# supply-chain-security Cybersecurity discipline focused on securing software supply-chain operations and artifacts. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## SymfonyCon Warsaw 2026: The Attack Reached PHP: Composer and Packagist, One Year On DevFeed: [SymfonyCon Warsaw 2026: The Attack Reached PHP: Composer and Packagist, One Year On]() Original publisher: [Read original article]() Author: Eloïse Charrier Published: 2026-09-16T12:30:00Z Content type: article Language: en Sources: [Symfony Blog]() Topics: [Symfony](), [Composer](), [PHP](), [supply-chain-security](), [Security]() Tags: [2026](), [composer](), [conference](), [github](), [php](), [supply-chain-security](), [symfony]() ### AI overview SymfonyCon Warsaw 2026 will take place in Poland on November 26-27, with talks across three parallel tracks and related community events. The announcement highlights a talk about PHP supply-chain security changes made after attacks involving Composer and Packagist, including malware detection, transparency logging, dependency policies, immutable releases, release-age settings, maintainer MFA status, and ownership controls. ### Source excerpt Get ready to connect with the global Symfony community! SymfonyCon Warsaw 2026 is landing in Poland, on November 26-27. We are bringing you two days of inspiring talks across 3 parallel tracks, alongside plenty of networking opportunities and vibrant... ## CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks DevFeed: [CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks]() Original publisher: [Read original article]() Author: Anne Aarness - Chris Prall Published: 2026-09-12T11:17:51.295154Z Content type: article Language: en Sources: [Blog]() Topics: [Endpoint Security & XDR](), [supply-chain-security](), [Security](), [Open Source](), [Software](), [Artificial Intelligence](), [Claude](), [codex]() Tags: [agentic](), [ai](), [codex](), [credential-theft](), [developer](), [developers](), [development](), [endpoint-security-xdr](), [malicious-packages](), [open-source](), [open-source-packages](), [persistence](), [security](), [software-supply-chain](), [supply-chain]() ### AI overview The article describes CrowdStrike's Real-Time Supply Chain Attack Protection, embedded in the Falcon sensor, which detects and blocks malicious open-source packages before their code executes on enterprise endpoints. It explains how AI-assisted and agentic applications have expanded software supply chain risk beyond developer workstations to endpoints across the organization. ### Source excerpt Real-Time Supply Chain Attack Protection, embedded into the Falcon sensor, blocks malicious open-source packages at download to protect the endpoint. ## LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program DevFeed: [LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program]() Original publisher: [Read original article]() Author: Harold Fritts Published: 2026-09-11T16:35:51Z Content type: news Language: en Sources: [StorageReview.com]() Topics: [ibm](), [open-source-security](), [supply-chain-security](), [Security](), [vulnerability](), [DevSecOps](), [Deployment](), [Open Source](), [Artificial Intelligence]() Tags: [ai](), [deployment](), [devsecops](), [enterprise](), [ibm](), [open-source](), [open-source-software](), [red-hat](), [security](), [software-supply-chain](), [testing](), [vulnerability]() ### AI overview LTM is developing a remediation services practice around IBM and Red Hat's Lightwell program, which provides AI-generated, vendor-validated fixes for open-source software vulnerabilities. The offering is intended to help customers plan, prioritize, test, validate, and deploy patches at scale. ### Source excerpt LTM, the Larsen & Toubro Group services company that was LTIMindtree until its February rebrand, is building a Lightwell remediation services practice around the $5 billion IBM and Red Hat program for securing open-source software with AI-generated, vendor-validated fixes. IBM's clearinghouse produces validated, production-ready patches for open-source dependencies; LTM's job is getting them into customer The post LTM Builds a Lightwell Remediation Services Practice Around IBM and Red Hat's $5B Open-Source Program appeared first on StorageReview.com. ## How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act DevFeed: [How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act]() Original publisher: [Read original article]() Author: andrewb@proximabiz.com (The Linux Foundation) Published: 2026-09-09T19:11:24Z Content type: article Language: en Sources: [Linux Foundation - Blog]() Topics: [cyber resilience act](), [Security](), [Vulnerabilities](), [open-source-security](), [supply-chain-security]() Tags: [2026](), [cyber-resilience-act](), [eu](), [linux-foundation](), [open-source](), [openssf](), [regulatory](), [security](), [supply-chain-security](), [vulnerabilities]() ### AI overview This Linux Foundation post explains how Open Source Program Offices can help organizations prepare for the EU Cyber Resilience Act, including identifying affected products and dependencies, coordinating legal, security, engineering and procurement teams, and responding to vulnerability and incident reporting obligations. ### Source excerpt For organizations offering products with digital elements in the EU, the next major Cyber Resilience Act (CRA) deadline arrives on 11 September 2026. From that date, organizations covered by the reporting obligations must be ready to assess actively exploited vulnerabilities and severe security incidents, coordinate an internal response and submit notifications within the required timelines. ## How financial services companies can modernize their software supply chain DevFeed: [How financial services companies can modernize their software supply chain]() Original publisher: [Read original article]() Published: 2026-09-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [open-source-security](), [Security](), [Vulnerabilities](), [Business Security]() Tags: [cve](), [dependency](), [financial-services](), [legacy](), [security](), [software-supply-chain-security](), [vulnerabilities]() ### AI overview This article argues that financial services organizations should modernize software supply chain security while preserving business-critical systems. It explains that legacy infrastructure, regulatory obligations, and downtime concerns have encouraged deferred vulnerability remediation, but AI-assisted exploitation is making that risk increasingly dangerous. ### Source excerpt Modernize your financial software supply chain without disrupting critical systems. See how trusted open source reduces risk without major migrations. ## What it took to reach 1 billion build manifests DevFeed: [What it took to reach 1 billion build manifests]() Original publisher: [Read original article]() Published: 2026-09-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [container images](), [chainguard os](), [supply-chain-security](), [sigstore](), [Linux](), [NumPy]() Tags: [chainguard](), [chainguard-factory](), [chainguard-os](), [container-images](), [go](), [open-source](), [provenance](), [sbom](), [sigstore](), [software-supply-chain]() ### AI overview Chainguard describes how it doubled container build output from 500 million to more than 1 billion manifests in six months. The article explains how Chainguard Factory and Chainguard OS support continuous rebuilds, while using source builds, SLSA Level 3 provenance, Sigstore signatures, and full SBOMs. ### Source excerpt Chainguard doubled its container build output in six months. Learn how Factory 2.0 uses AI and reconciliation to rebuild secure software at scale. ## When AI skills become supply-chain dependencies DevFeed: [When AI skills become supply-chain dependencies]() Original publisher: [Read original article]() Author: Nubank Editorial Published: 2026-09-02T16:47:57Z Content type: article Language: en Sources: [Nubank]() Topics: [Security](), [supply-chain-security](), [Application Security](), [Development](), [Software]() Tags: [ai](), [ai-research](), [developer](), [development](), [product-security](), [security](), [supply-chain]() ### AI overview Nubank describes how AI skills and related components are expanding the software supply chain. Its security team reviewed more than 2,000 AI skills before distribution and argues that security controls must evolve as AI becomes part of the developer toolchain. ### Source excerpt How Nubank vetted 2,000+ AI skills before distribution, building security into the developer workflow without turning safety into a separate gate The post When AI skills become supply-chain dependencies appeared first on Building Nubank. ## OpenClaw went viral. Meet the maintainers building and securing it. DevFeed: [OpenClaw went viral. Meet the maintainers building and securing it.]() Original publisher: [Read original article]() Author: Gregg Cochran Published: 2026-08-27T16:00:00Z Content type: article Language: en Sources: [GitHub Engineering]() Topics: [OpenClaw](), [Maintainers](), [pull-requests](), [GitHub](), [Code review](), [supply-chain-security](), [Security](), [Artificial Intelligence]() Tags: [agent](), [agents](), [ai](), [ai-agents](), [blog](), [code](), [contributors](), [developers](), [development](), [github](), [maintainers](), [open-source](), [openclaw](), [pull-request](), [pull-requests](), [review](), [security](), [supply-chain]() ### AI overview OpenClaw maintainers discuss the project's rapid growth, the resulting flood of pull requests, contributor trust, code review, software supply chain risks, and security. They describe welcoming contributions from first-time contributors, non-developers, and people using AI agents while refining promising changes. ### Source excerpt OpenClaw is the fastest-growing project in GitHub history. Peter Steinberger and several maintainers share what they learned in the project's first six months. The post OpenClaw went viral. Meet the maintainers building and securing it. appeared first on The GitHub Blog. ## Moving from Minimus to Docker Hardened Images DevFeed: [Moving from Minimus to Docker Hardened Images]() Original