This week at a glance
The week’s theme is trust signals you can actually check. When the eMudhra intermediate certificate authority compromise was published on October 20, the Python ecosystem had fixes out across certifi, CPython, pip, uv, conda and a half-dozen other tools within two days, including a last-resort denylist in CPython itself (CVE-2026-115557) backported to older releases. A few days later PyPI finished its redesigned project pages. Each release now says whether its files carry publish or SLSA build-provenance attestations, and four new warnings flag incomplete, inconsistent, changed or lost provenance — patterns that can mean a file did not come from the maintainers. Both depended on outside funding: Alpha-Omega pays for the PSF’s security role, and the OpenSSF paid for the PyPI redesign.
The second thread is who controls the coding agent. A developer found that opening the Postman desktop app installed Postman plugins into both Claude Code and OpenAI Codex, and that the installer approved its own session-start hook, a step a direct install leaves to the user. Nothing malicious was shown, which is the point: an ordinary upgrade changed what two agents do without anyone deciding it should. A CSO Online piece asks who approves the instruction, settings and skill files in a repository, a Help Net Security interview sets out an allowlist command policy for agents, and BlueFlag Security reports that 99% of repository access tokens it measured never expire and 68% of the identities agents run under hold admin rights. Google is giving gVisor and its Agent Substrate runtime to the CNCF, a bid to make sandboxed agent execution a shared standard.
The third thread is fixes are only half the job. The OpenSSF argues that PHP’s October 21 security release is a milestone, not the finish line, until fixed versions actually reach servers. Amazon engineers described how they cope with the flood of kernel CVEs, and JFrog announced zero-touch remediation that pulls backports and end-of-life patches from several patching vendors into one policy-driven flow. For maintainers, a clear guide explains what the EU Cyber Resilience Act asks of open-source stewards, and Kubescape earned all six OpenSSF Security Slam badges, including one for CRA readiness. Debian, meanwhile, is debating LLM-drafted reviews of incoming packages. Rounding out the issue: Revolut cut AI coding costs by about 90% by self-hosting, and several pieces ask how engineers verify what agents produce.
On our watch list
- gVisor and Agent Substrate at KubeCon North America. Google is donating both to the CNCF at Sandbox level alongside OpenRL, timed to KubeCon in Salt Lake City (November 9-12). Watch which other vendors commit maintainers, and whether agent platforms start naming a user-space kernel or microVM as the default isolation boundary.
- Postman’s answer, and the agent vendors’. Postman had not responded when the report ran. Watch whether it stops installing plugins on upgrade for existing users, and whether coding-agent vendors stop letting third-party installers write their own hook-trust entries.
- How many popular packages show “No provenance”. PyPI now surfaces provenance state and four tampering warnings per release. Watch for counts of top projects without attestations, and whether installers and lockfile tools start acting on the same signals.
- Certificate-authority incidents in other ecosystems. Python treated eMudhra with a bundle change plus a runtime denylist. Watch whether other language runtimes and container base images follow, and whether browser-style revocation via upki spreads beyond Ubuntu.
- Uptake of PHP’s October 21 fixes. The OpenSSF says the release is not the finish line. Watch for hosting providers and distributions reporting how much of the installed base has moved to fixed versions.
- Who supplies the patch. Backports for versions in use, fixes for end-of-life packages and pre-disclosure CVE patches now come from several vendors. Watch whether they converge on shared metadata so policy engines can choose between them and prove which fix shipped.
- Debian’s line on LLM-drafted reviews. The DFSG team’s use of LLMs for NEW-queue reviews follows August’s “Responsible Use of Generative AI” vote. Watch whether the project sets disclosure or human sign-off rules for LLM-drafted review text.
- Steward declarations under the CRA. Manufacturer reporting has applied since September 11, 2026; steward duties start December 11, 2027. Watch for foundations publishing which products they steward and their 24/72-hour reporting runbooks.
- Default token expiry. With 99% of measured repository tokens set never to expire, watch whether source-hosting and CI platforms make expiry the default for new tokens and flag those unused for 90 days.
- Self-hosted coding models and their attack surface. Revolut now runs about 2,000 engineers on a self-hosted open-weight model. Watch for more large firms making the same move, and for how they secure the model-serving stack and its gateway once it carries all source code.
