Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

GitHub Spark vs. Replit - Vibe Code Challenge

Mar 30, 2026 By Snyk In Snyk
We pit GitHub Spark (in public preview) against Replit's AI agent. The challenge? Build a fully functional community forum for DIY tips from a single prompt. We compare design aesthetics, mobile responsiveness, login security, and deployment speed to see which tool creates a truly production-ready application. Which one do you think deserved the win? Let me know in the comments!
View Video
certkit

Let's Encrypt simulated revoking 3 million certificates. Most ACME clients didn't notice.

Mar 30, 2026 By Todd H. Gardner In CertKit
On March 19th, Richard Hicks, one of our customers, emailed us about a certificate that had renewed after only a week. It was a 90-day certificate and he had not initiated the renewal. That’s the kind of thing that sends you straight to the logs. We found the answer right away. The certificate’s ARI renewal window had been shortened dramatically.
Read Post

Securing OpenClaw Access So It Can't Go Rogue

Mar 30, 2026 By Teleport In Teleport
In this video, we demonstrate how to securely grant an AI agent (OpenClaw) access to Teleport-protected Kubernetes resources using Teleport Machine Identity and tbot, without exposing secrets, API keys, or long-lived tokens. You’ll see how Teleport treats AI agents as first-class identities, enforcing strict RBAC controls so the agent can only do what it’s allowed to do, like reading logs, while being blocked from sensitive actions like deleting resources or accessing secrets.
View Video
mend

Famous Telnyx Pypi Package compromised by TeamPCP

Mar 27, 2026 By Tom Abai In Mend
Part 1 covered CanisterWorm, the self-spreading npm worm. Part 2 covered the malicious LiteLLM package and its.pth persistence. This post covers the third wave: a compromised telnyxPyPI package that hides its payload inside audio files and delivers entirely different malware depending on the victim’s operating system.
Read Post

Trivy/LiteLLM Breach: How to Identify Your Exposure and Contain It - 20-min Live Demo

Mar 27, 2026 By GitGuardian In GitGuardian
In this 20-minute live demo with Eric Fourrier (CEO and Founder of GitGuardian), Guillaume Valadon (Staff Cybersecurity Researcher at GitGuardian), & Dwayne McDaniel (Principal Developer Advocate at GitGuardian), you'll see how to determine if your machines were compromised by the ongoing Trivy and LiteLLM supply chain attack (attributed to TeamPCP), then scan for exposed secrets and get moving on remediation - step by step.
View Video

Understanding Malicious Packages in Modern Software Supply Chains

Mar 26, 2026 By Mend In Mend
Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.
View Video
The Hidden Costs Of Not Using Cloud Technology

The Hidden Costs Of Not Using Cloud Technology

Mar 26, 2026 By SecuritySenses In SecuritySenses
Business owners often stick to familiar routines - even when those habits drain the company bank account. Holding onto physical servers feels safe until the hidden bills for maintenance and repairs start piling up. These expenses act like a slow leak in your budget - slowly draining resources that could go toward growth. Many leaders overlook the subtle drains on their budget when they avoid modern systems. Shifting away from physical setups reveals expenses that were hiding in plain sight for years. Taking the step toward better systems is the only way to protect your long-term profits.
Read Post
certkit

CertKit Keystore: Private keys that never leave your infrastructure

Mar 25, 2026 By Todd H. Gardner In CertKit
When you use CertKit, your private keys live in CertKit’s database, encrypted at rest. We’ve written about why the actual risk is smaller than it sounds. But some organizations have policies that prohibit storing private keys with any third party, regardless of how they’re protected. That policy isn’t going away. The Local Keystore enables those organizations to use CertKit and still keep their keys local.
Read Post
jfrog

Stop Policies From Breaking Your Builds

Mar 25, 2026 By Jacqueline Basil In JFrog
Security policies exist to protect your software supply chain. So why do they keep breaking your builds? This is the unspoken frustration inside most DevOps and security teams today. Supply chain attacks drove 30% of external breaches in 2025. So your security team did the right thing. They added policies to flag packages that are too new, unproven, or missing from the organization’s approved package list.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.