Safeguard on social

PostgreSQL 14 is reaching end of life in November 2026. After that date it stops getting security fixes. This video shows how to find every place version 14 still runs and plan the upgrade before support ends. Try Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=fix-stories&utm_content=postgresql-14-eol Upgrade guide: https://safeguard.sh/resources/blog/postgresql-14-end-of-life-november-2026-upgrade-guide Topics: PostgreSQL 14 end of life, PostgreSQL upgrade, end of life software, software inventory, SBOM.

26 of the 68 advisories on the nginx project's security advisories page were fixed in releases shipped in 2026. Stable is now 1.30.6 and mainline 1.31.8 (26 October 2026), and the 1.28 branch ended with 1.28.3 on 24 March. If a distribution, container image or ingress controller ships your nginx, that packager sets your patch timing. An SBOM that records the build in every image and host turns an advisory into a lookup. Release history, advisory process and upgrade checklist: https://na2.hubs.ly/H08CDrJ0

26 of the 68 advisories on the nginx project's security advisories page were fixed in releases shipped in 2026. That is the patch cadence. The harder question is which nginx build you actually run. The upstream picture as of 26 October 2026: stable is 1.30.6 and mainline is 1.31.8. The 1.28 branch got its last release, 1.28.3, on 24 March 2026, and every advisory since 1.30.0 lists fixed versions only for 1.30 and 1.31. But if a distribution, container image or ingress controller ships your nginx, that packager sets your patch timing, and backports mean its version string may not match upstream ranges. So the useful artifact is an SBOM that records the build in every image and host. Then an advisory is a lookup, not a week of asking around. Safeguard's SBOM lookup shows where a component and version sits across your estate. Our nginx release history covers the branch model, TLS and HTTP/3, the advisory process and an upgrade checklist: https://lnkd.in/geDsS2vS Counts and versions as of 26 Oct 2026, from the nginx project's advisories and download pages. #nginx #SBOM #AppSec

26 of the 68 advisories on the nginx security advisories page were fixed in releases shipped in 2026. Patch cadence is the easy part. The hard part is knowing which nginx build runs in each image and host, because distribution and container packagers set your patch timing. An SBOM turns that question into a lookup. Release history, advisory process and upgrade checklist: link in bio, http://safeguard.sh/resources/blog Counts as of 26 Oct 2026. #nginx #sbom #appsec #devsecops

26 of the 68 advisories on the nginx advisories page were fixed in 2026 releases. Patch cadence is the easy part. Which nginx build runs in each image and host? Distro and container packagers set your timing. An SBOM turns that into a lookup. https://t.co/HPKunwnOsJ https://t.co/NknU87J0E5

Most security tools stall after the first enthusiastic team. The blocker is rarely scanning. It is identity and control. Our new post is the rollout guide for the platform owner and the identity architect: SAML 2.0, OpenID Connect or Google, Microsoft and GitHub sign-in, SCIM 2.0 provisioning, passkey and TOTP multi-factor, built-in and custom roles, a tenant and organization hierarchy, and an append-only audit log you can stream to your SIEM. It also gives a phased plan: pilot one team, put SSO, multi-factor and roles in first, run policies in Warn or Notify, then switch the gates that matter to Block. What to do today: draw your tree. One organization per business unit, a separate one for any group that must be hidden from the rest, and a product for each release train. Roles and policies attach to that structure, so decide it before anyone configures SSO. Read it here: https://lnkd.in/g8gQVDZZ #AppSec #SSO #DevSecOps

Stolen GitHub tokens are being used to push one workflow file that prints repository secrets into the Actions log. Researchers count 13,500+ planted branches across 850+ accounts. GitHub's approval hold covers public repos on http://github.com. Private repos and GitHub Enterprise Server are not covered. Check today: ci-sync-* branches, who can edit workflows, token lifetimes, required reviewers on production secrets. Link in bio: http://safeguard.sh/resources/blog #GitHubActions #DevSecOps #CICD

