Topic
Kubernetes
Shadow AI in CI/CD: Why AI Agents Must Be Modeled as Security Threats
AI Security
Avoiding a Leaky Kubernetes Audit Policy: Real-World Configuration Breakdown
Policy & Regulation
Avito Details Security Gates Implementation to Enforce Vulnerability Remediation Without Disrupting Developers
OtherInfotecsTech Builds Custom Kubernetes-Based Traffic Generator for NGFW RnD and Performance Testing
InfotecsTech developed an in-house traffic generator to support development and testing of its high-performance NGFW cluster in active-active mode. The team rejected commercial solutions from IXIA and Xinertel due to high cost, insufficient flexibility for complex NGFW functions, and geopolitical restrictions. The resulting platform runs on Kubernetes with a master node managing Registry, Discovery, and Crux components while worker nodes host containerized generators. Supported generators include Cisco TRex for throughput and connection testing, SIPp for VoIP scenarios, pyftpdlib-based FTP generator, Yandex Tank with Nginx for live TLS traffic, and Selenium-based legitimate clients against OWASP Juice Shop. Practical scenarios cover VoIP call storms, maximum concurrent connections, 400 Gbit/s UDP throughput, 5 million CPS, and IMIX traffic at 300 Gbit/s with packet loss analysis. The system integrates Camunda for full automation of test scenarios and device configuration.
Critical Vulnerability CVE-2026-8715 Discovered in HashiCorp Vault Secrets Operator
HashiCorp has disclosed a critical vulnerability in its Vault Secrets Operator product that affects the AppRole authentication mechanism introduced in version 1.3.0. The flaw, tracked as CVE-2026-8715, stems from insufficient path validation in the secretIDPath field, allowing authenticated Kubernetes users to read arbitrary files from Pod filesystems. With a CVSS v3.1 base score of 9.6, the issue is rated Critical and can lead to credential theft by exfiltrating secrets to attacker-controlled endpoints. Exploitation requires specific permissions to create or retrieve VaultAuth, VaultConnection, and VaultStaticSecret resources. HashiCorp recommends immediate migration to version 1.5.0, which removes the vulnerable secretIDPath field entirely.
5 NetworkPolicy Mistakes That Leave Kubernetes Clusters Completely Unprotected
A detailed analysis from OTUS highlights five frequent configuration errors in Kubernetes NetworkPolicy that allow unrestricted traffic despite policies appearing active in the cluster. The article explains that Kubernetes itself does not enforce NetworkPolicy objects; enforcement depends entirely on the CNI plugin such as Calico, Cilium, or Weave Net, while Flannel and kubenet ignore them entirely. Common pitfalls include blocking DNS resolution when applying default-deny egress rules, incorrect use of namespaceSelector versus podSelector leading to overly permissive access, and confusing the top-level podSelector with selectors inside ingress or egress blocks. Additional issues arise when policies fail to account for ingress controllers, hostNetwork pods, or inter-container localhost communication within the same pod. The piece stresses the importance of traffic-based validation rather than relying on kubectl output and recommends testing with deny-all policies plus continuous monitoring during rollout.
GitLab Developer Account Leads to Full OpenStack Cloud Control via CI/CD Runner Misconfigurations
A penetration testing team demonstrated how a standard developer account in GitLab can be escalated to full administrative control over an OpenStack cloud environment through typical CI/CD misconfigurations. Starting with only GitLab credentials, the testers created a pipeline that executed arbitrary commands on a production Kubernetes runner named PROD-K8S-RUNNER01. Membership in the docker group allowed privilege escalation to root by mounting the host filesystem and adding an SSH key. From the compromised host, the team discovered a kubeconfig file granting extensive Kubernetes permissions including secret access, pod execution, and role bindings. This access enabled mounting a node filesystem to extract OpenStack cloud-config credentials. The resulting cloud account possessed broad roles across nova, cinder, neutron, and other services, effectively providing administrator-level control over virtual machines, networks, storage, and managed Kubernetes clusters.
OTUS Publishes Extensive Digest Covering Kubernetes, GitLab CI, DevSecOps and Infrastructure Reliability
OTUS has released a large-scale digest that compiles free lessons, practical articles and advanced courses focused on real-world infrastructure challenges. The collection addresses interconnected topics including Kubernetes container orchestration, GitLab CI pipeline automation, observability with OpenTelemetry, network troubleshooting, and DevSecOps practices. Readers can explore specific lessons on secrets management with Vault, load testing, RAID recovery, and kernel-level protections in Linux. The digest also features in-depth articles on Docker Compose configuration, CrowdSec migration, L2 network loops, and self-service deployment models. For experienced professionals, OTUS offers specialized courses on high-load systems, PostgreSQL administration, Linux kernel development, and advanced networking with BGP and OSPF.
GC Solar and SEG-T Launch Development of AI-Powered Security Email Gateway SEG-T to Counter Advanced Phishing Campaigns
GC Solar and co-founder of Secure-T Khariton Nikishkin have initiated the development of SEG-T, a new Security Email Gateway solution designed to protect corporate email systems using multi-agent AI. The project responds to the growing sophistication of phishing attacks that leverage ready-made toolkits, infrastructure, anti-bot mechanisms, and AI-generated content to create convincing messages at scale. Unlike traditional filters, SEG-T will analyze both technical indicators and semantic elements such as tone, manipulation tactics, attempts to build trust, instill fear, or create urgency. The system will block suspicious attachments including links, archives, PDFs, executables, and SVGs while focusing primarily on social engineering rather than relying on a built-in sandbox. SEG-T is planned for deployment across cloud, on-premises, and Kubernetes environments with rapid 15-minute setup times and will integrate with Solar webProxy and Solar Dozor for enhanced traffic inspection and data loss prevention. GC Solar holds a 49% stake in the project following its earlier acquisition of a controlling interest in Secure-T.