publisher: [Read original article]() Author: Vishrut Iyengar Published: 2026-08-25T22:27:06Z Content type: article Language: en Sources: [Docker]() Topics: [Docker Hardened Images](), [migration](), [Docker](), [supply-chain-security](), [Docker Hub](), [Open Source](), [Debian](), [Artificial Intelligence]() Tags: [apache](), [ci](), [community](), [debian](), [docker](), [docker-hardened-images](), [docker-hub](), [enterprise](), [guide](), [migration](), [open-source](), [products](), [security](), [solutions](), [supply-chain](), [vulnerabilities]() ### AI overview Docker explains how Minimus customers can migrate to Docker Hardened Images before the Minimus registry goes offline on October 22, 2026. The article highlights the 60-day maintenance window, free migration assistance, DHI's open-source Apache 2.0 catalog, and a drop-in migration process centered on updating Dockerfile FROM lines. ### Source excerpt The Minimus registry goes offline on October 22. Here is the migration path, the free help Docker is offering, and where to start. ## Security Hub Extended adds Supply Chain Security as its tenth category DevFeed: [Security Hub Extended adds Supply Chain Security as its tenth category]() Original publisher: [Read original article]() Author: Michael Fuller Published: 2026-08-18T17:04:28Z Content type: news Language: en Sources: [AWS Security Blog]() Topics: [supply-chain-security](), [Security](), [Amazon Web Services]() Tags: [amazon-web-services-aws](), [announcements](), [aws](), [aws-security-hub](), [black-hat](), [engineering](), [enterprise](), [foundational-100](), [leadership](), [open-source](), [partners](), [payment](), [pricing](), [security](), [security-blog](), [security-identity-compliance](), [software](), [streaming](), [supply-chain](), [supply-chain-security](), [uncategorized](), [vulnerability]() ### AI overview AWS Security Hub Extended adds Supply Chain Security as its tenth category, with Chainguard and Socket as curated partners. The article frames software supply-chain risk as an enterprise security concern and describes pay-as-you-go and private-offer procurement options. ### Source excerpt Since February, we've grown AWS Security Hub Extended from 14 curated partners across 9 categories to 23 partners across 10. At Black Hat this month, 14 of those partners were at the Amazon Web Services (AWS) booth demoing live. Four of those partners delivered theater talks and ten were featured on SecurityLive streaming. We hosted [...] ## Proven, not promised: Chainguard Containers achieves SLSA Build Level 3 DevFeed: [Proven, not promised: Chainguard Containers achieves SLSA Build Level 3]() Original publisher: [Read original article]() Published: 2026-08-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [supply-chain-security](), [software bill of materials](), [Security]() Tags: [chainguard](), [chainguard-containers](), [provenance](), [sbom](), [security](), [signing](), [slsa](), [software-supply-chain-security](), [supply-chain]() ### AI overview Chainguard says Coalfire independently assessed the Chainguard Containers build and release system as meeting SLSA Build Level 3 requirements. The article describes hardened, isolated builds, separately managed signing, provenance generation, and signed SBOMs for releases. ### Source excerpt Coalfire independently assessed Chainguard Containers at SLSA Build Level 3, validating hardened builds, provenance, and supply chain integrity. ## ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough DevFeed: [ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough]() Original publisher: [Read original article]() Author: Harness Team Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [ChainDrop](), [npm](), [supply-chain-security](), [Malware](), [npm packages](), [GitHub Actions](), [GitHub]() Tags: [chaindrop](), [ci](), [ci-cd](), [github](), [github-actions](), [integrity](), [least-privilege](), [malware](), [npm](), [npm-worm](), [openid-connect](), [provenance](), [security](), [slsa](), [software-supply-chain-security](), [worm]() ### AI overview The ChainDrop npm worm compromised hundreds of packages while retaining valid SLSA provenance, demonstrating that build attestations do not guarantee source integrity. The article explains the worm's propagation, credential theft, persistence mechanisms, and recommended defenses, including source governance, dependency controls, least-privilege identities, policy gates, and runtime evidence. ### Source excerpt ChainDrop poisoned hundreds of npm packages while retaining valid provenance. Learn why signed builds need source governance, policy gates, and runtime evidence | Blog ## Why AI-assisted attacks made software supply chain security its own category DevFeed: [Why AI-assisted attacks made software supply chain security its own category]() Original publisher: [Read original article]() Published: 2026-08-03T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Security](), [Artificial Intelligence](), [Open Source](), [Agent Skills](), [Application Security](), [CI/CD]() Tags: [agent-skills](), [ai](), [ai-assisted-attacks](), [ci-cd](), [containers](), [open-source](), [secure-by-default](), [security](), [software-supply-chain](), [software-supply-chain-security](), [supply-chain-security]() ### AI overview The article argues that AI has changed the economics and speed of software supply chain attacks, making software supply chain security a distinct category requiring dedicated tooling, budgets, and strategy. It describes how AI benefits defenders and attackers, while agents accelerate dependency adoption and introduce risks through artifacts such as agent skills. ### Source excerpt Software supply chain security is now its own category. Discover why AI is driving a shift toward trusted, secure-by-default open source. ## Introducing Deputy: Better signal and control for software supply chains DevFeed: [Introducing Deputy: Better signal and control for software supply chains]() Original publisher: [Read original article]() Author: Kent Gruber Published: 2026-08-03T00:00:00Z Content type: release Language: en Sources: [Temporal Blog]() Topics: [supply-chain-security](), [Application Security](), [Command-line interface](), [Open Source]() Tags: [application-security](), [cli](), [open-source](), [software](), [supply-chain](), [supply-chain-security](), [temporal-voices]() ### AI overview Temporal introduces Deputy, an open-source, CLI-first security toolchain for inventorying, scanning, triaging, and controlling dependencies across repositories, container images, VM disk images, SBOMs, and other targets. It provides a customizable policy layer for local use, CI, and download-time controls. ### Source excerpt Meet Deputy, Temporal's open-source, CLI-first toolchain for inventorying, scanning, triaging, and controlling dependencies across your supply chain. ## Codename One Adds On-Device AI and Loopback MCP Support DevFeed: [Codename One Adds On-Device AI and Loopback MCP Support]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-08-02T00:00:00Z Content type: release Language: en Sources: [CodeName One]() Topics: [On-device AI](), [Model Context Protocol](), [Artificial Intelligence](), [LiteRT](), [Inference](), [Mobile](), [supply-chain-security]() Tags: [applications](), [inference](), [litert](), [mcp](), [mobile](), [on-device](), [on-device-ai](), [tensorflow-lite]() ### AI overview Codename One has added on-device vision, language, and LiteRT inference to its core, alongside a guarded loopback MCP transport for inspecting and operating applications. The article explains platform support, asynchronous OCR, model sessions, secure model downloads, and privacy limitations of local inference. ### Source excerpt Codename One now exposes on-device vision, language, and LiteRT inference in the core, while a guarded loopback MCP transport lets an LLM inspect and drive real applications. ## pnpm vs. npm: Which package manager should you use? DevFeed: [pnpm vs. npm: Which package manager should you use?]() Original publisher: [Read original article]() Author: Chinwike Maduabuchi Published: 2026-07-28T13:00:17Z Content type: article Language: en Sources: [LogRocket Blog]() Topics: [npm](), [Security](), [supply-chain-security](), [JavaScript](), [Application Security](), [Yarn]() Tags: [application-security](), [article](), [dev](), [javascript](), [security](), [supply-chain](), [uncategorized](), [vulnerabilities]() ### AI overview This article compares npm and pnpm as JavaScript package managers, focusing on security defaults, disk usage, dependency strictness, workspace behavior, and software supply chain risk. It explains how pnpm's content-addressable store and linked dependencies improve efficiency while stricter installation policies can make migrations more demanding. ### Source excerpt Compare pnpm and npm across security defaults, disk usage, dependency strictness, and workspace policy to decide which package manager fits your project. The post pnpm vs. npm: Which package manager should you use? appeared first on LogRocket Blog. ## How to protect an npm package from supply chain attacks DevFeed: [How to protect an npm package from supply chain attacks]() Original publisher: [Read original article]() Author: Travis Turner (richardturner@evilmartians.com) Published: 2026-07-28T00:00:00Z Content type: tutorial Language: en Sources: [Evil Martians]() Topics: [npm](), [supply-chain-security](), [Security](), [ci](), [GitHub](), [Open Source]() Tags: [2026](), [ci](), [developer-community](), [dx](), [github](), [how-to](), [javascript](), [monorepo](), [npm](), [npm-packages](), [open-source](), [performance-scale](), [security](), [supply-chain](), [supply-chain-security]() ### AI overview This tutorial explains how to protect npm packages from supply chain attacks. It covers Trusted Publishers, publishing restrictions, organization-wide 2FA, GitHub tag controls, pinned CI actions, CI security linting, cooldowns for new versions, and staged-release approval. ### Source excerpt How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings ## Introducing AI-powered container standardization