Matteo Bisi

19 Oct: for ~90 minutes, OVHcloud CLI GitHub releases were a credential stealer. Source was clean. How to check if you were in the window, and a first-hour playbook for the next poisoned CLI. www.msbiro.net/posts/ovhclo...

Every security review hits the same wall: the image is scanned, signed and pinned, but what the workload is allowed to reach lives somewhere else. Docker Sandbox Kits move that answer into the artifact, as an open standard on OCI. www.msbiro.net/posts/docker...

🎉 Abstract submitted for KubeCon + CloudNativeCon Europe 2027, together with Sebastiano Vida! 🤞 Thinking of submitting too? Deadline is approaching! 🚀☁️

Signed your SBOM? That is the middle, not the end. How I store, verify and rescan it with Harbor, Dependency-Track, GUAC, Ratify and Kyverno, with CRA in mind. www.msbiro.net/posts/sbom-s... #SBOM #SupplyChain

New lab: Apple Container 1.5.0 creates a Kubernetes cluster natively on Apple silicon, and SIGHUP Distribution installs cleanly on top. Kernel backstory, temporary k8s start removal, and an x86_64 furyctl cache quirk, all verified end to end. www.msbiro.net/posts/apple-...

third-party[.]com looked like a placeholder in 1700+ repos. It was never reserved like example.com. Someone registered it. No code changed. Trust did. How I audit external refs and trust assumptions: www.msbiro.net/posts/when-e...

AI agents can install tools, retry failed approaches, and explore an environment for hours. I wrote about microVMs, Firecracker, Kata Containers, and what the ECB’s AI cybersecurity letter means for banks: www.msbiro.net/posts/microv...

Opening a repo is not always read-only. A trusted VS Code workspace can run  tasks.json  on folder open. That makes the IDE part of your supply chain. A guide to malicious tasks, Workspace Trust, and untrusted repos: www.msbiro.net/posts/shift-... #DevSecOps #VSCode

Security can write the NIS2 policy. Security cannot merge the Helm chart. If the engineering manager cannot name the artefact and the sprint, you do not have a security gap. www.msbiro.net/posts/who-ow...

Kubernetes 1.37 brings three security capabilities worth planning for now: stable Pod certificates, Cluster Trust Bundles, and improved SELinux volume handling. www.msbiro.net/posts/kubern... #Kubernetes #CloudSecurity

AI coding agents can write code. Can they close work with proof? Grok Bot pairs execution with ownership, feedback, CI checks, and human review based on risk. Senior engineers remain the control plane. www.msbiro.net/posts/grok-b... #AIAgents

Your SOC receives a runtime alert. Can the analyst quickly establish who changed the workload, what traffic reached it, and what happened before the detection? Kubernetes audit logs and HAProxy ingress logs provide that evidence. www.msbiro.net/posts/kubern...

A DevSecOps seat is live on my team. Kubernetes, Policy-as-Code, shift-left, runtime security, and open source, not ticket closing. Hybrid: Vimercate, Rome, Catania, or Cascina. Italian + English (C1) required. JD + apply → www.linkedin.com/jobs/view/44...

Apple Container can run a local SIGHUP Distribution profile on Apple silicon. This walkthrough covers the current bootstrap recovery, registry-free local images, storage, Fluent Bit inotify tuning, and upcoming improvements for native creation and host access. www.msbiro.net/posts/apple-...

A kernel CVE hiding for 18 years. CVSS 8.5. Container escape. And it probably is not aimed at you. Severity and exposure are two different questions. www.msbiro.net/posts/sctpha...

OWASP GenAI LLM Top 10 2026 adds incident data to practitioner judgment, drawing on 7,714 real AI security incidents. www.msbiro.net/posts/owasp-...

"Just temporarily" is how an AI agent ends up with cluster-admin. K8s doesn't distinguish a destructive action by an attacker from the same action by an over-privileged agent. Shadow AI threat model, laptop to pod: www.msbiro.net/posts/shadow...

It's 2026 and I still get asked why encrypting secrets with git-crypt isn't enough. Short answer: encryption solves confidentiality, not revocation, audit logging, or dynamic secrets. DORA and NIS2 remove any remaining excuse. www.msbiro.net/posts/secret...

