{"id":5545,"date":"2026-07-26T13:22:32","date_gmt":"2026-07-26T18:22:32","guid":{"rendered":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=5545"},"modified":"2026-07-26T13:22:32","modified_gmt":"2026-07-26T18:22:32","slug":"devsecops-weekly-july-26-2026","status":"publish","type":"post","link":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=5545","title":{"rendered":"DevSecOps Weekly &mdash; July 26, 2026"},"content":{"rendered":"<style>\n.single .entry-title,\n.single .entry-header .entry-title,\n.single .post-title,\n.single header.entry-header h1,\n.single h1.entry-title,\n.single .page-title,\n.post-template-default h1.entry-title,\n.post-template-default .entry-header,\narticle .entry-header,\narticle .entry-title { display: none !important; }\n.single .entry-header { margin: 0 !important; padding: 0 !important; }\n.single .entry-content { margin-top: 0 !important; padding-top: 0 !important; }\n<\/style>\n<div class=\"container\">\n<div class=\"banner\" style=\"background-color:#082f49;background:linear-gradient(135deg,#082f49 0%,#0c4a6e 50%,#0891b2 100%);padding:44px 32px 40px;color:#ffffff;\">\n<p class=\"kicker\">Security Radar &middot; Issue 9<\/p>\n<h1 style=\"color:#ffffff !important;\">DevSecOps Weekly<\/h1>\n<p class=\"date\" style=\"color:#e0f2fe !important;\">July 26, 2026 &middot; Weekly Edition<\/p>\n<p class=\"tagline\" style=\"color:#f0f9ff !important;\">The Shai-Hulud worm surfaced inside a breach at Suno, a poisoned PyPI package walked off with SSH, cloud, and Kubernetes credentials, and a backdoored RubyGem sat quietly waiting &mdash; every major package registry took a hit this week.<\/p>\n<\/p><\/div>\n<div class=\"content\">\n<h2 class=\"section\">At a glance<\/h2>\n<p class=\"lead\">This week the software supply chain got attacked on every front at once, and no single registry was spared. The through-line is the <strong>Shai-Hulud worm<\/strong> &mdash; the self-propagating npm malware that spreads by harvesting a developer&rsquo;s tokens and using them to publish itself into the next package. Socket traced it inside the breach at AI-music startup Suno, where leaked internal code exposed the company&rsquo;s music-scraping pipeline, and separately documented &ldquo;Miasma,&rdquo; a mini Shai-Hulud variant that hit ImmobiliareLabs&rsquo; npm packages. A worm that turns each compromised maintainer into the launch pad for the next infection is exactly the failure mode SBOMs and one-time scans were never built to catch.<\/p>\n<p class=\"lead\">Around that spine, the credential-theft campaigns fanned out across languages. StepSecurity caught the PyPI package <em>mrmustard 0.7.4<\/em> stealing SSH keys, cloud tokens, and Kubernetes credentials on install, and detailed <strong>SleeperGem<\/strong>, a set of compromised RubyGems that drop a persistent backdoor and wait. Socket flagged the <em>jscrambler<\/em> npm package compromise, eleven malicious NuGet tools masquerading as game cheats to plant a Windows host-surveillance payload, and the ongoing North-Korea-linked <strong>PolinRider<\/strong> campaign now expanding across open-source ecosystems. npm, PyPI, RubyGems, NuGet &mdash; four registries, four live campaigns, one week.<\/p>\n<p class=\"lead\">The defensive and platform news pushes back at the layer where these attacks land. On the pipeline side, WinBuzzer covered <strong>Cordyceps<\/strong>, a GitHub Actions flaw that lets pull requests reach secrets and CI\/CD tokens, while Socket reported that both Next.js and Node.js are formalizing how they ship and triage security fixes &mdash; Next.js moving to scheduled security releases, Node.js weighing a public workflow for reports amid an AI-driven surge in submissions. On the tooling side, the AI-coding-agent story keeps getting more operational: Cisco released an AI model that points code reviewers straight at likely vulnerabilities, VS Code 1.129 introduced a dedicated agent host, the Model Context Protocol is going stateless to scale more cleanly, StepSecurity shipped Device Policy to enforce approved VS Code extensions across a fleet, and TechTimes underscored why it all matters &mdash; AI coding agents that skip package verification are precisely the door these registry campaigns walk through. The connective tissue: the registry, the pipeline, and the coding assistant are now one continuous attack surface, and this week every part of it was live.