Anyone, or any token, that can push a workflow file to a repository can read every secret that repository can see. A campaign researchers call Gheist is built on exactly that. Per research published on 25 October, stolen GitHub tokens are used to push a ci-sync branch with one workflow file, sync-check. The push starts it, the job prints the secrets context into the Actions log encoded (so log masking misses it), and the run is deleted. Researchers count more than 13,500 planted branches across more than 850 accounts, and said the campaign was still active as of 24 October. GitHub's approval hold, announced 28 July, covers public repositories on https://lnkd.in/gumQgVic. It does not cover private repositories or GitHub Enterprise Server. What to check today: 1. Search every repo for branches matching ci-sync-xxxxxx, and look for runs deleted within a minute. 2. Review who and what can change workflow files. Most automation does not need to. 3. Check token scope and lifetime. Short-lived beats a classic token that never expires. 4. Put production secrets behind environments with required reviewers, and scope cloud trust to that environment. There is no CVE and nothing to patch. Indicators and exact commands: https://lnkd.in/gVdKqZka #GitHubActions #DevSecOps #CICD

Stolen GitHub tokens are being used to push one workflow file that prints repository secrets into the Actions log. What to check in your org today: ci-sync-* branches, who can change workflows, token scope and lifetime, and required reviewers on production secrets. Sources: research published 25 Oct 2026; GitHub changelog, 28 Jul 2026. Full write-up: https://na2.hubs.ly/H08CbQt0 #GitHubActions #DevSecOps #Shorts

Stolen GitHub tokens are being used to push one workflow file that prints a repository's secrets into the Actions log. Researchers count 13,500+ planted branches across 850+ accounts. GitHub's approval hold covers public repos on https://na2.hubs.ly/H08CbQs0, not private repos or GitHub Enterprise Server. Check today: ci-sync-* branches, who can edit workflows, token lifetimes, and required reviewers on production secrets. https://na2.hubs.ly/H08CbQv0

A real terminal session with the Safeguard CLI: install with one command, check the version, open the interactive terminal, ask for a change in plain words, approve each step, and scan a folder. Recorded live; this cut is captioned with a light music bed. For developers who want AppSec in the terminal and AI coding agent workflows with approvals. Try the interactive demo yourself: https://safeguard.sh/demos/safeguard-cli-in-action?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: Safeguard CLI, AI coding agent, command line security scanner, DevSecOps, AppSec, developer security, supply chain security, vulnerability scanning. Chapters 0:00 The Safeguard CLI, recorded live 0:06 Install with one command 0:20 Check the version 0:33 Open the interactive terminal 0:46 Ask in plain words 1:00 It reads first, then asks 1:13 Approve the install 1:27 Approve the tests 1:40 Done, with a summary 1:53 Choose how much it asks 2:06 Pick the model 2:20 Scan the folder 2:33 Install the CLI 2:39 Try it yourself

See how to set guardrails for AI agents and MCP tool access in Safeguard: choose the tools an agent may call, hide what it should not see, set request caps, and give each agent its own identity. A short product demo on AI agent security, Model Context Protocol (MCP) security, least privilege and AI guardrails. Try the interactive demo yourself: https://safeguard.sh/demos/mcp-guardrail?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: AI agent security, MCP security, Model Context Protocol, AI guardrails, least privilege, AI coding agents, agent permissions, AI governance. Chapters 0:00 Guardrails for AI agents 0:15 Guardrails 0:21 Choose the type 0:28 Pick the tools 0:36 Hide what it should not see 0:42 Set request caps 0:50 Saved 0:55 Agents have identities 1:03 Agents with limits 1:11 Try it yourself

Watch how to request a fixed, Gold version of a vulnerable open source package from your inventory in Safeguard Open Source Manager. Each request becomes a task assigned to Safeguard, for one package or every vulnerable package at once. A short product demo on vulnerability management, open source security and remediation when upstream has no fix. Try the interactive demo yourself: https://safeguard.sh/demos/fix-my-package?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: vulnerability management, remediation, open source security, software supply chain security, SBOM, dependency vulnerabilities, fork and patch, patch management. Chapters 0:00 Ask Safeguard for a fixed package 0:16 Your open source inventory 0:25 A package with no fix 0:36 Request sent 0:43 Source Gold for the inventory 0:51 The risks it covers 0:58 Tasks created 1:04 Fixed packages, on request 1:10 Try it yourself