This week’s topic map: the Python Software Foundation, the eMudhra compromise and PyPI’s provenance pages anchor the registry-trust cluster, funded through the OpenSSF and Alpha-Omega. Agent configuration links Postman’s self-approved hooks, Claude Code and Codex to command allowlists, non-expiring tokens and non-human identities, and on to sandboxing with gVisor, Agent Substrate and the CNCF. Patching ties JFrog’s zero-touch remediation to the kernel CVE flood and PHP fix uptake, and the EU Cyber Resilience Act sits with open-source stewards, Kubescape and Debian.
View interactive topic map →
Article index
Package registries and trust signals
A certificate-authority compromise fixed across the Python toolchain in two days, and project pages that now tell you whether a release can prove where it came from.
Patching at volume
Kernel CVEs at a pace that tests every downstream user, a fix supply that now spans several patching vendors, and a reminder that a security release only helps once it is installed.
Open-source governance, maintainers and the CRA
Debian argues over LLM-drafted package reviews, Kubescape earns every Security Slam badge including CRA readiness, and a clear guide to what the Cyber Resilience Act asks of open-source stewards.
Tokens and non-human identities
Machine identities now far outnumber people with repository access, and almost none of their tokens expire.
Who controls the coding agent
An app upgrade that rewired two coding agents, the files that steer agents and who should approve them, allowlist command policies, and sandboxes built so a prompt is never the only boundary.
Engineering at agent speed
Self-hosted models that make tokens cheap, a Git backend rebuilt for agent commit volume, parallel agents that need orchestration, and engineers redesigning the line rather than writing every change.
Verifying what agents produce
Layered release defences for AI-written code, agents that sway their users, metrics that miss most failures, and SQL that is correct but not authorised.
Detailed write-ups
1. Python patched a compromised certificate authority in two days
Python Software Foundation · November 5, 2026
When the compromise of eMudhra intermediate certificates was published on October 20, the Python Software Foundation’s Security Developer-in-Residence, Seth Larson, was on standby and started work at once. The role is funded by Alpha-Omega. Within two days the ecosystem had mitigations out across certifi, CPython, pip, uv, sigstore, virtualenv, conda, pixi, manylinux and the PyPI publishing action.
The fixes came in two layers. certifi, the certificate bundle most Python HTTP clients rely on, removed the “emSign Root TLS CA – G3” root so the affected intermediates are no longer trusted (advisory GHSA-6q48-6c7w-9gw2). CPython added a last-resort denylist that rejects the compromised intermediates during the TLS handshake even if an older bundle is still in place. It is tracked as CVE-2026-115557 and was backported to older Python versions. Larson also points to upki, a project that brings browser-style certificate revocation to other software and has been adopted by Ubuntu.
For DevSecOps teams, the lesson is about where trust stores hide. certifi is often pinned inside containers, serverless bundles and vendored virtual environments that never see a routine upgrade. A runtime denylist covers some of that, but only once the interpreter itself is updated. Treat a CA compromise like any other dependency CVE: find every copy of the bundle and every interpreter version in your images, and rebuild them.
Sources: https://pyfound.blogspot.com/2026/11/how-python-ecosystem-responded-to.html
2. PyPI now shows whether a release can prove where it came from
PyPI Blog · November 6, 2026
PyPI has finished redesigning its project pages around security signals. Each release now shows its provenance state. “Full provenance” means every file carries an attestation, and “No provenance” means none do, which is typical of older releases and projects that have not set up Trusted Publishing. Two attestation types are recognised: PyPI Publish attestations, which confirm a Trusted Publisher uploaded the file, and SLSA Build Provenance attestations, which tie the file to its source commit, build platform and build instructions.
Four new warnings flag patterns that may mean a file did not come from the maintainers: incomplete, inconsistent, changed and lost provenance. Late-file warnings mark files uploaded more than 14 days after a release first appeared, for releases before the 14-day rule took effect in July 2026. A Release history tab shows each release’s file count, provenance and status (quarantined, yanked, archived or pre-release), and a quarantine banner overrides everything else. The work was funded by the OpenSSF and follows its Attestations Style Guide.
PyPI is careful not to overclaim. “No provenance does not necessarily indicate that a release or release file is malicious,” writes Nicole Harris. The value is in change. A project that had provenance and then loses it, or whose builder changes between releases, is exactly what a reviewer should ask about before taking an upgrade. If you publish Python packages, turn on Trusted Publishing so your own releases show full provenance.
