OWASP GenAI LLM Top 10 2026 adds incident data to practitioner judgment, drawing on 7,714 real AI security incidents. www.msbiro.net/posts/owasp-...

OWASP GenAI LLM Top 10 2026: What the New Rankings Mean for Security Teams

OWASP released the GenAI LLM Top 10 2026, the first edition grounded in 7,714 real AI security incidents. Prompt Injection stays at number one. Excessive Agency climbs. Misinformation is the widest ga...

msbiro.net

"Just temporarily" is how an AI agent ends up with cluster-admin. K8s doesn't distinguish a destructive action by an attacker from the same action by an over-privileged agent. Shadow AI threat model, laptop to pod: www.msbiro.net/posts/shadow...

Shadow AI in CI/CD: Threat-Modelling Laptop to Kubernetes

Shadow AI turns ungoverned coding assistants and agents into a live threat across CI/CD. A stage-by-stage threat model from developer laptop to Kubernetes pod, with the executive controls and tooling ...

msbiro.net

It's 2026 and I still get asked why encrypting secrets with git-crypt isn't enough. Short answer: encryption solves confidentiality, not revocation, audit logging, or dynamic secrets. DORA and NIS2 remove any remaining excuse. www.msbiro.net/posts/secret...

In 2026 I Am Still Asked Why You Need a Centralized Secrets Manager

Why a centralized secrets manager is non-negotiable in 2026: the operational limits of git-crypt and sealed-secrets style tools, the DORA and NIS2 mandate, and why OpenBao is now the open source secre...

msbiro.net

The ECB told bank CEOs AI is shortening the gap between vulnerability discovery and exploitation. Action plan due 31 October 2026, DORA as the foundation. Also extending the IT Risk Questionnaire deadline to Feb 2027. My breakdown with CNAPP, hardened images and SBOMs www.msbiro.net/posts/ecb-ai...

ECB on AI-Enabled Cybersecurity Threats: What Banks Must Do by October 2026

ECB letter on AI-enabled cybersecurity threats: action plan due October 2026, ITRQ deadline extension, CNAPP, hardened images, SBOMs and DORA resilience.

msbiro.net

Built a fully local meeting-minutes pipeline: on-device speech-to-text + diarization on Apple Silicon, then a 14B model via Docker Model Runner and Docker Agent. No audio, transcript, or prompt ever leaves the machine. www.msbiro.net/posts/local-...

Local AI Meeting Minutes with Docker Model Runner and Docker Agent: No Cloud, No Leaks

Local AI meeting minutes on Apple Silicon: on-device transcription with speaker diarization, then minutes from a 14B model through Docker Model Runner and Docker Agent. No cloud, no data flow to third...

msbiro.net

Episode 3 of my "Back to Basics" series: TLS and PKI from the ground up. What an X.509 certificate actually contains, how the chain of trust works, the TLS 1.3 handshake step by step, and the Kubernetes PKI most engineers never look at. www.msbiro.net/posts/back-t...

Back to Basics: TLS and PKI from the Ground Up

TLS and PKI explained from the ground up: what an X.509 certificate actually contains, how the chain of trust works, what happens during a TLS handshake step by step, and how Kubernetes builds a full ...

msbiro.net

In 2026 I still get asked why enterprises need a hardened container image catalog. DORA and NIS2 mandate it. Container base images are infrastructure and deserve the same governance we always applied to operating systems. www.msbiro.net/posts/harden... #devsecops #nis2

In 2026 I Am Still Asked Why You Need a Hardened Container Image Catalog

Why hardened container image catalogs are non-negotiable in 2026: the technological case, the DORA mandate, and the NIS2 obligations explained.

msbiro.net

Your engineering culture is not shaped by the all-hands. It is shaped by your EMs in every 1:1 this week. New post connecting McKinsey 2026 data to what I live daily as a team leader: why middle management is a CTO's highest-ROI investment. www.msbiro.net/posts/engine...

Engineering Managers Are Your Real Culture: Why CTOs Must Invest in Middle Management

Engineering managers are the real culture carriers in your organization. McKinsey 2026 data explains why CTOs must prioritize investment in their middle management layer.

msbiro.net

AI finds zero-days faster than disclosure was designed to handle. Athena is a new coalition: 24+ members, coordinated remediation before public disclosure, 20k findings, 2k patches already. My take on what it means for DevSecOps teams: www.msbiro.net/posts/athena...