DevFeed: [Introducing AI-powered container standardization]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-27T15:04:11Z Content type: article Language: en Sources: [Capital One Tech]() Topics: [Containers](), [Vulnerabilities](), [Security](), [Artificial Intelligence](), [supply-chain-security](), [sdlc]() Tags: [ai](), [ai-security](), [cloud-native](), [containers](), [requirements](), [security](), [software-development](), [software-engineering](), [software-supply-chain](), [vulnerabilities]() ### AI overview The article presents AI-powered container standardization as an approach to automate vulnerability detection, prioritization, remediation, testing, and patch deployment. It recommends avoiding exposure through curated base images and vetted dependencies, then automating ongoing remediation within the software development life cycle. ### Source excerpt AI-powered container standardization enables hands-free security remediation without sacrificing development velocity. In today's cloud-native world, containers have become the foundation of modern software delivery. Managing container security at scale can present significant challenges, thousands of vulnerabilities to track, manual remediation processes, inconsistent base images across teams and compliance requirements that slow everything down. AI-powered container standardization is a comprehensive approach that leverages artificial intelligence (AI) to automate vulnerability detection, prioritization and remediation across your entire container ecosystem. This transformative solution significantly reduces the manual toil traditionally associated with keeping containers secure and compliant. Development teams can focus on building features while the system automatically identifies vulnerabilities, generates fixes, tests changes and deploys patches, minimizing human intervention for routine updates. This approach simplifies the coordination of vulnerability remediation across hundreds of teams while ensuring that security and compliance are embedded throughout the software life cycle. Organizations can empower their developers to focus on innovation rather than patching, resulting in faster releases, stronger security and more productive engineering teams. The strategic framework: avoid and automate Our strategy for managing vulnerabilities focuses on two core principles: avoiding exposure and automating remediation, with governance baked into the software development life cycle. Avoid: Secure the foundation to minimize risk entering your environment. The most effective vulnerability remediation happens prior to the vulnerability reaching your digital ecosystems. By controlling what enters the software supply chain through curated base images and vetted dependencies/packages, you dramatically reduce the attack surface before code ever runs in production. This inc ## Best GitHub Actions Alternatives in 2026 DevFeed: [Best GitHub Actions Alternatives in 2026]() Original publisher: [Read original article]() Author: Pete Miloravac Published: 2026-07-23T12:51:23Z Content type: article Language: en Sources: [Semaphore Engineering]() Topics: [GitHub Actions](), [CI/CD](), [supply-chain-security](), [Vulnerabilities](), [Security]() Tags: [2026](), [alternatives](), [ci-cd](), [compare](), [github](), [github-actions](), [guide](), [outage](), [security](), [supply-chain-security](), [vulnerabilities]() ### AI overview A 2026 guide compares alternatives to GitHub Actions and discusses why some teams are reconsidering it, citing a major outage, a supply-chain attack affecting thousands of repositories, pricing and runner-management concerns, and log usability issues. ### Source excerpt GitHub Actions became the default CI/CD choice for millions of repositories simply because it's built into GitHub. But "default" and "best" are not the same thing -- and in 2026, the gap between the two has gotten harder to ignore. A ten-hour outage in July, a supply-chain attack that backdoored over 5,500 repositories in May, [...] The post Best GitHub Actions Alternatives in 2026 appeared first on Semaphore. ## Understanding platform engineering's role in staying compliant with the EU's CRA DevFeed: [Understanding platform engineering's role in staying compliant with the EU's CRA]() Original publisher: [Read original article]() Author: Nigel Douglas Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Security](), [vulnerability management](), [supply-chain-security](), [incident]() Tags: [compliance](), [cyber-resilience-act](), [engineering](), [eu](), [idp](), [incident](), [platform](), [platform-engineering](), [policy](), [regulatory](), [sboms](), [secure-by-default](), [secure-software](), [security](), [software-supply-chain](), [supply-chain](), [vulnerabilities](), [vulnerability-management]() ### AI overview The article explains how platform engineering can operationalize compliance with the EU's Cyber Resilience Act by embedding secure-by-default practices, automated SBOMs, and rapid incident reporting into an Internal Development Platform. It also outlines CRA compliance milestones and manufacturer responsibilities, including vulnerability management and security updates. ### Source excerpt The EU's Cyber Resilience Act (CRA) mandates secure software by design. Discover how platform engineering operationalizes compliance by embedding secure-by-default standards, automated SBOMs, and rapid incident reporting into your Internal Development Platform (IDP). This approach transforms compliance into a frictionless golden path ## Why repository-centric security still needs an artifact access control plane DevFeed: [Why repository-centric security still needs an artifact access control plane]() Original publisher: [Read original article]() Author: Adrian Herrera Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [supply-chain-security](), [CI/CD](), [Security](), [Authorization](), [iac-security]() Tags: [access-control](), [ci-cd](), [infrastructure-as-code](), [security](), [security-policies](), [software-supply-chain](), [vulnerability](), [vulnerability-scanning]() ### AI overview The article explains that repository-centric security controls can leave gaps because dependency access is distributed across CI runners, ephemeral build agents, public registries, developer tooling, and automation. It argues for an artifact access control plane, including Virtual Registries, to enforce security policies inline across CI/CD execution paths, complementing repository-based vulnerability scanning, license analysis, dependency governance, and remediation. ### Source excerpt Repository security gaps: Distributed dependency access bypasses centralized analysis. Virtual Registries offer the critical inline control plane to enforce artifact security policies across your CI/CD pipeline. ## Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL DevFeed: [Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL]() Original publisher: [Read original article]() Author: Koray Oksay Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Kubernetes](), [Platform Engineering](), [Security](), [developer velocity](), [Containers](), [supply-chain-security](), [YAML](), [opa](), [rego]() Tags: [common-expression-language](), [compliance](), [container-images](), [containers](), [cosign](), [deployment](), [developer-velocity](), [governance](), [hipaa](), [integration](), [kubernetes](), [kyverno](), [pci-dss](), [platform](), [policy](), [security](), [security-policies](), [sigstore](), [soc-2](), [supply-chain-security]() ### AI overview A guide to using Kyverno and its Common Expression Language support for Kubernetes governance. It explains how platform engineering teams can enforce policies, automate resource changes, generate resources, verify image signatures, and maintain security and compliance while preserving developer velocity. ### Source excerpt Kyverno with CEL support provides Policy-as-Code for Kubernetes governance. Enforce security, automate guardrails, and boost developer velocity for platform engineering teams. ## Announcing the State of Platform Engineering Report Vol 4 DevFeed: [Announcing the State of Platform Engineering Report Vol 4]() Original publisher: [Read original article]() Author: Sam Barlien Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [Artificial Intelligence](), [AI Development](), [GPU](), [supply-chain-security](), [MLOps](), [finops]() Tags: [2026](), [ai](), [ai-ml](), [cloud-native](), [engineering](), [infrastructure](), [mlops](), [platform](), [platform-engineering](), [platforms](), [report](), [scale](), [software-supply-chain](), [speed]() ### AI overview The State of Platform Engineering Report Volume 4 presents platform engineering as a foundational discipline for modern enterprises. Based on insights from 518 engineers, it describes a shift from the cloud-native era to an AI-native era, emphasizing "shifting down," AI-powered platforms, platforms for AI, specialized GPU infrastructure, governance, and MLOps requirements. ### Source excerpt Insights from over 500 engineers. Explore the shift to 'AI-native,' the 'dual mandate,' 'shifting down,' and key trends for 2026. ## Securing the Agent DLC: A Practical Guide DevFeed: [Securing the Agent DLC: A Practical Guide]() Original publisher: [Read original article]() Author: Rahul Sood Published: 2026-07-21T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [Development](), [Artificial Intelligence](), [supply-chain-security](), [Testing](), [observability](), [Firewall](), [Model Context Protocol]() Tags: [ai](), [ai-agents](), [firewall](), [mcp](), [observability](), [supply-chain-security](), [testing]() ### AI overview Harness presents an Agent Development Lifecycle security approach for AI agents, covering design-time scanning, AI bills of materials, testing, discovery, firewall controls, and runtime observability. The article argues that agents require security practices adapted to their dynamic tool, model, and API connections. ### Source excerpt Harness secures AI agents from development to runtime with AIBOM, AI testing, discovery, firewall, and observability across the Agent DLC. | Blog [Next page]()