The ECB told bank CEOs AI is shortening the gap between vulnerability discovery and exploitation. Action plan due 31 October 2026, DORA as the foundation. Also extending the IT Risk Questionnaire deadline to Feb 2027. My breakdown with CNAPP, hardened images and SBOMs www.msbiro.net/posts/ecb-ai...

Built a fully local meeting-minutes pipeline: on-device speech-to-text + diarization on Apple Silicon, then a 14B model via Docker Model Runner and Docker Agent. No audio, transcript, or prompt ever leaves the machine. www.msbiro.net/posts/local-...

Episode 3 of my "Back to Basics" series: TLS and PKI from the ground up. What an X.509 certificate actually contains, how the chain of trust works, the TLS 1.3 handshake step by step, and the Kubernetes PKI most engineers never look at. www.msbiro.net/posts/back-t...

In 2026 I still get asked why enterprises need a hardened container image catalog. DORA and NIS2 mandate it. Container base images are infrastructure and deserve the same governance we always applied to operating systems. www.msbiro.net/posts/harden... #devsecops #nis2

Your engineering culture is not shaped by the all-hands. It is shaped by your EMs in every 1:1 this week. New post connecting McKinsey 2026 data to what I live daily as a team leader: why middle management is a CTO's highest-ROI investment. www.msbiro.net/posts/engine...

AI finds zero-days faster than disclosure was designed to handle. Athena is a new coalition: 24+ members, coordinated remediation before public disclosure, 20k findings, 2k patches already. My take on what it means for DevSecOps teams: www.msbiro.net/posts/athena...

Apple just introduced “container machine” with Container 1.0. Worth adding to your workflow? It depends, but it’s definitely interesting. www.msbiro.net/posts/apple-...

AI agents run with the privileges we give them, and attackers now operate at machine speed. Anthropic's Zero Trust for AI Agents eBook is the practical framework the field has been missing. My review: www.msbiro.net/posts/zero-t... #zeroTrust #agents #antrhopic

@cloudnativedaysitaly.org Italy 2026 is behind us, and Bologna was worth every bit of the work. As one of the organizers, I wrote a short recap of 2 full days, 40 sessions, 4 workshops, and the community conversations that made this edition special. www.msbiro.net/posts/cloud-...

@sentinelone.com purple-mcp: open-source MCP server for Singularity, 22 read-only tools. I tested the integration with Claude Code. One prompt → alert list, asset context, triage brief. ~6 seconds. No tab-switching. Tested against a live tenant. www.msbiro.net/posts/sentin...

Lazarus Group hides malware in git hooks, targeting developers through fake job interviews. Clone a repo. Run git merge. Your credentials are gone. Attack breakdown + five practical defences: www.msbiro.net/posts/lazaru...

🎉 PLATINUM SPONSOR ANNOUNCEMENT: Spectro Cloud Spectro Cloud helps enterprises orchestrate infrastructure from cloud to edge, and metal to model. They're also the sponsor behind the CNCF Kairos project: an immutable Linux meta-distribution designed for edge Kubernetes.

CVE-2026-31431 "Copy Fail": nine years in the kernel, root in 732 bytes of Python. No race conditions, no kernel offsets. Container namespaces don't protect you the page cache is shared across the host. Only runtime detection catches this. www.msbiro.net/posts/cve-20...

Ubuntu 26.04 LTS is out. I focused on the server side instead of the desktop headlines: security changes, cgroup v2-only, confidential VMs, sudo-rs, post-quantum SSH, and what it means for Ubuntu-based container workloads. www.msbiro.net/posts/ubuntu...

3 supply chain attacks in 3 weeks. Bitwarden CLI, Trivy, Axios , all used postinstall scripts to steal credentials from developer environments and CI/CD pipelines. EDR doesn't see it coming. I wrote up the pattern and 8 controls worth actually putting in place. 🔗 www.msbiro.net/posts/supply...

🎉 SMART SPONSOR ANNOUNCEMENT: @cncf.io Cloud Native Days Italy has always been deeply connected to the CNCF community with CNCF Ambassadors, maintainers, and contributors at the heart of our event. Together we've built a vibrant cloud-native community in Italy.

📚 BOOK SIGNING & GIVEAWAY For the first time ever, Pietro Libro and @artemlajko.bsky.social will sign copies of their book "Implementing GitOps with Kubernetes" together and it's happening at Cloud Native Days Italy 2026!

Tomorrow K8s 1.36 ships. Ingress NGINX retires, but on security side SELinux labeling GA (faster Pod startup on enforcing systems) + external ServiceAccount signing GA (KMS integration). I've written a breakdown focused on why these matter for your infrastructure → www.msbiro.net/posts/kubern...

🚨 THE COUNTDOWN IS ON! 🚨Only 1 month to go! Cloud Native Days Italy 2026 is just around the corner: May 18-19 in Bologna … and we couldn't be more excited! 🚀

🐧 Wrote a piece on Linux Kernel 7.0 from a platform security lens — what's changed, what it means for your infrastructure, and what leaders should be paying attention to. If you're in DevSecOps or cloud native, worth a read 👇 www.msbiro.net/posts/linux-... #Linux #DevSecOps #CloudNative

Coming solo or with your team? Let us know! 👇

☁️ @cloudnativedaysitaly.org 2026 is coming to Bologna on May 18-19 🇮🇹 Two full days with 2 tracks, workshops, great talks, and a dedicated maintainer space on day 2. I’m proud to help organize it! join us! Agenda cloudnativedaysitaly.org/agenda

Weekend experiment: As a spec-kit user, I wanted to test GSD (Get Shit Done), a different SDD framework built around preventing AI context rot. Starting point: zero production code. Comparison of both frameworks + full session walkthrough 👇 msbiro.net/posts/gsd-sbom-drift-spec-driven-development/

As an AI enthusiast and Security Team Leader, when I saw Docker Sandboxes I couldn't resist going deep. I installed it, broke it, fixed it, and ran GitHub Copilot CLI inside a sandbox. Here's what I found Big kudos to @docker.com for shipping this 🐳 🔗 msbiro.net/posts/docker-sandboxes-ai-agents/

KubeCon EU 2026 swag: 6 months of Copilot Pro+ First thing I did back home: raise the security baseline of my side project. OpenSSF Scorecard as required merge check · Dependabot for Go + GitHub Actions · SHA-pinned workflows · branch protection via gh api Write-up 👇 www.msbiro.net/posts/actui-...

⚡ KEYNOTE SPEAKER: GIACOMO TENAGLIA Chair, @cern.bsky.social Open Source Program Office 25 years building and running services on open-source software 🎤 Keynote talk: "Open Source at CERN" This is the kind of keynote that reminds us why open source matters.

🎉 COMMUNITY PARTNER ANNOUNCEMENT: theRedCode TheRedCode.it a tech blog that shares practical tech guides on DevOps, security and AI for dev and not, in small bits. A huge thank you to Serena Sensini for supporting Cloud Native Days Italy and contributing to the broader cloud-native community! 🙌

Just dropped my #KubeConEU 2026 recap. Fourth in a row, and this time also wearing the Cloud Native Days Italy organizer hat, that changed a lot. Short read, no fluff. 👇 msbiro.net/posts/kubecon-eu-2026-amsterdam-recap/

It's a wrap for KubeCon + CloudNativeCon week! 🇳🇱 Our CND Italy organizers and Reevo partners soaked it all in, and now we're bringing that energy back home to Bologna Today is your last chance to grab the KubeCon week discount! 🎟️ ti.to/apropos/clou...

Kubecon may be over, but the CND Italy Kubecon discount is still active! Last few days to grab tickets at €110 👀 📅 May 18-19, Bologna 🎟️ Use code CND-ITALY-26-KUBECON-EU-22326 at checkout. Valid until Sunday March 29th: ti.to/apropos/clou... #CNDItaly #CloudNativeDaysItaly2026

🎉 INTRODUCING: OUR FIRST CONFIRMED SPEAKERS! We're starting to reveal the incredible lineup for Cloud Native Days Italy 2026 and we couldn't be more excited. More announcements are coming soon as we finalize confirmations with additional speakers. 🎟️ cloudnativedaysitaly.org

Who said a conference doesn’t count as a workout? #Kubecon #Amsterdam