Athena Coalition: Coordinated Open Source Defense in the AI Vulnerability Era

Athena is a new industry coalition for coordinated open source vulnerability defense. Here is what it means for DevSecOps teams and security leaders.

msbiro.net

Apple just introduced “container machine” with Container 1.0. Worth adding to your workflow? It depends, but it’s definitely interesting. www.msbiro.net/posts/apple-...

Apple container 1.0 and container machine: hands-on security test

Hands-on Apple container 1.0 test of container machine on macOS, covering home-mount security, networking, systemd, and Docker or Podman alternatives.

msbiro.net

AI agents run with the privileges we give them, and attackers now operate at machine speed. Anthropic's Zero Trust for AI Agents eBook is the practical framework the field has been missing. My review: www.msbiro.net/posts/zero-t... #zeroTrust #agents #antrhopic

Zero Trust for AI Agents: Why Anthropic's New eBook Should Be on Your Reading List

A review of Anthropic's Zero Trust for AI Agents eBook: a practical security framework for deploying autonomous AI agents, covering threat modeling for security leaders and an implementation guide for...

msbiro.net

@cloudnativedaysitaly.org Italy 2026 is behind us, and Bologna was worth every bit of the work. As one of the organizers, I wrote a short recap of 2 full days, 40 sessions, 4 workshops, and the community conversations that made this edition special. www.msbiro.net/posts/cloud-...

Cloud Native Days Italy 2026: A Wrap-Up from Bologna

Cloud Native Days Italy 2026 wrapped up in Bologna. A personal recap from one of the organizers: speakers, MCs, sponsors, and a community worth celebrating.

msbiro.net

@sentinelone.com purple-mcp: open-source MCP server for Singularity, 22 read-only tools. I tested the integration with Claude Code. One prompt → alert list, asset context, triage brief. ~6 seconds. No tab-switching. Tested against a live tenant. www.msbiro.net/posts/sentin...

SentinelOne Purple MCP: A Hands-On Guide to Singularity AI Integration

Hands-on review of SentinelOne's purple-mcp: how to connect Singularity alerts, vulnerabilities, and threat hunting to Claude Code for faster SOC triage.

msbiro.net

Lazarus Group hides malware in git hooks, targeting developers through fake job interviews. Clone a repo. Run git merge. Your credentials are gone. Attack breakdown + five practical defences: www.msbiro.net/posts/lazaru...

Lazarus Group Hides Malware in Git Hooks to Target Developers

North Korea's Lazarus Group embeds malware in git hooks to compromise developers through fake job interviews. Attack breakdown and five practical defences.

msbiro.net

🎉 PLATINUM SPONSOR ANNOUNCEMENT: Spectro Cloud Spectro Cloud helps enterprises orchestrate infrastructure from cloud to edge, and metal to model. They're also the sponsor behind the CNCF Kairos project: an immutable Linux meta-distribution designed for edge Kubernetes.

CVE-2026-31431 "Copy Fail": nine years in the kernel, root in 732 bytes of Python. No race conditions, no kernel offsets. Container namespaces don't protect you the page cache is shared across the host. Only runtime detection catches this. www.msbiro.net/posts/cve-20...

CVE-2026-31431 Copy Fail: A Nine-Year-Old Kernel Bug, a 732-Byte Script, and a Root Shell

CVE-2026-31431 Copy Fail is a local privilege escalation in the Linux kernel exploitable with a 732-byte Python script. This post covers what it is, how to fix it, what to do when patching isn't immed...

msbiro.net

Ubuntu 26.04 LTS is out. I focused on the server side instead of the desktop headlines: security changes, cgroup v2-only, confidential VMs, sudo-rs, post-quantum SSH, and what it means for Ubuntu-based container workloads. www.msbiro.net/posts/ubuntu...

Ubuntu 26.04 LTS: What Changes for Security and Container Workloads

Ubuntu 26.04 LTS 'Resolute Raccoon' just shipped. For teams running RHEL or Ubuntu on servers, this post breaks down what actually changed in security and container/Kubernetes workloads compared to 24...

msbiro.net

3 supply chain attacks in 3 weeks. Bitwarden CLI, Trivy, Axios , all used postinstall scripts to steal credentials from developer environments and CI/CD pipelines. EDR doesn't see it coming. I wrote up the pattern and 8 controls worth actually putting in place. 🔗 www.msbiro.net/posts/supply...

