Description

A merged security fix does nothing for a service still running the vulnerable build. A week of Node2Shell, PHP and GitLab vulnerabilities puts deployment speed, container contents and public exposure under scrutiny.

Andrey Devyatkin, Mattias Hemmingsson and returning co-host Julien Bisconti discuss patch delivery, minimal containers, private GitLab access, PHP maintenance and the certificate trust stores that browser updates do not reach.

What you will learn

• Why patching main and patching production are different milestones
• Why removing a shell does not eliminate interpreter-based attacks
• How mesh networks can restrict access to self-hosted GitLab
• When static HTML and CSS can replace a small PHP site
• Why browser certificate updates leave server trust stores to maintain

Full article and show notes: https://devsecops.fm/episodes/115/

Discuss the episode on LinkedIn

DevSecOps Talks on YouTube