<\/p>\n<p class=\"lead\">The platforms did push back at the structural level. GitHub and PyPI both shipped <strong>time-based defenses<\/strong> against exactly this wave &mdash; a three-day Dependabot cooldown before adopting new package versions, and a PyPI rule rejecting new files added to releases older than 14 days &mdash; blunting the &ldquo;publish-malicious-version-and-hope-it&rsquo;s-pulled-fast&rdquo; and release-poisoning tactics. Research kept pace: a University of Texas at Dallas study found that <strong>multi-patch vulnerability fixes<\/strong> leave open source exposed in the window between the first commit and the last, and that detection tools score worse than a coin flip at telling a partial fix from a complete one. And the human side buckled under AI volume: The Register reported <strong>GitHub is slashing public bug-bounty payouts<\/strong> as a flood of AI-generated reports buries its security team, while The Pragmatic Engineer captured the mirror-image problem &mdash; a <strong>surge in code-review load<\/strong> as AI writes more code than humans can carefully review, pushing teams toward AI reviewers and &ldquo;verify, don&rsquo;t review&rdquo; experiments. Rounding out the foundational reading, The New Stack&rsquo;s look at <strong>APIs vs. MCP<\/strong> for incident management argued the two are complements, not rivals &mdash; deterministic API workflows where you need reliability, MCP&rsquo;s AI context where you need judgment. The week&rsquo;s meta-story: AI is simultaneously the attacker&rsquo;s force multiplier and the reason the defensive humans (reviewers, triagers, bug-bounty teams) are drowning &mdash; and the platforms are reaching for structural, time-and-policy-based brakes because per-report human review no longer scales.<\/p>\n<div class=\"topic-map\">\n      <img decoding=\"async\" src=\"https:\/\/www.cybersecurityinstitute.com\/blog\/wp-content\/uploads\/2026\/07\/topic-map-devsecops-2026-07-26.png\" alt=\"Topic map of DevSecOps Weekly stories for July 26, 2026\" loading=\"eager\"><\/p>\n<p class=\"caption\">Topic map &mdash; the Shai-Hulud worm and its Miasma variant riding npm (Suno breach), the registry-wide credential-theft wave across PyPI (mrmustard), RubyGems (SleeperGem), NuGet (game-cheat surveillance tools) and npm (jscrambler), the North-Korea-linked PolinRider campaign, CI\/CD and upstream hardening (Cordyceps GitHub Actions flaw, Next.js scheduled releases, Node.js public workflow), and the AI-coding-agent tooling layer (Cisco code-review AI, VS Code agent host, Model Context Protocol, StepSecurity extension governance, package-verification gaps), and the platform\/process response &mdash; GitHub &amp; PyPI time-based supply-chain defenses, multi-patch fix exposure windows, GitHub&rsquo;s bug-bounty cuts under an AI-report flood, the rising code-review load, and where MCP fits alongside APIs. Socket and StepSecurity anchor the research.<\/p>\n<p>      <!-- INTERACTIVE_MAP_LINK_START --><\/p>\n<p style=\"margin:10px 0 0;text-align:center;\"><a href=\"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=5544\" target=\"_blank\" rel=\"noopener\" style=\"display:inline-block;padding:8px 18px;background-color:#0f172a;color:#ffffff !important;text-decoration:none;border-radius:6px;font-size:13px;font-weight:600;\">View interactive topic map &rarr;<\/a><\/p>\n<p><!-- INTERACTIVE_MAP_LINK_END -->\n    <\/div>\n<h2 class=\"section\">Article index<\/h2>\n<div class=\"cluster\">\n<h3>Shai-Hulud &amp; the multi-ecosystem supply-chain wave<\/h3>\n<p>The week&rsquo;s dominant thread: the self-propagating Shai-Hulud worm resurfaces inside the Suno breach and in the Miasma mini-variant, while credential-stealing and backdoor campaigns hit npm, PyPI, RubyGems and NuGet at once. Socket and StepSecurity carry most of the research. (W = weekly news, F = foundational reading.)<\/p>\n<ol class=\"articles\" style=\"margin:0;padding-left:20px;font-size:14px;color:#0f172a;\">\n<li><a href=\"https:\/\/socket.dev\/blog\/suno-breach-shai-hulud-worm\" style=\"color:#0c4a6e;\">Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Music Scraping<\/a> (Socket, Jul 16) &mdash; F1<\/li>\n<li><a href=\"https:\/\/socket.dev\/blog\/miasma-mini-shai-hulud-hits-immobiliarelabs-npm-packages\" style=\"color:#0c4a6e;\">Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages<\/a> (Socket, Jun 26) &mdash; F10<\/li>\n<li><a href=\"https:\/\/www.stepsecurity.io\/blog\/compromised-pypi-mrmustard-0-7-4-credential-stealer\" style=\"color:#0c4a6e;\">Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials<\/a> (StepSecurity, Jul 24) &mdash; W2<\/li>\n<li><a href=\"https:\/\/www.stepsecurity.io\/blog\/sleepergem-compromised-rubygems-drop-persistent-backdoor\" style=\"color:#0c4a6e;\">SleeperGem: Compromised RubyGems Drop a Persistent Backdoor<\/a> (StepSecurity, Jul 19) &mdash; W3<\/li>\n<li><a href=\"https:\/\/socket.dev\/blog\/jscrambler-supply-chain-attack\" style=\"color:#0c4a6e;\">jscrambler npm Package Compromised in Supply Chain Attack<\/a> (Socket, Jul 11) &mdash; F5<\/li>\n<li><a href=\"https:\/\/socket.dev\/blog\/11-malicious-nuget-tools-pose-as-game-cheats\" style=\"color:#0c4a6e;\">11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload<\/a> (Socket, Jul 14) &mdash; F3<\/li>\n<li><a href=\"https:\/\/socket.dev\/blog\/polinrider-north-korea-linked-supply-chain-campaign-expands\" style=\"color:#0c4a6e;\">PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems<\/a> (Socket, Jul 1) &mdash; F8<\/li>\n<\/ol><\/div>\n<div class=\"cluster\">\n<h3>CI\/CD pipelines &amp; upstream project hardening<\/h3>\n<p>The response layer: a GitHub Actions flaw (Cordyceps) that exposes secrets and CI\/CD tokens to pull requests, and two major projects formalizing how security fixes get shipped and triaged as AI drives up the volume of reports.<\/p>\n<ol class=\"articles\" style=\"margin:0;padding-left:20px;font-size:14px;color:#0f172a;\" start=\"7\">\n<li><a href=\"https:\/\/winbuzzer.com\/2026\/07\/08\/novee-says-cordyceps-can-expose-github-actions-secrets-xcxwbn\/\" style=\"color:#0c4a6e;\">GitHub Actions Flaw Lets Pull Requests Reach Secrets and CI\/CD Tokens (Cordyceps)<\/a> (WinBuzzer, Jul 8) &mdash; F6<\/li>\n<li><a href=\"https:\/\/socket.dev\/blog\/nextjs-moves-to-scheduled-security-releases\" style=\"color:#0c4a6e;\">Next.js Moves to Scheduled Security Releases<\/a> (Socket, Jul 16) &mdash; F2<\/li>\n<li><a href=\"https:\/\/socket.dev\/blog\/nodejs-considers-public-workflow-for-security-reports\" style=\"color:#0c4a6e;\">Node.js Considers Public Workflow for Security Reports Amid AI-Driven Surge<\/a> (Socket, Jul 6) &mdash; F7<\/li>\n<\/ol><\/div>\n<div class=\"cluster\">\n<h3>AI coding agents, MCP &amp; developer tooling<\/h3>\n<p>The assistant layer keeps getting more operational: an AI model that guides code reviewers to likely vulnerabilities, a dedicated VS Code agent host, a stateless Model Context Protocol, fleet-wide extension governance, and a blunt reminder that AI agents skipping package verification are the door these registry campaigns exploit.<\/p>\n<ol class=\"articles\" style=\"margin:0;padding-left:20px;font-size:14px;color:#0f172a;\" start=\"10\">\n<li><a href=\"https:\/\/www.infoworld.com\/article\/4200143\/ciscos-new-ai-model-tells-code-reviewers-where-to-look-for-vulnerabilities.html\" style=\"color:#0c4a6e;\">Cisco&rsquo;s New AI Model Tells Code Reviewers Where to Look for Vulnerabilities<\/a> (InfoWorld, Jul 22) &mdash; W1<\/li>\n<li><a href=\"https:\/\/www.infoworld.com\/article\/4199680\/visual-studio-code-1-129-introduces-dedicated-agent-host.html\" style=\"color:#0c4a6e;\">Visual Studio Code 1.129 Introduces Dedicated Agent Host<\/a> (InfoWorld, Jul 21) &mdash; W4<\/li>\n<li><a href=\"https:\/\/www.infoworld.com\/article\/4201254\/model-context-protocol-is-going-stateless-to-make-scaling-simpler.html\" style=\"color:#0c4a6e;\">Model Context Protocol Is Going Stateless to Make Scaling Simpler<\/a> (InfoWorld, Jul 24) &mdash; W5<\/li>\n<li><a href=\"https:\/\/www.stepsecurity.io\/blog\/introducing-device-policy-enforce-approved-vs-code-extensions-across-your-fleet\" style=\"color:#0c4a6e;\">Introducing Device Policy: Enforce Approved VS Code Extensions Across Your Fleet<\/a> (StepSecurity, Jul 14) &mdash; F4<\/li>\n<li><a href=\"https:\/\/www.techtimes.com\/articles\/319457\/20260701\/ai-coding-agents-skip-package-verification-attackers-are-exploiting-it.htm\" style=\"color:#0c4a6e;\">AI Coding Agents Skip Package Verification, and Attackers Are Exploiting It<\/a> (TechTimes, Jul 1) &mdash; F9<\/li>\n<\/ol><\/div>\n<div class=\"cluster\">\n<h3>Platform &amp; deployment operations<\/h3>\n<p>The ops reality check: Kubernetes made shipping stateless services trivial, but the stateful databases underneath remain the hard, under-warned part of running a platform.<\/p>\n<ol class=\"articles\" style=\"margin:0;padding-left:20px;font-size:14px;color:#0f172a;\" start=\"15\">\n<li><a href=\"https:\/\/thenewstack.io\/kubernetes-database-operations-platform\/\" style=\"color:#0c4a6e;\">Kubernetes Made Deploying Easy. Nobody Warned You About the Databases.<\/a> (The New Stack, Jul 21) &mdash; W6<\/li>\n<\/ol><\/div>\n<div class=\"cluster\">\n<h3>Registry &amp; supply-chain platform defenses<\/h3>\n<p>The platforms answer the wave at the structural level: GitHub and PyPI ship time-based brakes on package adoption and release edits, while new research shows multi-patch fixes leave open source exposed between commits &mdash; and detection tools can&rsquo;t tell a partial fix from a complete one.<\/p>\n<ol class=\"articles\" style=\"margin:0;padding-left:20px;font-size:14px;color:#0f172a;\" start=\"16\">\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/github-pypi-add-time-absed-defenses-against-supply-chain-attacks\/\" style=\"color:#0c4a6e;\">GitHub, PyPI Add Time-Based Defenses Against Supply Chain Attacks<\/a> (BleepingComputer, Jul 26) &mdash; W7<\/li>\n<li><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/07\/23\/research-multi-patch-vulnerability-fixes\/\" style=\"color:#0c4a6e;\">Multi-Patch Vulnerability Fixes Can Leave Open Source Exposed<\/a> (Help Net Security, Jul 23) &mdash; W8<\/li>\n<\/ol><\/div>\n<div class=\"cluster\">\n<h3>AI&rsquo;s pressure on review, bug bounties &amp; integration<\/h3>\n<p>The human side buckles under AI volume: GitHub cuts public bug-bounty payouts as AI-generated reports bury its security team, engineering leaders sound the alarm on a soaring code-review load, and a look at where MCP fits alongside APIs for incident management.