Supply Chain Attacks Won't Stop: 8 Controls to Reduce Your Exposure

Bitwarden CLI, Trivy, and Axios compromised in three weeks. Your EDR won't catch postinstall scripts. 8 practical controls to reduce the blast radius.

msbiro.net

🎉 SMART SPONSOR ANNOUNCEMENT: @cncf.io Cloud Native Days Italy has always been deeply connected to the CNCF community with CNCF Ambassadors, maintainers, and contributors at the heart of our event. Together we've built a vibrant cloud-native community in Italy.

📚 BOOK SIGNING & GIVEAWAY For the first time ever, Pietro Libro and @artemlajko.bsky.social will sign copies of their book "Implementing GitOps with Kubernetes" together and it's happening at Cloud Native Days Italy 2026!

Tomorrow K8s 1.36 ships. Ingress NGINX retires, but on security side SELinux labeling GA (faster Pod startup on enforcing systems) + external ServiceAccount signing GA (KMS integration). I've written a breakdown focused on why these matter for your infrastructure → www.msbiro.net/posts/kubern...

Kubernetes 1.36: The Release That Said Goodbye to Ingress NGINX

Kubernetes 1.36 releases tomorrow with a significant security focus: the end of Ingress NGINX, SELinux volume labeling reaching GA, and a set of long-overdue removals that tighten the security posture...

msbiro.net

🚨 THE COUNTDOWN IS ON! 🚨Only 1 month to go! Cloud Native Days Italy 2026 is just around the corner: May 18-19 in Bologna … and we couldn't be more excited! 🚀

🐧 Wrote a piece on Linux Kernel 7.0 from a platform security lens — what's changed, what it means for your infrastructure, and what leaders should be paying attention to. If you're in DevSecOps or cloud native, worth a read 👇 www.msbiro.net/posts/linux-... #Linux #DevSecOps #CloudNative

Coming solo or with your team? Let us know! 👇

Matteo Bisi@msbiro.net · 4mo ago

☁️ @cloudnativedaysitaly.org 2026 is coming to Bologna on May 18-19 🇮🇹 Two full days with 2 tracks, workshops, great talks, and a dedicated maintainer space on day 2. I’m proud to help organize it! join us! Agenda cloudnativedaysitaly.org/agenda

☁️ @cloudnativedaysitaly.org 2026 is coming to Bologna on May 18-19 🇮🇹 Two full days with 2 tracks, workshops, great talks, and a dedicated maintainer space on day 2. I’m proud to help organize it! join us! Agenda cloudnativedaysitaly.org/agenda

Weekend experiment: As a spec-kit user, I wanted to test GSD (Get Shit Done), a different SDD framework built around preventing AI context rot. Starting point: zero production code. Comparison of both frameworks + full session walkthrough 👇 msbiro.net/posts/gsd-sbom-drift-spec-driven-development/

As an AI enthusiast and Security Team Leader, when I saw Docker Sandboxes I couldn't resist going deep. I installed it, broke it, fixed it, and ran GitHub Copilot CLI inside a sandbox. Here's what I found Big kudos to @docker.com for shipping this 🐳 🔗 msbiro.net/posts/docker-sandboxes-ai-agents/

KubeCon EU 2026 swag: 6 months of Copilot Pro+ First thing I did back home: raise the security baseline of my side project. OpenSSF Scorecard as required merge check · Dependabot for Go + GitHub Actions · SHA-pinned workflows · branch protection via gh api Write-up 👇 www.msbiro.net/posts/actui-...

Hardening ACTUI: Dependabot and OpenSSF Scorecard for a Side Project

Back from KubeCon EU 2026 with a free Copilot Pro+ subscription, I turned my attention to the security posture of apple-container-tui. Here's how I added Dependabot and OpenSSF Scorecard using GitHub ...

msbiro.net

⚡ KEYNOTE SPEAKER: GIACOMO TENAGLIA Chair, @cern.bsky.social Open Source Program Office 25 years building and running services on open-source software 🎤 Keynote talk: "Open Source at CERN" This is the kind of keynote that reminds us why open source matters.

🎉 COMMUNITY PARTNER ANNOUNCEMENT: theRedCode TheRedCode.it a tech blog that shares practical tech guides on DevOps, security and AI for dev and not, in small bits. A huge thank you to Serena Sensini for supporting Cloud Native Days Italy and contributing to the broader cloud-native community! 🙌