DevOps and Infrastructure

DevOps, Terraform, CI/CD, GitHub Actions, GitLab CI, Jenkins, ArgoCD, FluxCD, Docker, Docker Compose, Podman, Vagrant, Packer, Nexus, SonarQube, HashiCorp Vault, Consul, Prometheus, Grafana, Loki, Alertmanager, ELK Stack, Datadog, New Relic, OpenTelemetry, SRE, site reliability engineering, infrastructure as code, IaC, GitOps, platform engineering, observability, monitoring

18 stories

AI Agents and Frameworks

GitHub’s Surge: 7.4 Billion Monthly Commits and the Infrastructure Race to Keep Up

GitHub has crossed a scale threshold few predicted: the platform is now processing 7.4 billion commits per month. That figure, announced at GitHub Universe, marks a staggering acceleration from earlier in the year — 1.4 billion monthly commits in April and 2.9 billion in August — and highlights how the nature of development activity is shifting. Behind the headline number lies a set of operational challenges and engineering responses that…

Saugata DattaOct 29, 20263 min read5

Data Breach

Supply-chain Breach: How a Leaked LiteLLM Master Key Let Attackers Push a Malicious PyPI Release

LiteLLM disclosed a serious supply-chain incident that began with a single accidentally published configuration file and escalated into a malicious package release that could execute whenever Python started. The exposure of an Agent Platform master key in late May 2026 went unrevoked and, months later, an attacker used it to extract high-privilege GitHub tokens, override release safeguards, and publish a trojaned LiteLLM package to PyPI. The fallout forced an emergency…

Saugata DattaOct 24, 20265 min read57

DevOps and Infrastructure

Smuggling Code: How ClickFix Uses Browser Cache to Beat Windows Run Limits

ClickFix attacks have evolved from simple social-engineering lures into highly creative delivery mechanisms that turn a user's own system into the execution environment. Recent Microsoft telemetry describes a variant that stages malicious scripts inside a victim's browser cache—disguised as innocuous PNG files—and then convinces the user to paste a short command that triggers execution of that cached payload. By hiding the payload in cache entries and later reconstituting it on…

Saugata DattaOct 6, 20264 min read154

Automation

Critical GitLab AI Gateway Flaw: What Administrators Need to Do Now

GitLab has pushed an urgent set of security updates after disclosing a critical vulnerability in its AI Gateway that could allow authenticated users to run arbitrary commands on the gateway. Tracked as CVE-2026-90970 and rated CVSS 9.9, the flaw affects self-hosted AI Gateway deployments that support GitLab Duo AI features. While GitLab’s hosted gateways have already been patched, organizations running their own gateways must act immediately to mitigate a high-impact…

Saugata DattaOct 3, 20264 min read222

Automation

The Credential-Free Watchdog: Mastering Event-Driven App Automation

We have all been there. You are an automation lover. You have built a masterpiece — a Scheduled Task, perfectly configured, credentials entered, running like clockwork. You walk away like a hero. Then Monday morning hits. Your account is locked. Your coffee tastes like failure. I once left a mapped network drive in an SOE test build and completely forgot about it. Windows did not forget. Every night it faithfully…

Saugata DattaMay 7, 202612 min read256

Artificial Intelligence

How the Google Gemini CLI Flaw Turned CI/CD Pipelines into Remote Code Execution Risk

A critical remote code execution (RCE) vulnerability in the Google Gemini CLI and its associated GitHub Action exposed a startling weakness in how AI tooling can interact with developer infrastructure. Rated with the maximum CVSS score of 10.0, the bug allowed unprivileged external actors to execute commands on the machines running CI/CD workflows. This wasn’t a prompt-injection trick against a model; it was an infrastructure-level failure that allowed malicious configuration…

Saugata DattaApr 30, 20264 min read311

Data Breach

Bitwarden CLI Compromised in Supply Chain Attack via GitHub Actions

Socket and other researchers have confirmed that the Bitwarden CLI package published to npm — @bitwarden/cli version 2026.4.0 — was compromised in a supply chain attack that abused a GitHub Action in Bitwarden’s CI/CD pipeline. The malicious release injected a file named bw1.js into the package, exposing tokens, cloud credentials, SSH keys and other sensitive artifacts. While Bitwarden’s Chrome extension, MCP server and other official distribution channels are reported unaffected,…

Saugata DattaApr 24, 20264 min read442

Cybersecurity

109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware

A large-scale campaign recently uncovered shows how attackers abused the trust developers place in open-source hosting to distribute two dangerous malware families, SmartLoader and StealC. By cloning legitimate projects and burying malicious ZIP archives deep inside repository structures, the threat actor made harmful downloads look like routine releases. For many victims the repository looked authentic at a glance: real source files remained intact, but documentation and release links silently pointed…

Saugata DattaApr 23, 20264 min read461

AI Agents and Frameworks

Comment and Control: How GitHub Comments Became a New Prompt-Injection Threat

A new class of prompt-injection attacks—dubbed "Comment and Control"—turns GitHub pull requests, issues, and comments into attack surfaces that can hijack AI coding agents and siphon secrets directly from CI/CD environments. Unlike classic prompt injection that waits for a user to feed a document to an agent, this pattern is proactive: opening a PR or posting an issue can automatically trigger an AI agent (via GitHub Actions) and cause it…

Saugata DattaApr 21, 20265 min read485

AI Agents and Frameworks

Building an AI Coding Tool Stack for Modern Development

The past few years have quietly transformed how software is written. AI-assisted tools are no longer experimental add-ons; they're becoming integral parts of developer workflows. But picking the right combination of models, integrations, and guardrails is more art than science. This article walks through a pragmatic approach to assembling an AI coding tool stack that improves productivity without sacrificing code quality, security, or team cohesion. Why an AI coding stack…

Saugata DattaApr 13, 20264 min read544

AI Agents and Frameworks

Claude’s New Release — Supercharged Multi‑Agent Code Review for Every PR

Good code review is getting harder as teams ship more code. Claude’s new release brings a deeper, multi-agent review system to Claude Code so every pull request can get a careful read. The goal is simple: surface the bugs and edge cases that quick skims miss, while leaving the final approval to human reviewers. What this release is This new release introduces Code Review in research preview for Team and…

Saugata DattaMar 13, 20263 min read735

Artificial Intelligence

Introducing the Azure Skills Plugin: Practical Azure Workflows for Coding Agents

The Azure Skills Plugin brings curated Azure expertise and an execution layer together so coding agents can do more than offer generic guidance. Rather than just suggesting commands or linking to documentation, the plugin packages decision logic (skills) and structured tools (MCP servers) so agents can reason about workflows and, when appropriate, run actions against real Azure resources. What the plugin is The plugin is a single install that combines…

Saugata DattaMar 10, 20264 min read705

Free Tools: IP, DNS, SSL