<\/p>\n<ol class=\"articles\" style=\"margin:0;padding-left:20px;font-size:14px;color:#0f172a;\" start=\"18\">\n<li><a href=\"https:\/\/www.theregister.com\/devops\/2026\/07\/23\/github-slashes-public-bug-bounty-payouts-as-ai-report-flood-buries-its-security-team\/5277046\" style=\"color:#0c4a6e;\">GitHub Slashes Public Bug-Bounty Payouts as AI Report Flood Buries Its Security Team<\/a> (The Register, Jul 23) &mdash; W9<\/li>\n<li><a href=\"https:\/\/newsletter.pragmaticengineer.com\/p\/the-pulse-new-trend-concern-about\" style=\"color:#0c4a6e;\">The Pulse: New Trend &mdash; Concern About a Massive Increase in Code-Review Load<\/a> (The Pragmatic Engineer, Jul 23) &mdash; F11<\/li>\n<li><a href=\"https:\/\/thenewstack.io\/api-vs-mcp-incident-management\/\" style=\"color:#0c4a6e;\">APIs Aren&rsquo;t Dead. Here&rsquo;s Where MCP Fits Alongside Them.<\/a> (The New Stack, Jul 12) &mdash; F12<\/li>\n<\/ol><\/div>\n<h2 class=\"section\">Detailed write-ups<\/h2>\n<div class=\"article\">\n<p><span class=\"num\">01<\/span><\/p>\n<h4>Shai-Hulud rides again: the worm surfaces in the Suno breach and a &ldquo;Miasma&rdquo; mini-variant<\/h4>\n<\/p>\n<p class=\"meta\">Socket &middot; June 26 &ndash; July 16, 2026<\/p>\n<p>The story tying the week together is a worm, not a single package. Shai-Hulud is self-propagating npm malware: once it lands on a developer&rsquo;s machine it harvests their npm and cloud tokens, then uses those stolen credentials to publish infected versions of packages the victim can push to &mdash; so every compromised maintainer becomes the launch pad for the next wave. Socket found its fingerprints inside the breach at AI-music startup Suno, where leaked internal code laid bare how the company scrapes and ingests music, and the worm&rsquo;s token-harvesting behavior is what turned a developer compromise into an exposure of Suno&rsquo;s pipeline. In a separate post Socket documented &ldquo;Miasma,&rdquo; a slimmed-down mini Shai-Hulud that hit ImmobiliareLabs&rsquo; npm packages &mdash; the same propagation trick, a lighter payload, showing the technique is now being forked and reused rather than run as one monolithic campaign. The reason this matters more than any one poisoned package: a worm defeats the mental model behind most supply-chain controls. An SBOM tells you what you shipped yesterday; a one-time scan tells you a version was clean when you checked it. Neither catches a payload that spreads laterally through maintainer credentials and republishes itself hours later. The defenses that actually bite here are credential-side &mdash; short-lived and scoped publish tokens, hardware-backed 2FA on registry accounts, and provenance\/trusted-publishing so an unexpected publish from a stolen token stands out &mdash; plus behavioral monitoring of what a package does on install rather than what its manifest claims.<\/p>\n<p>      <a class=\"button\" href=\"https:\/\/socket.dev\/blog\/suno-breach-shai-hulud-worm\">Read the article<\/a><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin-top:6px;\">Sources: <a href=\"https:\/\/socket.dev\/blog\/suno-breach-shai-hulud-worm\" style=\"color:#1d4ed8;text-decoration:none;\">Socket (Suno \/ Shai-Hulud)<\/a>, <a href=\"https:\/\/socket.dev\/blog\/miasma-mini-shai-hulud-hits-immobiliarelabs-npm-packages\" style=\"color:#1d4ed8;text-decoration:none;\">Socket (Miasma mini Shai-Hulud)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<p><span class=\"num\">03<\/span><\/p>\n<h4>Four registries, one heist: mrmustard on PyPI, jscrambler on npm, and surveillance-ware on NuGet<\/h4>\n<\/p>\n<p class=\"meta\">StepSecurity &amp; Socket &middot; July 11 &ndash; 24, 2026<\/p>\n<p>If Shai-Hulud is the marquee, the supporting cast shows the same playbook running in parallel across every ecosystem &mdash; and it is the credentials, not the code, that the attackers are after. StepSecurity caught <em>mrmustard 0.7.4<\/em> on PyPI, a compromised release that on install sweeps the host for SSH private keys, cloud provider tokens, and &mdash; notably &mdash; Kubernetes credentials, the exact secrets that let an attacker pivot from one developer laptop into production infrastructure. Socket documented the <em>jscrambler<\/em> npm package compromise, another trusted-name package turned against the developers who depend on it, and separately exposed eleven malicious NuGet tools dressed up as game cheats that, once run, drop a Windows host-surveillance payload &mdash; a reminder that the .NET ecosystem and Windows endpoints are squarely in scope, not just the Linux\/JavaScript world these stories usually center on. Read together, the three make the point that &ldquo;which registry do we use&rdquo; is the wrong question: PyPI, npm, and NuGet all took direct hits in the same seven days, and the payloads converge on the same objective &mdash; harvest the secrets that grant lateral movement. For DevSecOps teams the practical takeaways are consistent across languages: block or sandbox install-time script execution, keep developer credentials out of long-lived files (short-lived tokens, secrets managers, workload identity instead of static kubeconfigs), and treat any dependency that reads SSH keys or cloud metadata at install time as hostile by default.