Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Mini Shai-Hulud Hits keyv: Trojanized Release Exfiltrates CI Secrets via GitHub

On August 4, 2026, a malicious version of keyv was published to npm as keyv@6.0.0, one of a number of npm packages affected across the Keyv and Cacheable ecosystem. The release follows the Mini Shai-Hulud pattern: a trojanized version of a heavily depended-on package, with an install-time hook that reaches cloud and CI credentials. It leaves the compiled library untouched and instead adds a preinstall hook and two files.

Why Traditional SAST Fails on AI-Generated Code

AI didn't just speed up software development, it changed what application security programs must defend. As AI coding assistants generate code at machine speed and developers integrate AI agents, models, and RAG pipelines into production, traditional scanners generate endless backlogs of unprioritized alerts.

Guide: Certificate-Based Authentication for Payment & Banking Infrastructure

Payment and banking infrastructure continues to grow. Bare-metal servers and mainframes now sit alongside Kubernetes clusters, microservice architectures, and CI/CD pipelines running across multiple clouds and on-prem data centers. Every new environment adds its own accounts, tokens, and access paths to manage. But because this infrastructure powers live transactions, there is no room for downtime or disruptions.

It Just Got Easier To Consistently Deploy And Configure ggshield Across Your Whole Fleet With v1.53

ggshield v1.53.0 introduces ggshield machine setup, a consistent way to configure ggshield no matter how it was installed. Set up AI hooks for every detected AI coding assistant, install global git pre-commit/pre-push hooks, and deploy a honeytoken on the endpoint. You have full control, and we have options to customize which features you want to skip. This release also includes ggshield machine doctor, a read-only command that checks that the machine's ggshield protections are correctly set up, letting you know what steps to take if it encounters an issue.

AppSec: When Bandwidth Isn't the Bottleneck

AppSec teams are frequently told that a lack of bandwidth is why vulnerability backlogs keep growing. In reality, the bottleneck is not team size, it is the lack of contextual prioritization and agentic triage. When traditional scanners hand security teams thousands of findings without reachability context, developer velocity stalls. In this webinar, Mend.io security experts unpack why bandwidth is not the real bottleneck in modern software security and show you how to streamline triage, automate remediation, and secure code at AI speed.

CertKit Private PKI: A private certificate authority without running one yourself

In May I wrote that you probably don’t need private PKI for internal infrastructure, because DNS validation gets a publicly trusted certificate onto hosts that never touch the internet. In June I pointed out that Apple enforces an 825-day cap on private certificates, so your own CA doesn’t even free you from the browser vendors. Two days ago I told you that public client certificates stop renewing in October, and that the replacement is a private certificate authority.

NIS2 and DORA Compliance for Kubernetes Backup

EU regulations are putting real pressure on how organizations protect and recover their data. If you run Kubernetes workloads in financial services, insurance, healthcare, energy, telco, and public administration, your backup strategy is no longer just an IT concern. It is something regulators and auditors can examine directly. Most Kubernetes environments were set up for operational convenience rather than compliance.

Move faster than AI-driven risk: Inside Mend.io's latest AI application security update

AI didn’t just change how fast you ship. It changed what your AI application security program has to protect. Two years ago, security teams protected code, open source, and containers. Today they also have to protect AI agents, MCP servers, models, prompts, and runtime interactions, configured or deployed faster than any team can manually review. The attack surface didn’t grow. It exploded.