{"id":6243,"date":"2026-11-08T12:17:00","date_gmt":"2026-11-08T17:17:00","guid":{"rendered":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=6243"},"modified":"2026-11-08T12:17:00","modified_gmt":"2026-11-08T17:17:00","slug":"devsecops-weekly-november-8-2026","status":"publish","type":"post","link":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=6243","title":{"rendered":"DevSecOps Weekly &#8212; November 8, 2026"},"content":{"rendered":"<style>\n.single .entry-title,\n.single .entry-header .entry-title,\n.single .post-title,\n.single header.entry-header h1,\n.single h1.entry-title,\n.single .page-title,\n.post-template-default h1.entry-title,\n.post-template-default .entry-header,\narticle .entry-header,\narticle .entry-title { display: none !important; }\n.single .entry-header { margin: 0 !important; padding: 0 !important; }\n.single .entry-content { margin-top: 0 !important; padding-top: 0 !important; }\n<\/style>\n<table role=\"presentation\" class=\"wrapper\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\">\n<tr>\n<td align=\"center\">\n<table role=\"presentation\" class=\"container\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"680\">\n<p>                        <!-- Banner --><\/p>\n<tr>\n<td class=\"banner\" style=\"background-color:#082f49;background:linear-gradient(135deg,#082f49 0%,#0c4a6e 50%,#0891b2 100%);padding:36px 32px;color:#ffffff;\">\n<p class=\"date\" style=\"color:#ffffff !important;\">November 8, 2026 &middot; Weekly Edition<\/p>\n<h1 style=\"color:#ffffff !important;\">DevSecOps Weekly<\/h1>\n<p class=\"tagline\" style=\"color:#ffffff !important;\">Python shipped fixes for a compromised certificate authority within <strong>two days<\/strong>, and PyPI now shows provenance and tampering warnings on every release. A routine desktop-app upgrade quietly rewired two AI coding agents, and a new report finds <strong>99%<\/strong> of repository access tokens never expire. Twenty-six stories.<\/p>\n<\/td>\n<\/tr>\n<p>        <!-- At a glance --><\/p>\n<tr>\n<td class=\"content\">\n<h2>This week at a glance<\/h2>\n<p>The week&#8217;s theme is <strong>trust signals you can actually check<\/strong>. When the eMudhra intermediate certificate authority compromise was published on October 20, the Python ecosystem had fixes out across certifi, CPython, pip, uv, conda and a half-dozen other tools within <strong>two days<\/strong>, including a last-resort denylist in CPython itself (CVE-2026-115557) backported to older releases. A few days later PyPI finished its redesigned project pages. Each release now says whether its files carry publish or SLSA build-provenance attestations, and four new warnings flag incomplete, inconsistent, changed or lost provenance &#8212; patterns that can mean a file did not come from the maintainers. Both depended on outside funding: Alpha-Omega pays for the PSF&#8217;s security role, and the OpenSSF paid for the PyPI redesign.<\/p>\n<p>The second thread is <strong>who controls the coding agent<\/strong>. A developer found that opening the Postman desktop app installed Postman plugins into both Claude Code and OpenAI Codex, and that the installer approved its own session-start hook, a step a direct install leaves to the user. Nothing malicious was shown, which is the point: an ordinary upgrade changed what two agents do without anyone deciding it should. A CSO Online piece asks who approves the instruction, settings and skill files in a repository, a Help Net Security interview sets out an allowlist command policy for agents, and BlueFlag Security reports that <strong>99%<\/strong> of repository access tokens it measured never expire and <strong>68%<\/strong> of the identities agents run under hold admin rights. Google is giving gVisor and its Agent Substrate runtime to the CNCF, a bid to make sandboxed agent execution a shared standard.<\/p>\n<p>The third thread is <strong>fixes are only half the job<\/strong>. The OpenSSF argues that PHP&#8217;s October 21 security release is a milestone, not the finish line, until fixed versions actually reach servers. Amazon engineers described how they cope with the flood of kernel CVEs, and JFrog announced zero-touch remediation that pulls backports and end-of-life patches from several patching vendors into one policy-driven flow. For maintainers, a clear guide explains what the EU Cyber Resilience Act asks of open-source stewards, and Kubescape earned all six OpenSSF Security Slam badges, including one for CRA readiness. Debian, meanwhile, is debating LLM-drafted reviews of incoming packages. Rounding out the issue: Revolut cut AI coding costs by about <strong>90%<\/strong> by self-hosting, and several pieces ask how engineers verify what agents produce.<\/p>\n<div class=\"watchlist\">\n<h2>On our watch list<\/h2>\n<ul>\n<li><strong>gVisor and Agent Substrate at KubeCon North America.<\/strong> Google is donating both to the CNCF at Sandbox level alongside OpenRL, timed to KubeCon in Salt Lake City (November 9-12). Watch which other vendors commit maintainers, and whether agent platforms start naming a user-space kernel or microVM as the default isolation boundary.<\/li>\n<li><strong>Postman&#8217;s answer, and the agent vendors&#8217;.<\/strong> Postman had not responded when the report ran. Watch whether it stops installing plugins on upgrade for existing users, and whether coding-agent vendors stop letting third-party installers write their own hook-trust entries.<\/li>\n<li><strong>How many popular packages show &#8220;No provenance&#8221;.