<\/p>\n<p>      <a class=\"button\" href=\"https:\/\/www.stepsecurity.io\/blog\/compromised-pypi-mrmustard-0-7-4-credential-stealer\">Read the article<\/a><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin-top:6px;\">Sources: <a href=\"https:\/\/www.stepsecurity.io\/blog\/compromised-pypi-mrmustard-0-7-4-credential-stealer\" style=\"color:#1d4ed8;text-decoration:none;\">StepSecurity (mrmustard \/ PyPI)<\/a>, <a href=\"https:\/\/socket.dev\/blog\/jscrambler-supply-chain-attack\" style=\"color:#1d4ed8;text-decoration:none;\">Socket (jscrambler \/ npm)<\/a>, <a href=\"https:\/\/socket.dev\/blog\/11-malicious-nuget-tools-pose-as-game-cheats\" style=\"color:#1d4ed8;text-decoration:none;\">Socket (malicious NuGet tools)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<p><span class=\"num\">06<\/span><\/p>\n<h4>Patient adversaries: SleeperGem&rsquo;s dormant RubyGems backdoor and North Korea&rsquo;s PolinRider expansion<\/h4>\n<\/p>\n<p class=\"meta\">StepSecurity &amp; Socket &middot; July 1 &ndash; 19, 2026<\/p>\n<p>Two of this week&rsquo;s campaigns stand out for their patience and, in one case, their sponsor. StepSecurity&rsquo;s <strong>SleeperGem<\/strong> research covers compromised RubyGems that don&rsquo;t smash and grab: they install a persistent backdoor and sit quietly, establishing long-term access to the build environments and applications that pull them in. Ruby&rsquo;s registry gets a fraction of the scrutiny npm and PyPI attract, which is precisely why a dormant backdoor there can outlive the incident that would have burned a noisier payload &mdash; the value is in the waiting. Socket&rsquo;s reporting on <strong>PolinRider<\/strong> raises the stakes further: this is a North-Korea-linked supply-chain campaign that is now expanding across multiple open-source ecosystems, part of the DPRK&rsquo;s well-documented pattern of using developer-targeted intrusions to fund the regime and pre-position access. A nation-state actor deliberately seeding packages across ecosystems is a different threat class from opportunistic credential thieves &mdash; the goal is durable, deniable footholds inside the software the rest of the world builds on. The defensive lesson these two share is that point-in-time scanning isn&rsquo;t enough when the adversary&rsquo;s whole strategy is to lie low: teams need dependency provenance and pinning so an unexpected maintainer or version change trips an alarm, plus egress monitoring on build agents so a backdoor phoning home &mdash; even weeks later &mdash; gets noticed. Assume the quiet dependency is the dangerous one.<\/p>\n<p>      <a class=\"button\" href=\"https:\/\/www.stepsecurity.io\/blog\/sleepergem-compromised-rubygems-drop-persistent-backdoor\">Read the article<\/a><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin-top:6px;\">Sources: <a href=\"https:\/\/www.stepsecurity.io\/blog\/sleepergem-compromised-rubygems-drop-persistent-backdoor\" style=\"color:#1d4ed8;text-decoration:none;\">StepSecurity (SleeperGem \/ RubyGems)<\/a>, <a href=\"https:\/\/socket.dev\/blog\/polinrider-north-korea-linked-supply-chain-campaign-expands\" style=\"color:#1d4ed8;text-decoration:none;\">Socket (PolinRider \/ DPRK)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<p><span class=\"num\">07<\/span><\/p>\n<h4>Hardening the pipeline: the Cordyceps GitHub Actions flaw and disciplined security releases<\/h4>\n<\/p>\n<p class=\"meta\">WinBuzzer &amp; Socket &middot; July 6 &ndash; 16, 2026<\/p>\n<p>While the registries burned, the pipeline and the projects that feed it got their own reckoning. WinBuzzer covered <strong>Cordyceps<\/strong>, a GitHub Actions flaw that lets pull requests reach repository secrets and CI\/CD tokens &mdash; the class of misconfiguration where a workflow triggered by an untrusted external PR runs with access to credentials it should never see, handing an attacker who opens a pull request the keys to the build. It is the same lesson AsyncAPI taught last week from a different angle: the CI pipeline is production, and a workflow that mixes untrusted input with privileged tokens is a breach waiting to happen. The fixes are well understood but under-applied &mdash; use <code>pull_request<\/code> rather than <code>pull_request_target<\/code> for untrusted PRs, scope <code>GITHUB_TOKEN<\/code> permissions down to read-only by default, and never expose long-lived secrets to workflows that build fork contributions. On the upstream side, Socket reported two projects bringing process discipline to how fixes ship: Next.js is moving to <em>scheduled<\/em> security releases, giving downstream teams a predictable cadence to plan patching around instead of scrambling for out-of-band drops, and Node.js is weighing a public workflow for security reports as an AI-driven surge in submissions &mdash; many low-quality or machine-generated &mdash; strains its triage capacity. Both are quieter than a worm, but they shape whether the ecosystem can actually absorb and respond to the flood of vulnerabilities the AI era is producing.