Topic

DevSecOps: news, advisories and analysis

13 articlesUpdated 22 Oct 2026

CyberSecureToday covers DevSecOps across 13 articles published between 7 Sep 2026 and 22 Oct 2026. The coverage includes 11 vulnerability advisories and 2 analysis or guidance pieces. 9 advisories are rated critical or high severity, and 1 involves a flaw listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on DevSecOps most often intersect with Cloud Security, AWS and LLM Security, with Technology, Cloud & SaaS the most affected sector. The most recent story, “GitLab Patches Maximum-Severity CVSS 10.0 Unauthenticated RCE Flaw Spanning 12 Years of Releases”, was published 22 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaS
GitLab Patches Maximum-Severity CVSS 10.0 Unauthenticated RCE Flaw Spanning 12 Years of Releases
GitLab has released emergency security updates resolving CVE-2026-110264, a critical CVSS 10.0 integer overflow in the Onigmo regular expression compiler enabling unauthenticated RCE.
CST Editorial Desk22 Oct 202612 min read
InsightsCloud & SaaS
Why Prompt Guards Cannot Stop Agentic RCE: The Case for MicroVM Isolation in Tool-Calling Pipelines
Recent CVEs in Ollama and AWS MCP reveal that semantic prompt filters cannot prevent tool injection. Engineering teams must isolate agent tools in ephemeral microVMs.
Aisha Noor6 Oct 20268 min read
ThreatsCloud & SaaSCritical
GitLab AI Gateway Prompt Execution Flaw Exposes Cloud Workspaces to Remote Code Execution (CVE-2026-90970)
A critical command injection flaw in GitLab AI Gateway allows remote attackers to break LLM agent sandboxes and execute code across enterprise cloud runners.
CST Editorial Desk1 Oct 202611 min read
ThreatsCloud & SaaSHigh
AWS Security Agent, MCP Server Flaws Let S3 Squatters Intercept Source Code
AWS patches vulnerabilities CVE-2026-87912 and CVE-2026-87913 in DevSecOps security agents and Model Context Protocol servers where predictable bucket names permit source code theft.
Aisha Noor21 Sep 202614 min read
ThreatsCloud & SaaSHigh
Amazon SSM Agent Path Traversal Flaw Enables Root Host Takeover via Malicious S3 Object Keys
AWS resolves high-severity CVSS 8.8 flaw CVE-2026-81849 in amazon-ssm-agent where crafted S3 object keys allow authenticated IAM actors to overwrite root host files.
Daniel Okafor20 Sep 202612 min read
ThreatsCloud & SaaSHigh
Flowise SSRF Vulnerability Bypasses Network Guardrails to Steal Cloud Instance Credentials
Vulnerability CVE-2026-67620 in Flowise AI workflow builder allows attackers to bypass SSRF deny-lists and extract cloud instance metadata credentials from OCI and Alibaba Cloud.
Daniel Okafor20 Sep 202611 min read
ThreatsCloud & SaaSHigh
Amazon Bedrock AgentCore Flaw Allows Attackers to Bypass LLM Guardrails via Injected Tool-Use Payloads
AWS resolves high-severity vulnerability CVE-2026-18830 in Amazon Bedrock AgentCore allowing attackers to bypass LLM safety guardrails and trigger arbitrary tool calls.
Daniel Okafor19 Sep 202611 min read
ThreatsCloud & SaaSHigh
Azure Kubernetes Service Container Path Traversal Flaw Enables Node Escape and Code Execution
Microsoft patches high-severity vulnerability CVE-2026-32193 in Azure Kubernetes Service allowing container workloads to escape sandboxes via path traversal.
Priya Raman19 Sep 202611 min read
ThreatsCloud & SaaSHigh
AWS API MCP Server Flaw Let AI Agents Bypass Security Policies
AWS Labs resolves high-severity vulnerability CVE-2026-16584 in AWS API MCP Server allowing autonomous AI agent workflows to bypass security policies upon initialization failure.
Daniel Okafor19 Sep 202611 min read
ThreatsCloud & SaaSHigh
AWS Discloses Command Injection Flaw in projen Tooling Enabling CI/CD Runner Takeover
AWS resolves high-severity vulnerabilities CVE-2026-89066 and CVE-2026-89065 in projen software project synthesis tooling allowing arbitrary command execution on developer workstations and CI runners.
Daniel Okafor19 Sep 202610 min read
ThreatsCloud & SaaSCritical
Gitea Git Diffpatch Code Injection Flaw Weaponized to Compromise Repositories
CISA issues binding remediation directive on CVE-2026-60004, a critical code injection defect in Gitea's git diffpatch parser enabling remote command execution on self-hosted repositories.
Daniel Okafor15 Sep 20268 min read
ThreatsCloud & SaaS
GitHub adds a merge gate for pull requests with unresolved secret alerts
GitHub’s new ruleset can block pull-request merges until selected secret-scanning alerts are resolved, adding a review-stage guard beyond push protection.
Daniel Okafor13 Sep 20265 min read
GuidesCloud & SaaS
Hardening guide: locking down your npm and CI/CD supply chain
A practical, ordered checklist for defending against malicious packages and install-time credential theft — with the exact commands and settings.
Mei-Lin Chen7 Sep 20269 min read