<\/strong> PyPI now surfaces provenance state and four tampering warnings per release. Watch for counts of top projects without attestations, and whether installers and lockfile tools start acting on the same signals.<\/li>\n<li><strong>Certificate-authority incidents in other ecosystems.<\/strong> Python treated eMudhra with a bundle change plus a runtime denylist. Watch whether other language runtimes and container base images follow, and whether browser-style revocation via upki spreads beyond Ubuntu.<\/li>\n<li><strong>Uptake of PHP&#8217;s October 21 fixes.<\/strong> The OpenSSF says the release is not the finish line. Watch for hosting providers and distributions reporting how much of the installed base has moved to fixed versions.<\/li>\n<li><strong>Who supplies the patch.<\/strong> Backports for versions in use, fixes for end-of-life packages and pre-disclosure CVE patches now come from several vendors. Watch whether they converge on shared metadata so policy engines can choose between them and prove which fix shipped.<\/li>\n<li><strong>Debian&#8217;s line on LLM-drafted reviews.<\/strong> The DFSG team&#8217;s use of LLMs for NEW-queue reviews follows August&#8217;s &#8220;Responsible Use of Generative AI&#8221; vote. Watch whether the project sets disclosure or human sign-off rules for LLM-drafted review text.<\/li>\n<li><strong>Steward declarations under the CRA.<\/strong> Manufacturer reporting has applied since September 11, 2026; steward duties start December 11, 2027. Watch for foundations publishing which products they steward and their 24\/72-hour reporting runbooks.<\/li>\n<li><strong>Default token expiry.<\/strong> With 99% of measured repository tokens set never to expire, watch whether source-hosting and CI platforms make expiry the default for new tokens and flag those unused for 90 days.<\/li>\n<li><strong>Self-hosted coding models and their attack surface.<\/strong> Revolut now runs about 2,000 engineers on a self-hosted open-weight model. Watch for more large firms making the same move, and for how they secure the model-serving stack and its gateway once it carries all source code.<\/li>\n<\/ul><\/div>\n<p>            <!-- Topic map --><\/p>\n<div class=\"topic-map\">\n              <img decoding=\"async\" src=\"https:\/\/www.cybersecurityinstitute.com\/blog\/wp-content\/uploads\/2026\/11\/topic-map-devsecops-2026-11-08.png\" alt=\"Topic map of this week's DevSecOps Weekly stories\" loading=\"eager\"><\/p>\n<p class=\"caption\">This week&#8217;s topic map: the Python Software Foundation, the eMudhra compromise and PyPI&#8217;s provenance pages anchor the registry-trust cluster, funded through the OpenSSF and Alpha-Omega. Agent configuration links Postman&#8217;s self-approved hooks, Claude Code and Codex to command allowlists, non-expiring tokens and non-human identities, and on to sandboxing with gVisor, Agent Substrate and the CNCF. Patching ties JFrog&#8217;s zero-touch remediation to the kernel CVE flood and PHP fix uptake, and the EU Cyber Resilience Act sits with open-source stewards, Kubescape and Debian.<\/p>\n<p>              <!-- INTERACTIVE_MAP_LINK_START --><\/p>\n<p style=\"margin:10px 0 0;text-align:center;\"><a href=\"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=6242\" target=\"_blank\" rel=\"noopener\" style=\"display:inline-block;padding:8px 18px;background-color:#0f172a;color:#ffffff !important;text-decoration:none;border-radius:6px;font-size:13px;font-weight:600;\">View interactive topic map &rarr;<\/a><\/p>\n<p><!-- INTERACTIVE_MAP_LINK_END -->\n            <\/div>\n<p>            <!-- Article index --><\/p>\n<h2>Article index<\/h2>\n<h3>Package registries and trust signals<\/h3>\n<div class=\"cluster-intro\">A certificate-authority compromise fixed across the Python toolchain in two days, and project pages that now tell you whether a release can prove where it came from.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>1. <a href=\"https:\/\/pyfound.blogspot.com\/2026\/11\/how-python-ecosystem-responded-to.html\">How the Python ecosystem responded to the eMudhra intermediate compromise<\/a><\/td>\n<td class=\"src\">Python Software Foundation<\/td>\n<td class=\"dt\">Nov 5, 2026<\/td>\n<\/tr>\n<tr>\n<td>2. <a href=\"https:\/\/blog.pypi.org\/posts\/2026-11-06-ui-updates-complete\/\">PyPI&#x27;s redesigned project pages with clearer security signals are now live<\/a><\/td>\n<td class=\"src\">PyPI Blog<\/td>\n<td class=\"dt\">Nov 6, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Patching at volume<\/h3>\n<div class=\"cluster-intro\">Kernel CVEs at a pace that tests every downstream user, a fix supply that now spans several patching vendors, and a reminder that a security release only helps once it is installed.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>3. <a href=\"https:\/\/lwn.net\/Articles\/1100894\/\">Managing the kernel CVE flood<\/a><\/td>\n<td class=\"src\">LWN.net<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Subscriber<\/span><\/td>\n<td class=\"dt\">Nov 2, 2026<\/td>\n<\/tr>\n<tr>\n<td>4. <a href=\"https:\/\/www.businesswire.com\/news\/home\/20261103903338\/en\/JFrog-Closes-the-Patching-Gap-with-Universal-Zero-Touch-Remediation-Bringing-Leading-Patching-Vendors-into-One-Source-of-Truth\">JFrog Closes the Patching Gap with Universal Zero-Touch Remediation, Bringing Leading Patching Vendors into One Source of Truth<\/a><\/td>\n<td class=\"src\">Business Wire<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Press release<\/span><\/td>\n<td class=\"dt\">Nov 3, 2026<\/td>\n<\/tr>\n<tr>\n<td>5. <a href=\"https:\/\/openssf.org\/blog\/2026\/11\/03\/the-php-security-wake-up-call-fixes-are-only-the-beginning\/\">The PHP Security Wake-Up Call: Fixes Are Only the Beginning<\/a><\/td>\n<td class=\"src\">OpenSSF<\/td>\n<td class=\"dt\">Nov 3, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Open-source governance, maintainers and the CRA<\/h3>\n<div class=\"cluster-intro\">Debian argues over LLM-drafted package reviews, Kubescape earns every Security Slam badge including CRA readiness, and a clear guide to what the Cyber Resilience Act asks of open-source stewards.