Operations | Monitoring | ITSM | DevOps | Cloud

The latest News and Information on CyberSecurity for Applications, Services and Infrastructure, and related technologies.

npm axios attack - What happened and how to protect your supply chain

Apr 2, 2026 By Cloudsmith In Cloudsmith
100M+ weekly downloads. One compromised maintainer account. A remote access trojan in two active release branches. This is a 30-minute breakdown of the Axios npm supply chain attack – how it happened, why it was hard to detect, and what any engineering team can do right now to reduce exposure. Nigel Douglas, Head of Developer Relations at Cloudsmith, is joined by Jenn Gile, co-founder of Open Source Malware, a community-driven threat intelligence platform focused on malicious open source packages.
View Video
harness

Introducing Zero Trust Architecture for Software Delivery | Harness Blog

Apr 2, 2026 By Eric Minick In Harness
For the world’s largest financial institutions, places like Citi and National Australia Bank, shipping code fast is just part of the job. But at that scale, speed is nothing without a rock-solid security foundation. It’s the non-negotiable starting point for every release. Most Harness users believe they are fully covered by our fine-grained Role-Based Access Control (RBAC) and Open Policy Agent (OPA).
Read Post
How Cloud Computing Is Transforming Secure Financial Infrastructure

How Cloud Computing Is Transforming Secure Financial Infrastructure

Apr 2, 2026 By OpsMatters In OpsMatters
Here's the thing about old-school IT infrastructure: it bleeds your budget dry and puts the brakes on growth when you need speed most. You can't keep throwing money at clunky on-site servers that demand endless upgrades and full-time babysitters. Cloud computing is a total game-changer. Companies are now tapping into enterprise-level tech without mortgaging their future on capital investments that used to feel unavoidable.
Read Post
fabrix

The Agent Runtime Needs an Enterprise Brain: Why Fabrix.ai Completes the NemoClaw / DefenseClaw Stack

Apr 1, 2026 By Shailesh Manjrekar In Fabrix
The agentic AI security stack is taking shape , fast. At GTC 2026, NVIDIA unveiled NemoClaw, an open-source stack that wraps OpenClaw with enterprise-grade privacy controls, local inference via Nemotron models, and the OpenShell sandboxed runtime. Days later at RSAC 2026, Cisco launched DefenseClaw, an open-source governance framework that scans every agent skill, MCP server, and plugin before admission , and enforces block/allow policies at runtime with sub-two-second enforcement.
Read Post
Avantra

Five Ways Avantra Makes SAP More Secure

Apr 1, 2026 By Avantra Team In Avantra
Enterprises use SAP well beyond simple back-office only accounting software. Today’s SAP systems are highly integrated and used by thousands of people daily across dozens of departments, and that’s just for a single large enterprise! As a central part of business operations, getting SAP security right, and durable operations with it, have become essential responsibilities for IT teams.
Read Post
icinga

Mirroring Icinga Packages in Air-Gapped and Restricted Environments

Apr 1, 2026 By Alvar Penning In Icinga
When hosting in a secure or corporate environment, Internet access is often restricted or blocked completely. While this makes sense from a security point of view, this introduces some challenges. For one, getting software packages. There are usually two approaches to the package problem in such an environment: Either allow a certain package mirror in the firewall, or run your own mirror within the restricted environment with access to another package server to mirror packages from.
Read Post
kosli

Introducing kosli evaluate: Rego Policy Evaluation for Your Compliance Data

Apr 1, 2026 By Steve Tooke In Kosli
If you’re evaluating compliance controls against your Kosli trail data today, there’s a good chance you’ve written some glue code to make it work. A script that pulls trail data from the API. Another that downloads attestations one by one. Something that mangles the JSON together into a shape that your chosen compliance engine can evaluate. And then that engine itself, whether it’s OPA, a custom Python script, or something else, installed and configured in your pipeline.
Read Post
Why True Operational Security Requires an Unmanaged Cloud VPS

Why True Operational Security Requires an Unmanaged Cloud VPS

Apr 1, 2026 By OpsMatters In OpsMatters
When deploying infrastructure for sensitive communications, penetration testing, or privacy-centric applications, your threat model must account for the human element. Handing over the root access of your server to a "managed" hosting provider fundamentally breaks that model. In 2026, serious security practitioners know that true OPSEC cannot exist in an environment where support staff have administrative backdoors into your operating system.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.