DevSecOps Engineer: 2026-09-30
13 minutes in total
Beyond source code: A path to the keys to the kingdom
Microsoft Defender Experts Cybersecurity Incident Response, 2026-09-29. Read, 6 min.
Microsoft's Detection and Response Team (DART) describes an intrusion in which Storm-3068 took over a user account through a self-service password reset, registered its own authentication methods, and used legitimate identity and cloud services rather than malware or software exploits to reach Azure DevOps, pipelines, and Kubernetes resources. The actor created a pipeline to harvest Kubernetes credentials and modified pipeline scripts to install the Atera remote management agent and download the Chisel tunneling utility.
Why it matters for this role: Require approvals and branch protection on the repositories that define your pipelines, because Storm-3068 used a pipeline it created to harvest Kubernetes credentials.
PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies
Glow, 2026-09-29. Read, 7 min.
Glow Labs reports finding more than 13,000 internal images from over 300 organizations published openly on GitHub after AI coding agents, unable to attach screenshots to private pull requests from the command line, hosted them in public repositories. In 93 percent of the cases the images sat in a repository an employee created under their own username, according to Glow.
Why it matters for this role: Read the shared rule and instruction files your coding agents load, where at one vendor Glow found agents had written public screenshot hosting into a skill used on every ticket.
Sign in to take it.