Walk through getting ready for a SOC 2 Type 1 audit in Safeguard: turn on the framework, read your readiness score, see what the score rests on, open the controls, see why a control fails, turn gaps into tasks and plan the audit with your auditor. A short product demo on SOC 2 compliance automation, audit evidence and readiness gaps. Try the interactive demo yourself: https://safeguard.sh/demos/soc2-type1-in-a-day?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: SOC 2, SOC 2 Type 1, compliance automation, audit evidence, readiness assessment, controls, GRC, auditor, continuous compliance. Chapters 0:00 Get ready for a SOC2 Type 1 audit 0:16 Turn on SOC2 Type 1 0:25 Your readiness score 0:36 What the score rests on 0:47 Open the controls 0:56 See why a control fails 1:06 Gaps become tasks 1:15 Plan the audit 1:26 Ready to work with your auditor 1:34 Try it yourself

See continuous control monitoring in Safeguard: run every test, find the one that fails, see exactly what failed and who owns it, fix it, run it again, and watch the task close itself. A short product demo on continuous compliance, SOC 2 control testing and audit evidence that stays current. Try the interactive demo yourself: https://safeguard.sh/demos/continuous-monitoring?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: continuous monitoring, continuous compliance, control testing, SOC 2, compliance automation, audit evidence, GRC, drift detection. Chapters 0:00 From a failing test to a fixed control 0:14 Run every test now 0:18 One test fails 0:24 Exactly what failed 0:30 Who owns it 0:35 Fix it, then run it again 0:40 Passing again 0:45 The task closed itself 0:50 Monitored every day 0:55 Try it yourself

In the news, in October: two sets of flaws that CISA added to its Known Exploited Vulnerabilities catalog. Two PHP flaws nicknamed php2shell that allow unauthenticated remote code execution, and flaws in Collabora Online and Arista's VeloCloud Orchestrator. Mira and Cal cover what the public sources say, what is not known, and how to find every place PHP hides, patch the internet-facing systems first and check Nextcloud for web shells. Then a vendor story. In October a large IT services company said a subcontractor it uses for development and maintenance had been attacked, and that the subcontractor's legitimate accounts were then used against its customers. Two universities came forward with two very different failures: ransomware on a core platform, reached through a maintenance account, and a leak of personal data affecting about 78,000 people from a vendor's cloud storage that held files from finished work, shared with a partner the university had never been told about. Then the deep dive. A large AI lab filed its S-1 in late October, and its risk factors are more candid than any trust portal. Cal shows how to read a filing for security-relevant facts, how to separate boilerplate from things that already happened, and how to turn dated disclosures into vendor questions on data retention, agents, SBOMs, model withdrawal and incident notice. Theo answers what to ask an AI vendor before approving a tool, and the episode ends with five things to add to your vendor intake. If you run vendor risk management or third-party risk, this episode covers how to read an AI vendor's filing for your risk review, what to ask for in a security questionnaire, how to request and validate an SBOM, how to keep an AI-BOM, and how to handle vulnerability management and patch management when CISA adds exploited flaws to its KEV catalog. It also covers software supply chain security, subcontractor risk and prompt injection in AI agents. 00:00 Cold open, 00:32 Intro, 00:40 In the news, 03:32 The incident, 07:35 Deep dive, 15:25 Practitioner corner, 16:38 Fix it this week, 18:23 Outro. Sources S-1 guide (https://safeguard.sh/resources/blog/anthropic-s-1-ai-vendor-risk-security-teams?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep03) Incident (https://safeguard.sh/resources/blog/nec-subcontractor-breach-osaka-metropolitan-university-ransomware-osaka-university-77851?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep03) CISA PHP alert (https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) CISA KEV (https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) News (https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html) Topics: vendor risk management, third-party risk, TPRM, SBOM, AI-BOM, security questionnaire, CISA KEV, CVE-2026-109618, CVE-2026-109619, CVE-2026-110447, CVE-2026-114625, PHP, Nextcloud, patch management, software supply chain security, prompt injection, S-1 filing.