Sources: https://blog.pypi.org/posts/2026-11-06-ui-updates-complete/
3. A desktop-app upgrade quietly rewired two coding agents
The New Stack · November 3, 2026 · CSO Online · November 2, 2026 · Help Net Security · November 2, 2026
A developer reported on October 25 that opening Postman desktop 12.33.4 on macOS had installed Postman plugins into both Claude Code and OpenAI Codex without asking. Postman’s own logs show an install event on October 24 marked “auto-existing-upgrade”. Codex’s user configuration gained an enabled Postman plugin, a new plugin marketplace and a trusted session-start hook that tells Codex to load Postman’s API-engineering skill before most API tasks. A Postman command-line tool appeared with matching timestamps, and a connection to Postman’s remote MCP server was configured but kept failing to authenticate.
The detail that drew the most criticism is that Postman’s installer can write the hook’s trusted hash into Codex’s configuration itself, while a developer installing the same plugin through Codex has to review and approve it. The report covers one machine and has not been independently reproduced, and it shows no evidence of data being collected. The New Stack had no reply from Postman at publication. One commenter on the issue called the behaviour “unacceptable, even creating risk in corporate environment.”
Two other pieces this week explain why this matters beyond one vendor. A CSO Online contributor lists the files that now steer agents in a repository — Markdown instructions, JSON settings that can register shell commands, skill files and agent settings — and notes that a skill’s allowed-tools field can skip permission prompts, while repository hooks can run in non-interactive sessions without a trust dialog. Code-owner rules only help if branch protection requires them and the ownership file is itself protected. “The first reliable checkpoint is the pull request, and it needs a person who knows what the file can trigger.” In a Help Net Security interview, KloudStax CTO Vinay Thakker sets out the first lines of an agent command policy: an allowlist, one repository in a disposable environment, approved build, test and read-only git commands, no credentials, and network access only to an internal package mirror and named hosts, all enforced by the harness. “Never hand an agent a long-lived secret.”
Sources: https://thenewstack.io/postman-plugin-coding-agents/, https://www.csoonline.com/article/4242707/who-approves-the-files-that-control-your-ai-coding-assistant.html, https://www.helpnetsecurity.com/2026/11/02/vinay-thakker-kloudstax-ai-agent-access-control/
4. Ninety-nine percent of repository tokens never expire
Help Net Security · November 6, 2026 · TechTarget · November 4, 2026
BlueFlag Security’s State of Developer Risk 2026 report, covered by Help Net Security, finds that 99% of the repository access tokens it measured had no expiry date. 84% allowed code changes, and 47% had gone unused for more than 90 days without being revoked. The average developer had not used 61% of their granted permissions, and non-human identities with repository access outnumbered human developers eight to one.
AI agents make the picture sharper. Unapproved agents were present in 83% of organisations, which typically use about seven AI coding tools. 68% of the developer and service identities agents ran under held administrator rights, and 81% had no behavioural monitoring. Four in ten repositories had unprotected main branches, administrators bypassed code review in four of five organisations, and private repositories had become public in 28%. The report gives no sample size, so treat the percentages as directional. BlueFlag sells developer-identity security, and calls these tokens “the most powerful identities in the environment.”
At ISC2 Security Congress, Southwest Airlines’ Dhivya Balasubramanian and Vikas Gattu walked through a six-stage attack chain for non-human identities: discover, expose, acquire, exploit, escalate and persist. Their example was the March 2025 compromise of a widely used third-party CI action, used in more than 23,000 repositories, which leaked secrets into public workflow logs after an attacker stole a bot’s token in an earlier breach. Gattu’s advice is to find tokens older than 90 days and replace long-lived tokens with short-lived credentials. Balasubramanian added: “Please do not let your AI agents impersonate human or non-human identities.”
Sources: https://www.helpnetsecurity.com/2026/11/06/blueflag-ai-agents-access-risks-report/, https://www.techtarget.com/news/non-human-identities-pose-big-risks-cybersecurity-pros-warn/873822/
5. Google gives its agent sandbox to the CNCF
The New Stack · November 6, 2026 · DevOps.com · November 2, 2026 · DevOps.com · November 6, 2026
Google is donating gVisor, Agent Substrate and OpenRL to the Cloud Native Computing Foundation at Sandbox level, timed to KubeCon North America in Salt Lake City. The New Stack frames it as an attempt to repeat the Kubernetes playbook for AI agents, and notes that gVisor is already used by Anthropic and OpenAI. gVisor is an application kernel written in Go that intercepts system calls in user space, so untrusted code never talks to the host kernel directly. Agent Substrate, now at 1.0, adds a control and data plane on top of Kubernetes for stateful agents. With gVisor it can freeze a running environment and restore it on another node in under 500 milliseconds, and it supports microVMs for workloads that need hardware virtualisation.