<\/p>\n<p>      <a class=\"button\" href=\"https:\/\/winbuzzer.com\/2026\/07\/08\/novee-says-cordyceps-can-expose-github-actions-secrets-xcxwbn\/\">Read the article<\/a><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin-top:6px;\">Sources: <a href=\"https:\/\/winbuzzer.com\/2026\/07\/08\/novee-says-cordyceps-can-expose-github-actions-secrets-xcxwbn\/\" style=\"color:#1d4ed8;text-decoration:none;\">WinBuzzer (Cordyceps)<\/a>, <a href=\"https:\/\/socket.dev\/blog\/nextjs-moves-to-scheduled-security-releases\" style=\"color:#1d4ed8;text-decoration:none;\">Socket (Next.js scheduled releases)<\/a>, <a href=\"https:\/\/socket.dev\/blog\/nodejs-considers-public-workflow-for-security-reports\" style=\"color:#1d4ed8;text-decoration:none;\">Socket (Node.js public workflow)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<p><span class=\"num\">10<\/span><\/p>\n<h4>The coding assistant becomes a control point: Cisco&rsquo;s review AI, VS Code&rsquo;s agent host, MCP, and the verification gap<\/h4>\n<\/p>\n<p class=\"meta\">InfoWorld, StepSecurity, TechTimes &middot; July 1 &ndash; 24, 2026<\/p>\n<p>The tooling news this week keeps pulling the AI coding agent deeper into the security perimeter &mdash; as both a defense and a liability. On the defensive side, Cisco released an AI model that tells code reviewers where to look for vulnerabilities, triaging a diff and pointing human reviewers at the spots most likely to hide a flaw rather than trying to auto-fix them &mdash; a pragmatic division of labor that keeps a person in the loop while cutting the review surface. On the platform side, Visual Studio Code 1.129 introduced a dedicated agent host, giving AI coding agents a more isolated, managed runtime inside the editor instead of letting them run loose in the developer&rsquo;s session, and the Model Context Protocol &mdash; the connective standard agents use to reach tools and data &mdash; is going stateless to scale more cleanly, a plumbing change with real security upside since stateless servers carry less to leak or hijack between calls. StepSecurity&rsquo;s Device Policy attacks the governance gap directly, letting organizations enforce an approved list of VS Code extensions across an entire fleet &mdash; closing the door on the malicious-extension vector that mirrors the malicious-package problem one layer up. And TechTimes supplies the reason all of this is urgent: AI coding agents routinely skip package verification, pulling in dependencies without checking provenance or reputation, and attackers are already exploiting that blind trust &mdash; which is exactly how a typosquat or a poisoned package like this week&rsquo;s crop ends up in a build. The pattern across all five: as agents write, review, and pull code, the editor and the protocol they run on become security control points, and the teams that treat them that way &mdash; sandboxed agent hosts, enforced extension policy, verification gates in front of every dependency an agent fetches &mdash; are the ones who get the productivity without inheriting the blast radius.<\/p>\n<p>      <a class=\"button\" href=\"https:\/\/www.infoworld.com\/article\/4200143\/ciscos-new-ai-model-tells-code-reviewers-where-to-look-for-vulnerabilities.html\">Read the article<\/a><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin-top:6px;\">Sources: <a href=\"https:\/\/www.infoworld.com\/article\/4200143\/ciscos-new-ai-model-tells-code-reviewers-where-to-look-for-vulnerabilities.html\" style=\"color:#1d4ed8;text-decoration:none;\">InfoWorld (Cisco review AI)<\/a>, <a href=\"https:\/\/www.infoworld.com\/article\/4199680\/visual-studio-code-1-129-introduces-dedicated-agent-host.html\" style=\"color:#1d4ed8;text-decoration:none;\">InfoWorld (VS Code agent host)<\/a>, <a href=\"https:\/\/www.infoworld.com\/article\/4201254\/model-context-protocol-is-going-stateless-to-make-scaling-simpler.html\" style=\"color:#1d4ed8;text-decoration:none;\">InfoWorld (MCP stateless)<\/a>, <a href=\"https:\/\/www.stepsecurity.io\/blog\/introducing-device-policy-enforce-approved-vs-code-extensions-across-your-fleet\" style=\"color:#1d4ed8;text-decoration:none;\">StepSecurity (Device Policy)<\/a>, <a href=\"https:\/\/www.techtimes.com\/articles\/319457\/20260701\/ai-coding-agents-skip-package-verification-attackers-are-exploiting-it.htm\" style=\"color:#1d4ed8;text-decoration:none;\">TechTimes (package-verification gap)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<p><span class=\"num\">16<\/span><\/p>\n<h4>The platforms fight back with the clock: GitHub\/PyPI time-based defenses and the multi-patch exposure window<\/h4>\n<\/p>\n<p class=\"meta\">BleepingComputer &amp; Help Net Security &middot; July 23 &ndash; 26, 2026<\/p>\n<p>After