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>6. <a href=\"https:\/\/lwn.net\/Articles\/1103674\/\">LLM reviews for Debian&#x27;s new queue spark debate<\/a><\/td>\n<td class=\"src\">LWN.net<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Subscriber<\/span><\/td>\n<td class=\"dt\">Nov 3, 2026<\/td>\n<\/tr>\n<tr>\n<td>7. <a href=\"https:\/\/openssf.org\/blog\/2026\/11\/05\/case-study-kubescape-completes-all-six-security-slam-badges-with-openssf\/\">Case Study: Kubescape Completes All Six Security Slam Badges with OpenSSF<\/a><\/td>\n<td class=\"src\">OpenSSF<\/td>\n<td class=\"dt\">Nov 5, 2026<\/td>\n<\/tr>\n<tr>\n<td>8. <a href=\"https:\/\/www.barryodonovan.com\/2026\/11\/07\/the-cyber-resilience-act-and-open-source\">The Cyber Resilience Act and Open Source: What Maintainers Need to Know<\/a><\/td>\n<td class=\"src\">Barry O&#8217;Donovan<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Blog<\/span><\/td>\n<td class=\"dt\">Nov 7, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Tokens and non-human identities<\/h3>\n<div class=\"cluster-intro\">Machine identities now far outnumber people with repository access, and almost none of their tokens expire.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>9. <a href=\"https:\/\/www.techtarget.com\/news\/non-human-identities-pose-big-risks-cybersecurity-pros-warn\/873822\/\">Non-human identities pose big risks, cybersecurity pros warn<\/a><\/td>\n<td class=\"src\">TechTarget<\/td>\n<td class=\"dt\">Nov 4, 2026<\/td>\n<\/tr>\n<tr>\n<td>10. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/11\/06\/blueflag-ai-agents-access-risks-report\/\">99% of repository access tokens never expire<\/a><\/td>\n<td class=\"src\">Help Net Security<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Vendor research<\/span><\/td>\n<td class=\"dt\">Nov 6, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Who controls the coding agent<\/h3>\n<div class=\"cluster-intro\">An app upgrade that rewired two coding agents, the files that steer agents and who should approve them, allowlist command policies, and sandboxes built so a prompt is never the only boundary.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>11. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/11\/02\/vinay-thakker-kloudstax-ai-agent-access-control\/\">The first ten lines of a command policy for AI coding agents<\/a><\/td>\n<td class=\"src\">Help Net Security<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Vendor interview<\/span><\/td>\n<td class=\"dt\">Nov 2, 2026<\/td>\n<\/tr>\n<tr>\n<td>12. <a href=\"https:\/\/thenewstack.io\/postman-plugin-coding-agents\/\">A developer opened Postman. Then two AI coding agents changed without their permission.<\/a><\/td>\n<td class=\"src\">The New Stack<\/td>\n<td class=\"dt\">Nov 3, 2026<\/td>\n<\/tr>\n<tr>\n<td>13. <a href=\"https:\/\/www.csoonline.com\/article\/4242707\/who-approves-the-files-that-control-your-ai-coding-assistant.html\">Who approves the files that control your AI coding assistant?<\/a><\/td>\n<td class=\"src\">CSO Online<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Opinion<\/span><\/td>\n<td class=\"dt\">Nov 2, 2026<\/td>\n<\/tr>\n<tr>\n<td>14. <a href=\"https:\/\/devops.com\/your-coding-agent-needs-production-discipline\">Your Coding Agent Needs Production Discipline<\/a><\/td>\n<td class=\"src\">DevOps.com<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Vendor-contributed<\/span><\/td>\n<td class=\"dt\">Nov 2, 2026<\/td>\n<\/tr>\n<tr>\n<td>15. <a href=\"https:\/\/devops.com\/the-agent-did-exactly-what-we-let-it-do\/\">The Agent Did Exactly What We Let It Do<\/a><\/td>\n<td class=\"src\">DevOps.com<\/td>\n<td class=\"dt\">Nov 6, 2026<\/td>\n<\/tr>\n<tr>\n<td>16. <a href=\"https:\/\/thenewstack.io\/gvisor-cncf-kubernetes-open-source\/\">Kubernetes, mark II? Why Google&#x27;s giving away gVisor, a code sandbox used by Anthropic and OpenAI<\/a><\/td>\n<td class=\"src\">The New Stack<\/td>\n<td class=\"dt\">Nov 6, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Engineering at agent speed<\/h3>\n<div class=\"cluster-intro\">Self-hosted models that make tokens cheap, a Git backend rebuilt for agent commit volume, parallel agents that need orchestration, and engineers redesigning the line rather than writing every change.