The DevSecOps Talks Podcast

Mattias Hemmingsson, Julien Bisconti and Andrey Devyatkin

This is the show by and for DevSecOps practitioners who are trying to survive information overload, get through marketing nonsense, do the right technology bets, help their organizations to deliver value, and last but not the least to have some fun. Tune in for talks about technology, ways of working, and news from DevSecOps. This show is not sponsored by any technology vendor and trying to be as unbiased as possible. We talk like no one is listening! For good or bad :) For more info, show notes, and discussion of past and upcoming episodes visit devsecops.fm

Play

Open in

26 episodes
Avg 38 min
English

Episodes 26

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

#116
Monday · 40 min
#116 - Hot Fridges, sshole and New Container Defenses
Exposed management interfaces can turn a software flaw into spoiled supermarket stock or an infrastructure foothold. Containers carrying shells and download tools can make the next step easier for attackers. Andrey Devyatkin and Mattias Hemmingsson connect the fridge attacks and Alpine SSH bypass to private administrative access, minimal container images, Go entrypoints and automated rebuilds. What you will learn Why private SSH access matters when password checks fail How scratch images and read-only filesystems constrain attackers after entry Why ECS health checks prompted FivexL to build lprobe How Go entrypoints remove a reason to keep Bash Where moving base image tags complicate the immutable tag rule Full article and show notes: https://devsecops.fm/episodes/116/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube
#115
October 26 · 29 min
#115 - Julien Bisconti on Node2Shell, PHP and Patch Panic
A merged security fix does nothing for a service still running the vulnerable build. A week of Node2Shell, PHP and GitLab vulnerabilities puts deployment speed, container contents and public exposure under scrutiny. Andrey Devyatkin, Mattias Hemmingsson and returning co-host Julien Bisconti discuss patch delivery, minimal containers, private GitLab access, PHP maintenance and the certificate trust stores that browser updates do not reach. What you will learn Why patching main and patching production are different milestones Why removing a shell does not eliminate interpreter-based attacks How mesh networks can restrict access to self-hosted GitLab When static HTML and CSS can replace a small PHP site Why browser certificate updates leave server trust stores to maintain Full article and show notes: https://devsecops.fm/episodes/115/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube
#114
October 19 · 19 min
#114 - Fridge Hacks and Security by Obscurity
A fridge controller exposed to the internet can put a supermarket's stock at risk. A password that changes every day offers little reassurance if anyone can calculate it. Andrey Devyatkin and Mattias Hemmingsson discuss refrigeration attacks, predictable passwords, AI-assisted reverse engineering, regex-based security checks and concerns about remote access to solar inverters. What you will learn Why hiding a password algorithm leaves predictable credentials exposed How VPN access and patching reduce risks to refrigeration controllers Why the hosts expect AI to help bypass regex-based checks How contractor-installed equipment can fall between security responsibilities Why remote access to solar inverters raises wider infrastructure concerns Full article and show notes: https://devsecops.fm/episodes/114/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube
#113
October 12 · 40 min
#113 - Books, Juniors and Mattias’s Dark Factories
When AI handles implementation, a junior's first assignment might be approving code headed straight to production. Does that teach enough, or should learning start with the problem and the specification? Andrey Devyatkin, Paulina Dubas and Mattias Hemmingsson debate junior learning in Mattias's dark factory, scope control before AI implementation, practical education and the vocabulary engineers gain from books. What you will learn How Mattias connects GitHub workflows, Kubernetes and Berget AI Why senior oversight and release impact matter for junior reviewers How scope checks before planning help limit oversized changes How answering before asking Claude can indicate an intern's progress Why shared vocabulary helps engineers describe problems to AI Full article and show notes: https://devsecops.fm/episodes/113/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube
#112
October 5 · 31 min
#112 - DevOps Careers: What Should You Learn Now?
What is worth learning when agents can handle more of the implementation? Deep knowledge of one vendor still has value, but incident experience, industry constraints and clear communication change what an engineer can contribute. Andrey Devyatkin and Mattias Hemmingsson discuss DevOps careers, failure knowledge, cloud specialization, business understanding and the maintenance burden of replacing SaaS with internal tools. What you will learn Why knowing failure modes remains valuable beyond learning service manuals How project risk changes the review needed for agent output What business understanding means beyond keeping Docker containers running How clear technical language helps agents understand requirements and constraints Why rebuilding SaaS can turn engineers into internal vendors Full article and show notes: https://devsecops.fm/episodes/112/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube
#111
September 28 · 29 min
#111 - AI Agents: When Helpful Becomes Harmful
An agent asked to build a service found an Argo CD repository and deployed it to a cluster. Helpful automation gets harder to trust when a request leaves room for actions nobody intended. Mattias Hemmingsson and Paulina Dubas discuss AI-assisted compliance checks, unexpected deployments, evolving guardrails, company AI bans and whether regulation improves transparency or prices smaller competitors out. What you will learn How Claude turned AWS database checks into reusable audit evidence How an agent found a deployment path through Argo CD Why vague instructions and guardrail edge cases cause unwanted actions Why approving a hosted assistant does not make it local Where the hosts see benefits and competitive risks in regulation Full article and show notes: https://devsecops.fm/episodes/111/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube
#110
September 14 · 20 min
#110 - Can Broken GitHub Actions Get Your AWS Account Blocked?
Why would a security improvement break a working deployment? Andrey questions the operational cost of GitHub’s OIDC change, while Mattias explains how repository renames can break AWS access. The hosts share a real incident involving a blocked account and discuss how to prepare for the change. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#109
September 11 · 33 min
#109 - Docker Got Quiet. Did You Miss Anything?
What changed in Docker while everyone was watching AI? The hosts review BuildKit, Buildx, security features, provenance, and the updates practitioners should know. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#108
September 11 · 30 min
#108 - Assume You’re Vulnerable: Security Beyond Patching
Are AI tools making software safer, or creating an endless patching treadmill? Mattias, Andrey, and Paulina discuss Dependabot, human review, and why teams should assume their software is already vulnerable. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#107
September 11 · 30 min
#107 - Continuous Integration in 2026: What Still Matters
CI changed how teams integrate code, but its core promise remains the same: integrate often and keep the mainline green. Andrey and Paulina trace its history and examine how Git, merge queues, and modern pipelines changed the mechanics. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#106
September 11 · 40 min
#106 - When Your Pet Project Tells You No
This is a lighter summer episode about building things for yourself. The hosts talk personal projects, fitness data, AI agents, and the honest gap between having a smart plan and doing the work. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#105
September 11 · 46 min
#105 - EU LLMs with Pawel Piwosz, Filipe Berti and Mark Shine
Are European LLMs good enough to protect company data without sacrificing capability? Pawel Piwosz, Filipe Berti, and Mark Shine discuss sovereignty, self-hosting costs, compliance, and the tooling Europe still needs. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#104
September 11 · 33 min
#104 - When AI Coding Gets 10x More Expensive
Is flat-rate AI coding coming to an end? Mattias, Paulina, and Andrey discuss Copilot’s token billing, runaway API costs, and why an expensive model can sometimes be the cheaper choice. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#103
June 14 · 56 min
#103 - European Cloud Sovereignty with Mark Shine, Pawel Piwosz and Filipe Berti
Mark Shine, Pawel Piwosz, and Filipe Berti discuss why the default choice of AWS, Azure, or GCP is no longer automatic for every team. The conversation covers cost, managed services, open source, AI workloads, and what European cloud providers can offer instead. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#102
June 5 · 51 min
#102 - The 90-Day Patch Window Is Dead With Ian Amit And Matias Madou
What happens when AI can turn patches into exploits in hours? The hosts discuss why the 90-day disclosure window is breaking, what Mythos Preview changes, and why shipping vulnerable code is becoming more expensive. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#101
June 4 · 38 min
#101 - Infrastructure as Code in 2026: Still Essential or Already Changing?
Six years after the podcast first covered infrastructure as code, what still holds up and what does not? The hosts revisit IaC through a 2026 lens: platform teams shipping secure-by-default modules, stacks becoming standard, GitOps making more sense for Kubernetes, and AI raising new questions instead of removing old ones. It is a practical look at where infra tooling is heading and what teams should stop assuming. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#100
May 7 · 40 min
#100 - 100 Episodes Later: What Still Matters in DevSecOps
What changed between episode 1 and episode 100, and what stayed surprisingly constant? The hosts revisit infrastructure as code, observability, incident response, secrets, compliance, and supply chain security through the lens of six years of conversations. It is part retrospective, part editorial reset for what the next 100 episodes should focus on. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#99
April 28 · 48 min
#99 - AI SRE and the End of 3 AM On-Call
Could AI handle the worst parts of incident response before you even join the call? Mattias and Paulina talk with Birol Yildiz about AI-written status updates, fast root cause analysis, and the path from read-only help to autonomous fixes. They also explore why post-mortems and documentation may be some of the best places to start. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#98
April 21 · 37 min
#98 - Beyond AI SRE
Andrey shares the thinking behind Boris and the idea of going beyond AI SRE. The conversation covers the DevOps talent shortage, the coming squeeze on AI costs, why repeatable operational tasks are a strong fit for agents, and why customer data should stay in the customer's own AWS account. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel
#97
April 15 · 35 min
#97 - Shift Left, Get Hacked: Supply Chain Attacks Hit Devs
March 2026 made supply chain attacks feel a lot less theoretical, but what made these incidents different? The hosts discuss compromised publishing credentials, automatic execution hooks like post-install scripts and Python `.pth` files, and how both humans and security tools caught the malicious releases. They also talk through concrete ways to make developer environments harder to abuse. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel

Showing 1–20 of 26 episodes