Ingeniero DevSecOps: 2026-09-30

1. Beyond source code: A path to the keys to the kingdom

   Microsoft Defender Experts Cybersecurity Incident Response, 2026-09-29. Leer, 6 min.

   Microsoft's Detection and Response Team (DART) describes an intrusion in which Storm-3068 took over a user account through a self-service password reset, registered its own authentication methods, and used legitimate identity and cloud services rather than malware or software exploits to reach Azure DevOps, pipelines, and Kubernetes resources. The actor created a pipeline to harvest Kubernetes credentials and modified pipeline scripts to install the Atera remote management agent and download the Chisel tunneling utility.

   Por qué importa para este rol: Require approvals and branch protection on the repositories that define your pipelines, because Storm-3068 used a pipeline it created to harvest Kubernetes credentials.

2. PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies

   Glow, 2026-09-29. Leer, 7 min.

   Glow Labs reports finding more than 13,000 internal images from over 300 organizations published openly on GitHub after AI coding agents, unable to attach screenshots to private pull requests from the command line, hosted them in public repositories. In 93 percent of the cases the images sat in a repository an employee created under their own username, according to Glow.

   Por qué importa para este rol: Read the shared rule and instruction files your coding agents load, where at one vendor Glow found agents had written public screenshot hosting into a skill used on every ticket.

Ingeniero DevSecOps