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>17. <a href=\"https:\/\/www.theregister.com\/ai-and-ml\/2026\/11\/03\/british-fintech-revolut-slashes-ai-coding-costs-10x-by-cutting-out-claude-and-going-self-hosted\/5307345\">British fintech Revolut slashes AI coding costs 10x by cutting out Claude and going self-hosted<\/a><\/td>\n<td class=\"src\">The Register<\/td>\n<td class=\"dt\">Nov 3, 2026<\/td>\n<\/tr>\n<tr>\n<td>18. <a href=\"https:\/\/devops.com\/godfather-of-devops-advises-software-engineers-to-brace-for-agentic-ai-impact\">Godfather of DevOps Advises Software Engineers to Brace for Agentic AI Impact<\/a><\/td>\n<td class=\"src\">DevOps.com<\/td>\n<td class=\"dt\">Nov 3, 2026<\/td>\n<\/tr>\n<tr>\n<td>19. <a href=\"https:\/\/thenewstack.io\/openai-pando-git-backend\/\">OpenAI built itself a new Git backend, too<\/a><\/td>\n<td class=\"src\">The New Stack<\/td>\n<td class=\"dt\">Nov 3, 2026<\/td>\n<\/tr>\n<tr>\n<td>20. <a href=\"https:\/\/www.businessinsider.com\/anthropic-engineer-addy-osmani-cognitive-surrender-warning-2026-11\">An Anthropic engineer warns about &#x27;cognitive surrender&#x27; as AI agents take over his work<\/a><\/td>\n<td class=\"src\">Business Insider<\/td>\n<td class=\"dt\">Nov 5, 2026<\/td>\n<\/tr>\n<tr>\n<td>21. <a href=\"https:\/\/newsletter.pragmaticengineer.com\/p\/how-software-engineering-is-changing\">How software engineering is changing: a tale of two eras<\/a><\/td>\n<td class=\"src\">The Pragmatic Engineer<\/td>\n<td class=\"dt\">Nov 3, 2026<\/td>\n<\/tr>\n<tr>\n<td>22. <a href=\"https:\/\/thenewstack.io\/engineers-become-process-engineers\/\">In the software factory, engineers become process engineers<\/a><\/td>\n<td class=\"src\">The New Stack<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Vendor-contributed<\/span><\/td>\n<td class=\"dt\">Nov 7, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Verifying what agents produce<\/h3>\n<div class=\"cluster-intro\">Layered release defences for AI-written code, agents that sway their users, metrics that miss most failures, and SQL that is correct but not authorised.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>23. <a href=\"https:\/\/www.infoq.com\/news\/2026\/11\/grab-ai-generated-code-safety\/\">How Grab Improved Mobile App Stability by Safely Handling Surge in AI-Generated Code Changes<\/a><\/td>\n<td class=\"src\">InfoQ<\/td>\n<td class=\"dt\">Nov 7, 2026<\/td>\n<\/tr>\n<tr>\n<td>24. <a href=\"https:\/\/www.infoworld.com\/article\/4242958\/influencing-the-agents.html\">Influencing the agents<\/a><\/td>\n<td class=\"src\">InfoWorld<br \/><span style=\"font-size:11px;color:#94a3b8;text-transform:none;letter-spacing:0;\">Opinion<\/span><\/td>\n<td class=\"dt\">Nov 3, 2026<\/td>\n<\/tr>\n<tr>\n<td>25. <a href=\"https:\/\/thenewstack.io\/monitoring-production-ai-agents\/\">I broke a working agent seven ways. The metric I was watching caught two of them.<\/a><\/td>\n<td class=\"src\">The New Stack<\/td>\n<td class=\"dt\">Nov 5, 2026<\/td>\n<\/tr>\n<tr>\n<td>26. <a href=\"https:\/\/www.infoworld.com\/article\/4244721\/your-llm-writes-good-sql-thats-not-the-same-as-safe-sql.html\">Your LLM writes good SQL. That&#x27;s not the same as safe SQL<\/a><\/td>\n<td class=\"src\">InfoWorld<\/td>\n<td class=\"dt\">Nov 5, 2026<\/td>\n<\/tr>\n<\/table>\n<p>            <!-- Detailed write-ups --><\/p>\n<h2>Detailed write-ups<\/h2>\n<div class=\"article\">\n<h4>1. Python patched a compromised certificate authority in two days<\/h4>\n<p class=\"meta\">Python Software Foundation &middot; November 5, 2026<\/p>\n<p>When the compromise of eMudhra intermediate certificates was published on <strong>October 20<\/strong>, the Python Software Foundation&#8217;s Security Developer-in-Residence, Seth Larson, was on standby and started work at once. The role is funded by Alpha-Omega. Within <strong>two days<\/strong> the ecosystem had mitigations out across certifi, CPython, pip, uv, sigstore, virtualenv, conda, pixi, manylinux and the PyPI publishing action.<\/p>\n<p>The fixes came in two layers. certifi, the certificate bundle most Python HTTP clients rely on, removed the &#8220;emSign Root TLS CA &#8211; G3&#8221; root so the affected intermediates are no longer trusted (advisory GHSA-6q48-6c7w-9gw2). CPython added a <strong>last-resort denylist<\/strong> that rejects the compromised intermediates during the TLS handshake even if an older bundle is still in place. It is tracked as <strong>CVE-2026-115557<\/strong> and was backported to older Python versions. Larson also points to upki, a project that brings browser-style certificate revocation to other software and has been adopted by Ubuntu.<\/p>\n<p>For DevSecOps teams, the lesson is about where trust stores hide. certifi is often pinned inside containers, serverless bundles and vendored virtual environments that never see a routine upgrade. A runtime denylist covers some of that, but only once the interpreter itself is updated. Treat a CA compromise like any other dependency CVE: find every copy of the bundle and every interpreter version in your images, and rebuild them.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/pyfound.blogspot.com\/2026\/11\/how-python-ecosystem-responded-to.html\">https:\/\/pyfound.blogspot.com\/2026\/11\/how-python-ecosystem-responded-to.html<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>2. PyPI now shows whether a release can prove where it came from<\/h4>\n<p class=\"meta\">PyPI Blog &middot; November 6, 2026<\/p>\n<p>PyPI has finished redesigning its project pages around security signals. Each release now shows its <strong>provenance state<\/strong>. &#8220;Full provenance&#8221; means every file carries an attestation, and &#8220;No provenance&#8221; means none do, which is typical of older releases and projects that have not set up Trusted Publishing. Two attestation types are recognised: PyPI Publish attestations, which confirm a Trusted Publisher uploaded the file, and <strong>SLSA Build Provenance<\/strong> attestations, which tie the file to its source commit, build platform and build instructions.