A newly discovered supply chain security flaw is once again putting a spotlight on inherent weaknesses in CI/CD pipelines and the growing interest among cyberthreat actors to exploit them. Security researchers with Novee, an AI penetration testing platform provider, wrote about Cordyceps, an exploitable pattern in the open source supply chain that can allow attackers to hijack workflows and gain full control of code repositories, including those at dozens of the world’s largest companies, including Microsoft, Google, Python, Apache, and Cloudflare. In addition, the vulnerability can be exploited by any unauthenticated user, according to Elad Meged, founding engineer and security researcher at Novee. “No org membership or special privileges; a free account is enough to forge approvals, push code, or steal credentials,” Meged wrote in a report . The Novee team scanned 30,000 “high-impact” repositories, 654 were flagged in a single scan and more than 300 were confirmed to be ful...
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Greenhouse Cadence Solutions Remote, US Staff DevOps Engineer $200,000 to $260,000 Vast Long Beach, CA Staff DevOps Engineer $188,600 to $267,700 DV Trading New York, NY Senior DevOps Engine...