#108 - Assume You’re Vulnerable: Security Beyond Patching

Exposed management interfaces can turn a software flaw into spoiled supermarket stock or an infrastructure foothold. Containers carrying shells and download tools can make the next step easier for attackers. Andrey Devyatkin and Mattias Hemmingsson connect the fridge attacks and Alpine SSH bypass to private administrative access, minimal container images, Go entrypoints and automated rebuilds. What you will learn Why private SSH access matters when password checks fail How scratch images and read-only filesystems constrain attackers after entry Why ECS health checks prompted FivexL to build lprobe How Go entrypoints remove a reason to keep Bash Where moving base image tags complicate the immutable tag rule Full article and show notes: https://devsecops.fm/episodes/116/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

A merged security fix does nothing for a service still running the vulnerable build. A week of Node2Shell, PHP and GitLab vulnerabilities puts deployment speed, container contents and public exposure under scrutiny. Andrey Devyatkin, Mattias Hemmingsson and returning co-host Julien Bisconti discuss patch delivery, minimal containers, private GitLab access, PHP maintenance and the certificate trust stores that browser updates do not reach. What you will learn Why patching main and patching production are different milestones Why removing a shell does not eliminate interpreter-based attacks How mesh networks can restrict access to self-hosted GitLab When static HTML and CSS can replace a small PHP site Why browser certificate updates leave server trust stores to maintain Full article and show notes: https://devsecops.fm/episodes/115/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

A fridge controller exposed to the internet can put a supermarket's stock at risk. A password that changes every day offers little reassurance if anyone can calculate it. Andrey Devyatkin and Mattias Hemmingsson discuss refrigeration attacks, predictable passwords, AI-assisted reverse engineering, regex-based security checks and concerns about remote access to solar inverters. What you will learn Why hiding a password algorithm leaves predictable credentials exposed How VPN access and patching reduce risks to refrigeration controllers Why the hosts expect AI to help bypass regex-based checks How contractor-installed equipment can fall between security responsibilities Why remote access to solar inverters raises wider infrastructure concerns Full article and show notes: https://devsecops.fm/episodes/114/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

When AI handles implementation, a junior's first assignment might be approving code headed straight to production. Does that teach enough, or should learning start with the problem and the specification? Andrey Devyatkin, Paulina Dubas and Mattias Hemmingsson debate junior learning in Mattias's dark factory, scope control before AI implementation, practical education and the vocabulary engineers gain from books. What you will learn How Mattias connects GitHub workflows, Kubernetes and Berget AI Why senior oversight and release impact matter for junior reviewers How scope checks before planning help limit oversized changes How answering before asking Claude can indicate an intern's progress Why shared vocabulary helps engineers describe problems to AI Full article and show notes: https://devsecops.fm/episodes/113/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

What is worth learning when agents can handle more of the implementation? Deep knowledge of one vendor still has value, but incident experience, industry constraints and clear communication change what an engineer can contribute. Andrey Devyatkin and Mattias Hemmingsson discuss DevOps careers, failure knowledge, cloud specialization, business understanding and the maintenance burden of replacing SaaS with internal tools. What you will learn Why knowing failure modes remains valuable beyond learning service manuals How project risk changes the review needed for agent output What business understanding means beyond keeping Docker containers running How clear technical language helps agents understand requirements and constraints Why rebuilding SaaS can turn engineers into internal vendors Full article and show notes: https://devsecops.fm/episodes/112/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

An agent asked to build a service found an Argo CD repository and deployed it to a cluster. Helpful automation gets harder to trust when a request leaves room for actions nobody intended. Mattias Hemmingsson and Paulina Dubas discuss AI-assisted compliance checks, unexpected deployments, evolving guardrails, company AI bans and whether regulation improves transparency or prices smaller competitors out. What you will learn How Claude turned AWS database checks into reusable audit evidence How an agent found a deployment path through Argo CD Why vague instructions and guardrail edge cases cause unwanted actions Why approving a hosted assistant does not make it local Where the hosts see benefits and competitive risks in regulation Full article and show notes: https://devsecops.fm/episodes/111/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

Why would a security improvement break a working deployment? Andrey questions the operational cost of GitHub’s OIDC change, while Mattias explains how repository renames can break AWS access. The hosts share a real incident involving a blocked account and discuss how to prepare for the change.  We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel

What changed in Docker while everyone was watching AI? The hosts review BuildKit, Buildx, security features, provenance, and the updates practitioners should know.  We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel

Are AI tools making software safer, or creating an endless patching treadmill? Mattias, Andrey, and Paulina discuss Dependabot, human review, and why teams should assume their software is already vulnerable.  We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel

CI changed how teams integrate code, but its core promise remains the same: integrate often and keep the mainline green. Andrey and Paulina trace its history and examine how Git, merge queues, and modern pipelines changed the mechanics.  We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel