Aurea

Aurea Specification Golden Standards for IaC Security HTML Mirror: https://roxanneardary.com/aurea-specification/ Specification Overview Aurea is a fully open-source, AI-powered Infrastructure-as-Code security specification designed to provide continuous security analysis throughout the software...

PT-2026-61848

A critical supply chain risk targeting Infrastructure as Code IaC environments has been disclosed over the last 24 hours. Security researchers have revealed "TerraSmuggle" tracked as CVE-2026-81042, CVSS 8.8, a severe RCE and credential-leaking vulnerability impacting HashiCorp Terraform and...

gabposter (>=1.2.5, <=1.2.8), open-webdriver (>=1.3.5, <=1.6.9) +4 more potentially affected by CVE-2026-55206 via py7zr (0.20.2)

py7zr PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - gabposter =1.2.5, =1.3.5, =1.0.4, =1.0.0, =1.0.10, =1.0.0, =1.2.86 Source cves: CVE-2026-55206 Source advisory: OSV:PYSEC-2026-2973...

qualys-iac-security (>=1.0.0b2, <=1.0.3) potentially affected by CVE-2026-55206 via py7zr (0.16.1)

py7zr PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - qualys-iac-security =1.0.0b2, =1.0.3 Source cves: CVE-2026-55206 Source advisory: OSV:PYSEC-2026-2973...

qualys-iac-security (>=1.0.0b2, <=1.0.3) potentially affected by CVE-2026-55195 via py7zr (0.16.1)

py7zr PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - qualys-iac-security =1.0.0b2, =1.0.3 Source cves: CVE-2026-55195 Source advisory: OSV:PYSEC-2026-2972...

qualys-iac-security (>=1.0.0b2, <=1.0.3) potentially affected by CVE-2026-23879 via py7zr (0.16.1)

py7zr PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - qualys-iac-security =1.0.0b2, =1.0.3 Source cves: CVE-2026-23879 Source advisory: OSV:PYSEC-2026-2974...

gabposter (>=1.2.5, <=1.2.8), open-webdriver (>=1.3.5, <=1.6.9) +4 more potentially affected by CVE-2026-23879 via py7zr (0.20.2)

py7zr PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - gabposter =1.2.5, =1.3.5, =1.0.4, =1.0.0, =1.0.10, =1.0.0, =1.2.86 Source cves: CVE-2026-23879 Source advisory: OSV:PYSEC-2026-2974...

qualys-iac-security (>=1.0.0b2, <=1.0.3) potentially affected by CVE-2026-55206 via py7zr (0.16.1)

py7zr PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - qualys-iac-security =1.0.0b2, =1.0.3 Source cves: CVE-2026-55206 Source advisory: OSV:GHSA-H4GH-22QQ-72R7...

qualys-iac-security (>=1.0.0b2, <=1.0.3) potentially affected by CVE-2026-55195 via py7zr (0.16.1)

py7zr PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - qualys-iac-security =1.0.0b2, =1.0.3 Source cves: CVE-2026-55195 Source advisory: OSV:GHSA-GJRG-MPP7-G774...

gabposter (>=1.2.5, <=1.2.8), open-webdriver (>=1.3.5, <=1.6.9) +4 more potentially affected by CVE-2026-55195 via py7zr (0.20.2)

py7zr PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - gabposter =1.2.5, =1.3.5, =1.0.4, =1.0.0, =1.0.10, =1.0.0, =1.2.86 Source cves: CVE-2026-55195 Source advisory: OSV:GHSA-GJRG-MPP7-G774...

gabposter (>=1.2.5, <=1.2.8), open-webdriver (>=1.3.5, <=1.6.9) +4 more potentially affected by CVE-2026-23879 via py7zr (0.20.2)

py7zr PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - gabposter =1.2.5, =1.3.5, =1.0.4, =1.0.0, =1.0.10, =1.0.0, =1.2.86 Source cves: CVE-2026-23879 Source advisory: OSV:GHSA-Q6RC-2CGV-63H7...

qualys-iac-security (>=1.0.0b2, <=1.0.3) potentially affected by CVE-2026-23879 via py7zr (0.16.1)

py7zr PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - qualys-iac-security =1.0.0b2, =1.0.3 Source cves: CVE-2026-23879 Source advisory: OSV:GHSA-Q6RC-2CGV-63H7...

Cybersecurity Blind Spots in IaC and PaC Tools Expose Cloud Platforms to New Attacks

Cybersecurity researchers have disclosed two new attack techniques against infrastructure-as-code IaC and policy-as-code PaC tools like HashiCorp's Terraform and Styra's Open Policy Agent OPA that leverage dedicated, domain-specific languages DSLs to breach cloud platforms and exfiltrate data...

Why IaC Security Should Matter to CISOs

Explore how secure infrastructure-as-code IaC enables security leaders to help DevOps teams quickly deliver more business value...

The Evolution of DevSecOps

The DevOps methodology offers organizations of all sizes from across all industries a framework for delivering value and responsiveness. Instead of traditional distinct development and operations teams, DevOps embraces multidisciplinary teams that use efficient practices that support continuous...