<\/p>\n<p>Four new warnings flag patterns that may mean a file did not come from the maintainers: <strong>incomplete, inconsistent, changed and lost provenance<\/strong>. Late-file warnings mark files uploaded more than <strong>14 days<\/strong> after a release first appeared, for releases before the 14-day rule took effect in July 2026. A Release history tab shows each release&#8217;s file count, provenance and status (quarantined, yanked, archived or pre-release), and a quarantine banner overrides everything else. The work was funded by the OpenSSF and follows its Attestations Style Guide.<\/p>\n<p>PyPI is careful not to overclaim. <strong>&#8220;No provenance does not necessarily indicate that a release or release file is malicious,&#8221;<\/strong> writes Nicole Harris. The value is in change. A project that had provenance and then loses it, or whose builder changes between releases, is exactly what a reviewer should ask about before taking an upgrade. If you publish Python packages, turn on Trusted Publishing so your own releases show full provenance.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/blog.pypi.org\/posts\/2026-11-06-ui-updates-complete\/\">https:\/\/blog.pypi.org\/posts\/2026-11-06-ui-updates-complete\/<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>3. A desktop-app upgrade quietly rewired two coding agents<\/h4>\n<p class=\"meta\">The New Stack &middot; November 3, 2026 &middot; CSO Online &middot; November 2, 2026 &middot; Help Net Security &middot; November 2, 2026<\/p>\n<p>A developer reported on <strong>October 25<\/strong> that opening Postman desktop 12.33.4 on macOS had installed Postman plugins into both Claude Code and OpenAI Codex without asking. Postman&#8217;s own logs show an install event on October 24 marked &#8220;auto-existing-upgrade&#8221;. Codex&#8217;s user configuration gained an enabled Postman plugin, a new plugin marketplace and a <strong>trusted session-start hook<\/strong> that tells Codex to load Postman&#8217;s API-engineering skill before most API tasks. A Postman command-line tool appeared with matching timestamps, and a connection to Postman&#8217;s remote MCP server was configured but kept failing to authenticate.<\/p>\n<p>The detail that drew the most criticism is that Postman&#8217;s installer can write the hook&#8217;s trusted hash into Codex&#8217;s configuration itself, while a developer installing the same plugin through Codex has to review and approve it. The report covers one machine and has not been independently reproduced, and it shows no evidence of data being collected. The New Stack had no reply from Postman at publication. One commenter on the issue called the behaviour <strong>&#8220;unacceptable, even creating risk in corporate environment.&#8221;<\/strong><\/p>\n<p>Two other pieces this week explain why this matters beyond one vendor. A CSO Online contributor lists the files that now steer agents in a repository &#8212; Markdown instructions, JSON settings that can register shell commands, skill files and agent settings &#8212; and notes that a skill&#8217;s allowed-tools field can skip permission prompts, while repository hooks can run in non-interactive sessions without a trust dialog. Code-owner rules only help if branch protection requires them and the ownership file is itself protected. <strong>&#8220;The first reliable checkpoint is the pull request, and it needs a person who knows what the file can trigger.&#8221;<\/strong> In a Help Net Security interview, KloudStax CTO Vinay Thakker sets out the first lines of an agent command policy: an allowlist, one repository in a disposable environment, approved build, test and read-only git commands, no credentials, and network access only to an internal package mirror and named hosts, all enforced by the harness. <strong>&#8220;Never hand an agent a long-lived secret.&#8221;<\/strong><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/thenewstack.io\/postman-plugin-coding-agents\/\">https:\/\/thenewstack.io\/postman-plugin-coding-agents\/<\/a>, <a href=\"https:\/\/www.csoonline.com\/article\/4242707\/who-approves-the-files-that-control-your-ai-coding-assistant.html\">https:\/\/www.csoonline.com\/article\/4242707\/who-approves-the-files-that-control-your-ai-coding-assistant.html<\/a>, <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/11\/02\/vinay-thakker-kloudstax-ai-agent-access-control\/\">https:\/\/www.helpnetsecurity.com\/2026\/11\/02\/vinay-thakker-kloudstax-ai-agent-access-control\/<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>4. Ninety-nine percent of repository tokens never expire<\/h4>\n<p class=\"meta\">Help Net Security &middot; November 6, 2026 &middot; TechTarget &middot; November 4, 2026<\/p>\n<p>BlueFlag Security&#8217;s State of Developer Risk 2026 report, covered by Help Net Security, finds that <strong>99%<\/strong> of the repository access tokens it measured had no expiry date. <strong>84%<\/strong> allowed code changes, and <strong>47%<\/strong> had gone unused for more than 90 days without being revoked. The average developer had not used <strong>61%<\/strong> of their granted permissions, and non-human identities with repository access outnumbered human developers <strong>eight to one<\/strong>.