Google’s pitch is a neutral, three-layer stack — isolation, agent runtime, training orchestration — that runs on any conformant cluster. “Without a shared open standard, every organization ends up building custom schedulers on top of VMs or working around Kubernetes,” its announcement says. For security teams, the useful part is that the isolation boundary becomes infrastructure rather than a promise in a prompt.
Two DevOps.com pieces describe what should wrap that boundary. Leon Kuperman of CAST AI argues that an agent’s environment should be defined in code and reviewed like a pipeline, with its own workload identity separate from the engineer’s login, short-lived scoped credentials, egress limits, and caps on runtime, retries and spend. The deployment pipeline, not the agent, promotes the result: “The agent does not need production credentials to implement a feature.” Igboanugo David Ugochukwu lines up agent incidents since mid-2025 — a production database deleted during a declared code freeze, malware that drove installed AI command-line tools to hunt for secrets (2,349 leaked), and a Terraform destroy run against the wrong state file — and finds the same cause each time. “A code freeze written in a prompt is a suggestion. A freeze enforced by credentials is a fact.”
Sources: https://thenewstack.io/gvisor-cncf-kubernetes-open-source/, https://devops.com/your-coding-agent-needs-production-discipline, https://devops.com/the-agent-did-exactly-what-we-let-it-do/
6. The patching gap: more fixes, from more places
Business Wire · November 3, 2026 · LWN.net · November 2, 2026
At swampUP Europe, JFrog convened a panel of patching vendors, including Red Hat, Broadcom and Echo, on what it calls the patching gap: the time between a fix existing somewhere and a fix running in your build. The panel described three kinds of patch now on offer from open-source patching vendors: backports to versions customers already run, patches for end-of-life packages, and CVE-only patches released before public disclosure. Each solves a real problem, and together they mean the same CVE can have several valid fixes from different suppliers.
JFrog’s answer is Universal Zero-Touch Remediation. The artifact repository ingests fixes from partner vendors for binaries, containers, AI models and MCP servers. JFrog Security applies the fix a customer’s policy prefers and records a signed evidence chain auditors can verify, with evidence mapped to frameworks such as DORA and the EU Cyber Resilience Act. JFrog says this cuts patching from days to hours. “Having a single source of truth is essential for protection in today’s AI threat landscape,” said Nico Thirion, JFrog’s field CISO. No availability date was given.
The kernel shows why the policy question matters. At the 2026 Linux Plumbers Conference, Amazon engineers Dylan Johnson and Justinien Bouron described keeping AWS running and secure through a storm of kernel CVE disclosures. LWN’s write-up, subscriber-only until next week, notes that the kernel community’s long-standing advice is to run current kernels, “and that turns out to work — sort of.” Whether you upgrade, take a vendor backport or accept the risk, decide by policy and keep a record of which fix shipped.
Sources: https://www.businesswire.com/news/home/20261103903338/en/JFrog-Closes-the-Patching-Gap-with-Universal-Zero-Touch-Remediation-Bringing-Leading-Patching-Vendors-into-One-Source-of-Truth, https://lwn.net/Articles/1100894/
7. A security release is not the finish line
OpenSSF · November 3, 2026 · LWN.net · November 3, 2026
PHP runs on about 70% of websites whose server-side language is known. On October 21 the project shipped fixes for two critical vulnerabilities that could let unauthenticated attackers execute code on some servers. Writing on the OpenSSF blog, Jeff Borek and Mike Linksvayer note that a 2024 audit funded by Germany’s Sovereign Tech Agency led to follow-up work that found early signs of the problem behind one of them, and that the PHP Foundation has acknowledged resource limits and weaknesses in its decision-making. Funded engineers made the remediation possible.