A hospital group says yes to your demo, then sends a contract with three letters in the title. B A A. There is no HIPAA certificate you can hold up, so what will they ask you to show? Mira and Cal sit in the reviewer's chair for a small software vendor's first request list from a hospital's privacy lead: a dated risk analysis, the sub-processor agreements, log review proof, training records and a breach notification path. They explain who counts as a business associate, what the rule says a B A A must contain, what required and addressable really mean, why the risk analysis comes first, and where the proposed Security Rule rewrite stands (a proposal, with a federal target of July 2027). Before that, two late October stories about patient data in someone else's system: the Quest Diagnostics filing about unauthorized access to a system clinics use for lab orders, and a Denver Health Medical Plan vendor incident involving an access key on a public website. Theo asks where a patient's name ends up in your company that is not the database. The episode ends with a checklist for before your window opens. Topics: HIPAA, business associate agreement (BAA), Security Rule, risk analysis, required and addressable, breach notification, vendor risk, SaaS compliance, Quest Diagnostics, Denver Health Medical Plan. Chapters 00:00 Cold open 00:46 Intro 01:14 News: two late October stories on vendors and patient data 05:14 Audit story: a hospital's request list, from the reviewer's chair 08:19 Deep dive: business associates, the BAA and the Security Rule 14:30 Practitioner corner 15:41 Before your window opens 17:15 Outro Sources HIPAA: what it is and who has to comply: https://safeguard.sh/resources/blog/hipaa-what-it-is-and-who-needs-to-comply?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA audit findings: why risk analysis tops the list: https://safeguard.sh/resources/blog/hipaa-audit-findings-risk-analysis-first?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA compliance checklist for SaaS companies: https://safeguard.sh/resources/blog/hipaa-compliance-checklist-for-saas?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA glossary: the terms engineers and buyers mix up: https://safeguard.sh/resources/blog/hipaa-glossary-plain-language-terms?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 How do you answer HIPAA questions on a customer security que: https://safeguard.sh/resources/blog/answering-customer-security-questionnaires-hipaa-questions?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 What should a startup do in its first 90 days of HIPAA?: https://safeguard.sh/resources/blog/hipaa-first-90-days-for-a-startup?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA Security Rule: how to automate evidence collection: https://safeguard.sh/resources/blog/hipaa-security-rule-automating-evidence-collection?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 How do software supply chain controls map to HIPAA?: https://safeguard.sh/resources/blog/hipaa-software-supply-chain-controls-mapped?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA Security Rule in Safeguard: risk analysis, safeguards : https://safeguard.sh/resources/blog/hipaa-security-rule-in-safeguard-risk-analysis-technical-safeguards-and-evidence?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02

A buyer asks for an ISO 27001 certificate when you already hold a SOC 2 report. How much of the work do you get to keep? Mira and Cal sit in the auditor's chair for a first ISO audit, from stage 1 documentation review to stage 2 testing and the surveillance visits that follow. They explain what the Statement of Applicability is, how Annex A (2022) is organised into 93 controls in four themes, why the management system around the controls is the part a SOC 2 never asks you to build, and which evidence (change and vulnerability management, access reviews, scan results) carries over. Before that, two October stories on paper trails: the DHS order on DeepSeek products in the Federal Register and the EDPB's anonymisation consultation. Theo takes a question to settle before you write a word of the ISMS: is your ISO scope the same as your SOC 2 system boundary? The episode ends with a checklist for before your window opens. Topics: ISO 27001, SOC 2, Statement of Applicability, Annex A (2022), management system, stage 1 and stage 2 audit, surveillance audit, scope, DHS Order #2026-01, EDPB anonymisation. Chapters 00:00 Cold open 00:34 Intro 00:54 News: the DHS supplier order and the EDPB anonymisation consultation 03:23 Audit story: a first ISO 27001 audit, stage 1 to stage 2 05:52 Deep dive: the Statement of Applicability, Annex A and what carries over from SOC 2 09:43 Practitioner corner 10:39 Before your window opens 11:40 Outro Sources What is ISO 27001?: https://safeguard.sh/resources/blog/what-is-iso-27001?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001:2022 Annex A controls guide: https://safeguard.sh/resources/blog/iso-27001-annex-a-controls-guide?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 certification: complete guide and requirements: https://safeguard.sh/resources/blog/iso-27001-certification-complete-guide-and-requirements?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 compliance for software development teams: https://safeguard.sh/resources/blog/iso-27001-compliance-for-software-development-teams?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 risk assessment: how to conduct one: https://safeguard.sh/resources/blog/iso-27001-risk-assessment-how-to-conduct-one?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 monitoring between surveillance audits: https://safeguard.sh/resources/blog/iso-27001-monitoring-between-surveillance-audits?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 vs SOC 2: which framework is right for you: https://safeguard.sh/resources/blog/iso-27001-vs-soc-2-which-framework-is-right-for-you?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 Your first SOC 2 audit should not require your first complia: https://safeguard.sh/resources/blog/scale-up-soc2-iso-compliance-without-a-team?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 SOC 2 Type II vs ISO 27001: what each certification actually: https://safeguard.sh/resources/blog/soc-2-type-ii-vs-iso-27001-what-each-certification-actually-covers?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 DHS Exclusion and Removal Order #2026-01, Federal Register n: https://www.federalregister.gov/d/2026-21447?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01