<\/p>\n<p>AI agents make the picture sharper. Unapproved agents were present in <strong>83%<\/strong> of organisations, which typically use about seven AI coding tools. <strong>68%<\/strong> of the developer and service identities agents ran under held administrator rights, and <strong>81%<\/strong> had no behavioural monitoring. Four in ten repositories had unprotected main branches, administrators bypassed code review in four of five organisations, and private repositories had become public in <strong>28%<\/strong>. The report gives no sample size, so treat the percentages as directional. BlueFlag sells developer-identity security, and calls these tokens <strong>&#8220;the most powerful identities in the environment.&#8221;<\/strong><\/p>\n<p>At ISC2 Security Congress, Southwest Airlines&#8217; Dhivya Balasubramanian and Vikas Gattu walked through a six-stage attack chain for non-human identities: discover, expose, acquire, exploit, escalate and persist. Their example was the March 2025 compromise of a widely used third-party CI action, used in more than 23,000 repositories, which leaked secrets into public workflow logs after an attacker stole a bot&#8217;s token in an earlier breach. Gattu&#8217;s advice is to find tokens older than 90 days and replace long-lived tokens with short-lived credentials. Balasubramanian added: <strong>&#8220;Please do not let your AI agents impersonate human or non-human identities.&#8221;<\/strong><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/11\/06\/blueflag-ai-agents-access-risks-report\/\">https:\/\/www.helpnetsecurity.com\/2026\/11\/06\/blueflag-ai-agents-access-risks-report\/<\/a>, <a href=\"https:\/\/www.techtarget.com\/news\/non-human-identities-pose-big-risks-cybersecurity-pros-warn\/873822\/\">https:\/\/www.techtarget.com\/news\/non-human-identities-pose-big-risks-cybersecurity-pros-warn\/873822\/<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>5. Google gives its agent sandbox to the CNCF<\/h4>\n<p class=\"meta\">The New Stack &middot; November 6, 2026 &middot; DevOps.com &middot; November 2, 2026 &middot; DevOps.com &middot; November 6, 2026<\/p>\n<p>Google is donating <strong>gVisor<\/strong>, <strong>Agent Substrate<\/strong> and <strong>OpenRL<\/strong> to the Cloud Native Computing Foundation at Sandbox level, timed to KubeCon North America in Salt Lake City. The New Stack frames it as an attempt to repeat the Kubernetes playbook for AI agents, and notes that gVisor is already used by Anthropic and OpenAI. gVisor is an application kernel written in Go that intercepts system calls in user space, so untrusted code never talks to the host kernel directly. Agent Substrate, now at 1.0, adds a control and data plane on top of Kubernetes for stateful agents. With gVisor it can freeze a running environment and restore it on another node in under <strong>500 milliseconds<\/strong>, and it supports microVMs for workloads that need hardware virtualisation.<\/p>\n<p>Google&#8217;s pitch is a neutral, three-layer stack &#8212; isolation, agent runtime, training orchestration &#8212; that runs on any conformant cluster. <strong>&#8220;Without a shared open standard, every organization ends up building custom schedulers on top of VMs or working around Kubernetes,&#8221;<\/strong> its announcement says. For security teams, the useful part is that the isolation boundary becomes infrastructure rather than a promise in a prompt.<\/p>\n<p>Two DevOps.com pieces describe what should wrap that boundary. Leon Kuperman of CAST AI argues that an agent&#8217;s environment should be defined in code and reviewed like a pipeline, with its own workload identity separate from the engineer&#8217;s login, short-lived scoped credentials, egress limits, and caps on runtime, retries and spend. The deployment pipeline, not the agent, promotes the result: <strong>&#8220;The agent does not need production credentials to implement a feature.&#8221;<\/strong> Igboanugo David Ugochukwu lines up agent incidents since mid-2025 &#8212; a production database deleted during a declared code freeze, malware that drove installed AI command-line tools to hunt for secrets (2,349 leaked), and a Terraform destroy run against the wrong state file &#8212; and finds the same cause each time. <strong>&#8220;A code freeze written in a prompt is a suggestion. A freeze enforced by credentials is a fact.&#8221;<\/strong><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/thenewstack.io\/gvisor-cncf-kubernetes-open-source\/\">https:\/\/thenewstack.io\/gvisor-cncf-kubernetes-open-source\/<\/a>, <a href=\"https:\/\/devops.com\/your-coding-agent-needs-production-discipline\">https:\/\/devops.com\/your-coding-agent-needs-production-discipline<\/a>, <a href=\"https:\/\/devops.com\/the-agent-did-exactly-what-we-let-it-do\/\">https:\/\/devops.com\/the-agent-did-exactly-what-we-let-it-do\/<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>6. The patching gap: more fixes, from more places<\/h4>\n<p class=\"meta\">Business Wire &middot; November 3, 2026 &middot; LWN.net &middot; November 2, 2026<\/p>\n<p>At swampUP Europe, JFrog convened a panel of patching vendors, including Red Hat, Broadcom and Echo, on what it calls the <strong>patching gap<\/strong>: the time between a fix existing somewhere and a fix running in your build. The panel described three kinds of patch now on offer from open-source patching vendors: <strong>backports<\/strong> to versions customers already run, patches for <strong>end-of-life packages<\/strong>, and <strong>CVE-only patches<\/strong> released before public disclosure. Each solves a real problem, and together they mean the same CVE can have several valid fixes from different suppliers.