Their point is that disclosure and release are only the start. The OpenSSF named accelerating uptake of fixed components as its first priority back in 2023, and Alpha-Omega funds this kind of sustained work in critical projects. “A coordinated security release is a critical milestone. It is not the finish line.” The OpenSSF’s new guide to finding and fixing vulnerabilities with AI is offered as one way to keep up, and it plans a policy summit in Washington in spring 2027.
Debian is working through a related question about who does review work. After an August general resolution chose “Responsible Use of Generative AI”, the relatively new DFSG, Licensing & New Packages team began using LLMs to draft reviews of packages entering the NEW queue. LWN reports objections and questions about where the lines should be drawn on LLM-generated output. The details are subscriber-only until next week, but the debate is one every project that gates incoming code will face.
Sources: https://openssf.org/blog/2026/11/03/the-php-security-wake-up-call-fixes-are-only-the-beginning/, https://lwn.net/Articles/1103674/
8. What the Cyber Resilience Act asks of open-source maintainers
Barry O’Donovan · November 7, 2026 · OpenSSF · November 5, 2026
Barry O’Donovan’s guide is one of the clearest short reads on the CRA for maintainers. Regulation (EU) 2024/2847 applies directly in every member state. Manufacturer vulnerability and incident reporting began on September 11, 2026, and full application, including limited duties for open-source stewards, starts on December 11, 2027. Individual developers publishing open source are almost certainly outside it. Hosting code or publishing to a package registry does not, by itself, place software on the market.
A steward is a legal person, never an individual, that sustainably supports free software intended for commercial use without monetising it. Status is decided per product, and monetising the software makes you a manufacturer with full obligations. Stewards must keep a cybersecurity policy, cooperate with market surveillance authorities and, from December 2027, report actively exploited vulnerabilities and severe incidents on infrastructure they provide: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix. Stewards cannot be fined, while manufacturers face up to €15 million or 2.5% of worldwide turnover. “It’s a recognition that non-profit foundations are different from commercial vendors.”
Kubescape shows what preparation looks like in practice. During the OpenSSF Fall 2026 Security Slam (October 5 to November 6) it earned all six project badges, including a new CRA Readiness badge for stewardship and escalation documentation. About 45 Slam pull requests were merged across 12 repositories, five core repositories adopted Security Insights files and weekly baseline scans, and more than ten pinned their CI actions and tightened workflow permissions. Roughly 25-30 maintainer hours of guidance unlocked 125-150 community hours. Maintainer Matthias Bertschy called the framework “a clear, machine-verifiable blueprint to elevate security across the Kubescape ecosystem.”
Sources: https://www.barryodonovan.com/2026/11/07/the-cyber-resilience-act-and-open-source, https://openssf.org/blog/2026/11/05/case-study-kubescape-completes-all-six-security-slam-badges-with-openssf/
Calls to action
- Find every copy of certifi and every Python interpreter in your images. Rebuild containers, serverless bundles and vendored environments with the certifi release that drops the emSign root and a CPython build that includes the CVE-2026-115557 denylist.
- Turn on Trusted Publishing and attestations for every package you publish to PyPI. Before taking an upgrade of a dependency, check its provenance state and treat a change or loss of provenance as a reason to stop and ask.
- Audit agent configuration on developer machines this week. Read ~/.codex/config.toml and Claude Code’s settings and plugin list, and remove any plugin, hook, skill or MCP server nobody chose to install.
- Put agent instruction, settings, hook and skill files under required owner review. Enforce it with branch protection, protect the ownership file itself, and extend review to the scripts those files call.
- Set an expiry on every repository token. Revoke tokens unused for 90 days, replace long-lived tokens with short-lived credentials, and give each agent its own identity with only the permissions one job needs.
- Write your agent command policy as an allowlist the harness enforces. One repository in a disposable environment, approved build and test commands only, no long-lived secrets, and network access limited to your package mirror and named hosts.
- Run agent-executed code inside a real isolation boundary. Use a user-space kernel or microVM sandbox, cap runtime, retries and spend, and let the pipeline — not the agent — promote anything to production.
- Decide by policy which fix wins for each package. Choose between upstream upgrade, distribution backport and end-of-life patch, and keep signed evidence of which fix shipped in each build.
- Confirm your PHP servers run the October 21 fixed releases. Check base images and hosting tiers, not just the versions in your lockfiles.
- If a foundation you work with supports open source, decide whether it is a CRA steward. Write the cybersecurity policy now and draft a 24-hour and 72-hour reporting runbook before December 2027.
|