Day one on a new team. Sam installs one extension, signs in, and a warning shows up on a package she didn't choose. Mira and Cal walk through her first ten minutes with Safeguard in the editor and in the chat window: install the VS Code or JetBrains extension, sign in with the device flow, pick a remediation strategy, apply one fix, read the diff, and hand the pull request to a teammate. Then they connect Claude or ChatGPT to Safeguard's hosted MCP server and see what a fresh workspace can and cannot do. In the news, three October stories about things that ran before a person looked: a malicious LiteLLM release on PyPI (JFrog, 21 Oct; LiteLLM's own account, 23 Oct), a planted AGENTS.md that led Codex to try installing a malicious package (Forever Security, 25 Oct), and an npm worm that armed GitHub repositories with startup hooks for Claude, Cursor and VS Code (JFrog, 26 Oct). Under the hood, the inline Package Firewall check for typosquatting, dependency confusion and malicious package names, why a hosted MCP server means there is no package to install, and what to ask about any AI coding agent. Theo brings one setting, and the episode ends with a try-this-today checklist for secure coding with AI. Topics: AI coding agents, secure coding with AI, VS Code extension, JetBrains plugin, MCP server, MCP security, Claude connector, ChatGPT, Cursor, Claude Code, OpenAI Codex, LiteLLM, JFrog, Forever Security, AGENTS.md, npm worm, malicious packages, typosquatting, dependency confusion, supply chain security, code review of AI generated code. For developers trying AI coding agents: your first ten minutes with Safeguard in the editor and in chat, from the VS Code and JetBrains extensions to the MCP install, with notes on Claude Code, Cursor and GitHub Copilot, MCP security, prompt injection, permissions and AI code security. Chapters 00:00 Cold open 00:28 Intro 00:51 News: LiteLLM 1.107.0, a planted AGENTS.md, and the npm worm hooks 04:05 Sam's first ten minutes: editor and chat 08:07 Under the hood 10:02 Theo's one setting 10:52 Try this today 11:58 Outro Sources JFrog Security Research: LiteLLM 1.107.0 malicious release: https://research.jfrog.com/post/litellm-hijacked-again/ BleepingComputer: AI coding agents hijacked using AGENTS.md file in Do: https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/ JFrog Security Research: beyond testmetest, 42 hijacked GitHub repos: https://research.jfrog.com/post/beyond-testmetest-42-hijacked-github-repos/ The Register: worm armed 42 GitHub repos by hiding a payload too big t: https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570 LiteLLM: The attack chain behind the v1.107.0 LiteLLM release: https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain The Register: LiteLLM supply chain attack started with an exposed mast: https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544 IDE Support (docs): https://docs.safeguard.sh/docs/ide-support?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep02 MCP Integrations (docs): https://docs.safeguard.sh/docs/mcp?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep02 Topics: AI coding agents, Safeguard in the editor, VS Code, JetBrains, MCP, MCP security, prompt injection, LiteLLM, npm worm, AGENTS.md, Claude Code, Cursor, GitHub Copilot, Codex, AI code security, DevSecOps.

Where does your code go when you adopt a security platform? Our new post walks through every Safeguard deployment model: SaaS in the US, EU (Frankfurt) and Gov regions, private VPC, on-prem and air-gapped. It shows what leaves your network in each one, and how the local runner keeps source code on your machine.