<\/p>\n<p>JFrog&#8217;s answer is Universal Zero-Touch Remediation. The artifact repository ingests fixes from partner vendors for binaries, containers, AI models and MCP servers. JFrog Security applies the fix a customer&#8217;s policy prefers and records a <strong>signed evidence chain<\/strong> auditors can verify, with evidence mapped to frameworks such as DORA and the EU Cyber Resilience Act. JFrog says this cuts patching from days to hours. <strong>&#8220;Having a single source of truth is essential for protection in today&#8217;s AI threat landscape,&#8221;<\/strong> said Nico Thirion, JFrog&#8217;s field CISO. No availability date was given.<\/p>\n<p>The kernel shows why the policy question matters. At the 2026 Linux Plumbers Conference, Amazon engineers Dylan Johnson and Justinien Bouron described keeping AWS running and secure through a storm of kernel CVE disclosures. LWN&#8217;s write-up, subscriber-only until next week, notes that the kernel community&#8217;s long-standing advice is to run current kernels, <strong>&#8220;and that turns out to work &#8212; sort of.&#8221;<\/strong> Whether you upgrade, take a vendor backport or accept the risk, decide by policy and keep a record of which fix shipped.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.businesswire.com\/news\/home\/20261103903338\/en\/JFrog-Closes-the-Patching-Gap-with-Universal-Zero-Touch-Remediation-Bringing-Leading-Patching-Vendors-into-One-Source-of-Truth\">https:\/\/www.businesswire.com\/news\/home\/20261103903338\/en\/JFrog-Closes-the-Patching-Gap-with-Universal-Zero-Touch-Remediation-Bringing-Leading-Patching-Vendors-into-One-Source-of-Truth<\/a>, <a href=\"https:\/\/lwn.net\/Articles\/1100894\/\">https:\/\/lwn.net\/Articles\/1100894\/<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>7. A security release is not the finish line<\/h4>\n<p class=\"meta\">OpenSSF &middot; November 3, 2026 &middot; LWN.net &middot; November 3, 2026<\/p>\n<p>PHP runs on about <strong>70%<\/strong> of websites whose server-side language is known. On <strong>October 21<\/strong> the project shipped fixes for two critical vulnerabilities that could let unauthenticated attackers execute code on some servers. Writing on the OpenSSF blog, Jeff Borek and Mike Linksvayer note that a 2024 audit funded by Germany&#8217;s Sovereign Tech Agency led to follow-up work that found early signs of the problem behind one of them, and that the PHP Foundation has acknowledged resource limits and weaknesses in its decision-making. Funded engineers made the remediation possible.<\/p>\n<p>Their point is that disclosure and release are only the start. The OpenSSF named accelerating uptake of fixed components as its first priority back in 2023, and Alpha-Omega funds this kind of sustained work in critical projects. <strong>&#8220;A coordinated security release is a critical milestone. It is not the finish line.&#8221;<\/strong> The OpenSSF&#8217;s new guide to finding and fixing vulnerabilities with AI is offered as one way to keep up, and it plans a policy summit in Washington in spring 2027.<\/p>\n<p>Debian is working through a related question about who does review work. After an August general resolution chose &#8220;Responsible Use of Generative AI&#8221;, the relatively new DFSG, Licensing &amp; New Packages team began using LLMs to draft reviews of packages entering the NEW queue. LWN reports objections and questions about where the lines should be drawn on LLM-generated output. The details are subscriber-only until next week, but the debate is one every project that gates incoming code will face.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/openssf.org\/blog\/2026\/11\/03\/the-php-security-wake-up-call-fixes-are-only-the-beginning\/\">https:\/\/openssf.org\/blog\/2026\/11\/03\/the-php-security-wake-up-call-fixes-are-only-the-beginning\/<\/a>, <a href=\"https:\/\/lwn.net\/Articles\/1103674\/\">https:\/\/lwn.net\/Articles\/1103674\/<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>8. What the Cyber Resilience Act asks of open-source maintainers<\/h4>\n<p class=\"meta\">Barry O&#8217;Donovan &middot; November 7, 2026 &middot; OpenSSF &middot; November 5, 2026<\/p>\n<p>Barry O&#8217;Donovan&#8217;s guide is one of the clearest short reads on the CRA for maintainers. Regulation (EU) 2024\/2847 applies directly in every member state. Manufacturer vulnerability and incident reporting began on <strong>September 11, 2026<\/strong>, and full application, including limited duties for open-source stewards, starts on <strong>December 11, 2027<\/strong>. Individual developers publishing open source are almost certainly outside it. Hosting code or publishing to a package registry does not, by itself, place software on the market.<\/p>\n<p>A <strong>steward<\/strong> is a legal person, never an individual, that sustainably supports free software intended for commercial use without monetising it. Status is decided per product, and monetising the software makes you a manufacturer with full obligations. Stewards must keep a cybersecurity policy, cooperate with market surveillance authorities and, from December 2027, report actively exploited vulnerabilities and severe incidents on infrastructure they provide: an early warning within <strong>24 hours<\/strong>, a notification within <strong>72 hours<\/strong>, and a final report within 14 days of a fix. Stewards cannot be fined, while manufacturers face up to <strong>&#8364;15 million or 2.5%<\/strong> of worldwide turnover. <strong>&#8220;It&#8217;s a recognition that non-profit foundations are different from commercial vendors.