a week in which every registry took a hit, GitHub and PyPI reached for a defense the worms and typosquats can&rsquo;t easily out-run: time. GitHub added a default <strong>three-day cooldown<\/strong> to Dependabot, so newly published package versions aren&rsquo;t auto-adopted for 72 hours &mdash; long enough for the security tooling that flags malicious npm packages &ldquo;within minutes&rdquo; to matter, since fast detection is useless if your pipeline pulled the bad version in the same minute it shipped. PyPI complemented it by <strong>rejecting new files added to a release after 14 days<\/strong>, shutting the release-poisoning door where an attacker with a stolen publishing token quietly slips a malicious artifact into an old, trusted release nobody is watching anymore. Neither is a silver bullet &mdash; GitHub itself notes the cooldown does nothing against a long-dormant compromise, and still recommends lockfiles, scoped tokens, and disabling install scripts &mdash; but both raise the attacker&rsquo;s cost with almost no burden on legitimate maintainers. Running underneath is a sharper research warning from UT Dallas: <strong>multi-patch fixes<\/strong> leave open source exposed in the gap between the first commit and the last, roughly a third of them take more than a day to fully close, and when the team ran seven detection models against incomplete fixes, accuracy landed <em>below 50% &mdash; worse than guessing<\/em>, because a partial fix looks almost identical to a complete one. The DevSecOps takeaway is to stop treating a linked patch as the end of a vulnerability&rsquo;s life: for high-severity CVEs, check for follow-up commits and confirm the fix reached every affected branch before you call it closed &mdash; and lean into time-and-provenance-based controls, because the ecosystem is converging on them precisely where per-artifact scanning falls short.<\/p>\n<p>      <a class=\"button\" href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/github-pypi-add-time-absed-defenses-against-supply-chain-attacks\/\">Read the article<\/a><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin-top:6px;\">Sources: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/github-pypi-add-time-absed-defenses-against-supply-chain-attacks\/\" style=\"color:#1d4ed8;text-decoration:none;\">BleepingComputer (GitHub\/PyPI time-based defenses)<\/a>, <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/07\/23\/research-multi-patch-vulnerability-fixes\/\" style=\"color:#1d4ed8;text-decoration:none;\">Help Net Security (multi-patch exposure window)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<p><span class=\"num\">18<\/span><\/p>\n<h4>AI floods the humans: bug-bounty cuts, the code-review crunch, and where MCP fits alongside APIs<\/h4>\n<\/p>\n<p class=\"meta\">The Register, The Pragmatic Engineer &amp; The New Stack &middot; July 12 &ndash; 23, 2026<\/p>\n<p>The other half of the AI story this week isn&rsquo;t the attacks &mdash; it&rsquo;s the defenders drowning in AI-generated volume. The Register reported that <strong>GitHub is slashing public bug-bounty payouts<\/strong> as a flood of low-quality, AI-generated vulnerability reports buries its security team; when the cost of producing a plausible-looking report collapses, the economics of a pay-per-valid-bug program invert, and the rational response is to devalue the public queue and lean on curated researchers &mdash; a pattern other programs will likely copy. The Pragmatic Engineer captured the same force from inside engineering orgs: with AI writing far more code since the Opus 4.5 \/ GPT-5.4 step-change, the bottleneck has moved from writing to <strong>reviewing<\/strong>, and leaders are watching reviewers either burn out on &ldquo;AI slop PRs&rdquo; or rubber-stamp changes an AI reviewer didn&rsquo;t flag &mdash; which is how unreviewed code (and unreviewed vulnerabilities) reach main. The emerging answers &mdash; dedicated AI review tools, in-house systems like Uber&rsquo;s Code Inbox with risk profiles, and a shift toward &ldquo;verify, don&rsquo;t review&rdquo; via stronger testing &mdash; are still experiments, not solutions. Against that backdrop, The New Stack&rsquo;s <strong>APIs-vs-MCP<\/strong> piece is the constructive note: rather than replacing deterministic API workflows, the Model Context Protocol earns its place where incident response needs AI to gather and reason over messy context, while APIs stay in charge where you need reliable, repeatable execution. Read together, the three sketch the DevSecOps management problem of the year &mdash; AI has made producing code, reports, and pull requests nearly free, so the scarce resource is trustworthy human (or verified machine) judgment, and the winning teams are the ones redesigning review, triage, and incident workflows around that scarcity instead of asking people to simply absorb more volume.