supervises with an unambiguous instruction: build a formal action plan against AI-enabled cyberattacks, and submit it to your supervisory team by October 31.
Read Post
mend

Best AI Governance Platforms for Enterprises: Top 6 in 2026

Jul 7, 2026 By Tiffany Jennings In Mend
AI governance platforms provide enterprises with centralized oversight to manage AI risks, ensure regulatory compliance, and automate policy enforcement across the AI lifecycle. Leading solutions include security-oriented tools like Mend.io, HiddenLayer, and Prompt Security, as well as end-to-end governance platforms like IBM watsonx.governance and Microsoft Purview.
Read Post
mend

9-Step AI Governance Implementation Strategy and the Solutions to Know

Jul 2, 2026 By Tiffany Jennings In Mend
TL;DR: AI governance solutions help organizations inventory, secure, and monitor AI systems. Best for AI security and shadow AI: Mend AI; enterprise risk and compliance: Credo AI and IBM watsonx.governance; model monitoring: Fiddler AI. Effective AI governance implementation involves establishing a cross-functional committee, compiling an AI bill of materials (AI-BOM) to identify risks, and implementing policies based on frameworks like NIST AI RMF.
Read Post
mend

RubyGems supply chain attack: malware used as a credential exfiltration dead drop

Jul 1, 2026 By Maciej Mensfeld In Mend
Package registries have a well-known abuse pattern: attackers upload malicious packages, and unsuspecting developers install them. Our researchers just found the pattern working in reverse, in a RubyGems supply chain attack that turns the registry into a place to stash stolen data rather than deliver it.
Read Post
mend

Evaluating AI Security Posture Management Tools: 7 Key Criteria

Jul 1, 2026 By Tiffany Jennings In Mend
Evaluating AI Security Posture Management (AI-SPM) tools is a critical process for organizations integrating AI, specifically Generative AI (GenAI) and Large Language Models (LLMs), into their workflows. Unlike traditional security tools, AI-SPM focuses on the unique risks of AI, including Shadow AI, prompt injection, data poisoning, model theft, and improper model configuration. When assessing AI-SPM tools, security leaders should prioritize the following capabilities.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.