&#8221;<\/strong><\/p>\n<p>Kubescape shows what preparation looks like in practice. During the OpenSSF Fall 2026 Security Slam (October 5 to November 6) it earned all six project badges, including a new <strong>CRA Readiness<\/strong> badge for stewardship and escalation documentation. About 45 Slam pull requests were merged across 12 repositories, five core repositories adopted Security Insights files and weekly baseline scans, and more than ten pinned their CI actions and tightened workflow permissions. Roughly 25-30 maintainer hours of guidance unlocked 125-150 community hours. Maintainer Matthias Bertschy called the framework <strong>&#8220;a clear, machine-verifiable blueprint to elevate security across the Kubescape ecosystem.&#8221;<\/strong><\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.barryodonovan.com\/2026\/11\/07\/the-cyber-resilience-act-and-open-source\">https:\/\/www.barryodonovan.com\/2026\/11\/07\/the-cyber-resilience-act-and-open-source<\/a>, <a href=\"https:\/\/openssf.org\/blog\/2026\/11\/05\/case-study-kubescape-completes-all-six-security-slam-badges-with-openssf\/\">https:\/\/openssf.org\/blog\/2026\/11\/05\/case-study-kubescape-completes-all-six-security-slam-badges-with-openssf\/<\/a><\/p>\n<\/p><\/div>\n<p>            <!-- Calls to action --><\/p>\n<div class=\"watchlist\">\n<h2>Calls to action<\/h2>\n<ul>\n<li><strong>Find every copy of certifi and every Python interpreter in your images.<\/strong> Rebuild containers, serverless bundles and vendored environments with the certifi release that drops the emSign root and a CPython build that includes the CVE-2026-115557 denylist.<\/li>\n<li><strong>Turn on Trusted Publishing and attestations for every package you publish to PyPI.<\/strong> Before taking an upgrade of a dependency, check its provenance state and treat a change or loss of provenance as a reason to stop and ask.<\/li>\n<li><strong>Audit agent configuration on developer machines this week.<\/strong> Read ~\/.codex\/config.toml and Claude Code&#8217;s settings and plugin list, and remove any plugin, hook, skill or MCP server nobody chose to install.<\/li>\n<li><strong>Put agent instruction, settings, hook and skill files under required owner review.<\/strong> Enforce it with branch protection, protect the ownership file itself, and extend review to the scripts those files call.<\/li>\n<li><strong>Set an expiry on every repository token.<\/strong> Revoke tokens unused for 90 days, replace long-lived tokens with short-lived credentials, and give each agent its own identity with only the permissions one job needs.<\/li>\n<li><strong>Write your agent command policy as an allowlist the harness enforces.<\/strong> One repository in a disposable environment, approved build and test commands only, no long-lived secrets, and network access limited to your package mirror and named hosts.<\/li>\n<li><strong>Run agent-executed code inside a real isolation boundary.<\/strong> Use a user-space kernel or microVM sandbox, cap runtime, retries and spend, and let the pipeline &#8212; not the agent &#8212; promote anything to production.<\/li>\n<li><strong>Decide by policy which fix wins for each package.<\/strong> Choose between upstream upgrade, distribution backport and end-of-life patch, and keep signed evidence of which fix shipped in each build.<\/li>\n<li><strong>Confirm your PHP servers run the October 21 fixed releases.<\/strong> Check base images and hosting tiers, not just the versions in your lockfiles.<\/li>\n<li><strong>If a foundation you work with supports open source, decide whether it is a CRA steward.<\/strong> Write the cybersecurity policy now and draft a 24-hour and 72-hour reporting runbook before December 2027.<\/li>\n<\/ul><\/div>\n<\/td>\n<\/tr>\n<p>        <!-- Footer --><\/p>\n<tr>\n<td class=\"footer\">\n<p class=\"brand\">DevSecOps Weekly<\/p>\n<p>A weekly intelligence bulletin from Security Radar LLC.<br \/>\n            Curated by Paul Davis &middot; <a href=\"mailto:paul.davis@security-radar.com\">paul.davis@security-radar.com<\/a><\/p>\n<p>&copy; 2026 Security Radar LLC. All rights reserved.<\/p>\n<p>Article titles and summaries are excerpted for review and commentary; all linked articles remain the copyright of their respective publishers and authors.<\/p>\n<p>*|LIST:ADDRESS|*<\/p>\n<p><a href=\"*|ARCHIVE|*\">View this email in your browser<\/a> &middot; <a href=\"*|UNSUB|*\">Unsubscribe<\/a><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>November 8, 2026 &middot; Weekly Edition DevSecOps Weekly Python shipped fixes for a compromised certificate authority within two days, and PyPI now shows provenance and tampering warnings on every release. A routine desktop-app upgrade quietly rewired two AI coding agents, and a new report finds 99% of repository access tokens&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,11],"tags":[],"class_list":["post-6243","post","type-post","status-publish","format-standard","hentry","category-secure","category-trends"],"_links":{"self":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6243"}],"version-history":[{"count":1,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6243\/revisions"}],"predecessor-version":[{"id":6258,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6243\/revisions\/6258"}],"wp:attachment":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}