<\/p>\n<p>      <a class=\"button\" href=\"https:\/\/www.theregister.com\/devops\/2026\/07\/23\/github-slashes-public-bug-bounty-payouts-as-ai-report-flood-buries-its-security-team\/5277046\">Read the article<\/a><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin-top:6px;\">Sources: <a href=\"https:\/\/www.theregister.com\/devops\/2026\/07\/23\/github-slashes-public-bug-bounty-payouts-as-ai-report-flood-buries-its-security-team\/5277046\" style=\"color:#1d4ed8;text-decoration:none;\">The Register (GitHub bug-bounty cuts)<\/a>, <a href=\"https:\/\/newsletter.pragmaticengineer.com\/p\/the-pulse-new-trend-concern-about\" style=\"color:#1d4ed8;text-decoration:none;\">The Pragmatic Engineer (code-review load)<\/a>, <a href=\"https:\/\/thenewstack.io\/api-vs-mcp-incident-management\/\" style=\"color:#1d4ed8;text-decoration:none;\">The New Stack (APIs vs MCP)<\/a><\/p>\n<\/p><\/div>\n<h2 class=\"section\">On our watch list<\/h2>\n<ul class=\"watchlist\">\n<li><strong>Shai-Hulud forks into a family.<\/strong> The original worm plus the lighter &ldquo;Miasma&rdquo; variant suggest the self-propagating, credential-harvesting technique is being reused rather than run as one campaign. Watching whether more forks appear, whether registries accelerate trusted-publishing and short-lived-token adoption, and whether the worm jumps from npm into other ecosystems that share developer credentials.<\/li>\n<li><strong>Every registry is now in scope.<\/strong> npm, PyPI, RubyGems, and NuGet all took direct hits in a single week, and lower-scrutiny registries like RubyGems (SleeperGem) are attractive precisely because they get less attention. Watching whether teams extend the same install-time script blocking, provenance checks, and dependency pinning they apply to npm across every language they ship.<\/li>\n<li><strong>Nation-state pre-positioning via open source.<\/strong> PolinRider&rsquo;s expansion shows North-Korea-linked actors deliberately seeding packages across ecosystems for durable, deniable access. Watching whether provenance and maintainer-identity signals mature fast enough to distinguish a legitimate maintainer handoff from a hostile takeover.<\/li>\n<li><strong>The coding agent as an enforced control point.<\/strong> With VS Code&rsquo;s dedicated agent host, a stateless MCP, fleet-wide extension policy, and documented package-verification gaps, the editor and its agents are becoming security boundaries. Watching whether verification-before-fetch and sandboxed agent runtimes become defaults, and whether AI review models like Cisco&rsquo;s measurably shrink the vulnerability-review gap.<\/li>\n<li><strong>Time-based defenses become the new default.<\/strong> GitHub&rsquo;s Dependabot cooldown and PyPI&rsquo;s 14-day release lock bet that <em>waiting<\/em> beats racing malicious publishes. Watching whether other registries (npm, RubyGems, NuGet, crates) adopt cooldowns and release-immutability, and whether the multi-patch research pushes teams to verify a CVE is fully closed across all branches before standing down.<\/li>\n<li><strong>AI volume vs. human judgment.<\/strong> GitHub cutting bug-bounty payouts under an AI-report flood and the soaring code-review load are the same problem from two directions: AI made producing reports and PRs nearly free. Watching whether &ldquo;verify, don&rsquo;t review&rdquo; tooling, AI reviewers, and curated-researcher programs actually restore trustworthy triage &mdash; or just move the bottleneck.<\/li>\n<\/ul><\/div>\n<div class=\"footer\">\n<p class=\"brand\">Security Radar &middot; DevSecOps Weekly<\/p>\n<p>Weekly intelligence bulletin from Security Radar LLC<\/p>\n<p>Curated by Paul Davis &middot; paul.davis@security-radar.com<\/p>\n<p>&copy; 2026 Security Radar LLC. All rights reserved.<\/p>\n<p style=\"margin-top:12px;font-size:12px;color:#94a3b8;\">Article titles and summaries are excerpted for review and commentary; all linked articles remain the copyright of their respective publishers and authors.<\/p>\n<p>*|LIST:ADDRESS|*<\/p>\n<p><a href=\"*|ARCHIVE|*\">View this email in your browser<\/a> &middot; <a href=\"*|UNSUB|*\">Unsubscribe<\/a><\/p>\n<\/p><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Security Radar &middot; Issue 9 DevSecOps Weekly July 26, 2026 &middot; Weekly Edition The Shai-Hulud worm surfaced inside a breach at Suno, a poisoned PyPI package walked off with SSH, cloud, and Kubernetes credentials, and a backdoored RubyGem sat quietly waiting &mdash; every major package registry took a hit this&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,11],"tags":[],"class_list":["post-5545","post","type-post","status-publish","format-standard","hentry","category-secure","category-trends"],"_links":{"self":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/5545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5545"}],"version-history":[{"count":0,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/5545\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5545"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5545"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}