The DevSecOps Talks Podcast

Hosted by Mattias Hemmingsson, Julien Bisconti and Andrey Devyatkin

TechnologyInterviews guests

Website RSS feed

Episodes

100

Latest episode

Oct 2026

Language

About the show

This is the show by and for DevSecOps practitioners who are trying to survive information overload, get through marketing nonsense, do the right technology bets, help their organizations to deliver value, and last but not the least to have some fun. Tune in for talks about technology, ways of working, and news from DevSecOps. This show is not sponsored by any technology vendor and trying to be as unbiased as possible. We talk like no one is listening! For good or bad :) For more info, show notes, and discussion of past and upcoming episodes visit devsecops.fm

Listen to episodes

60 recent

October 26, 2026Episode 11529 min

#115 - Julien Bisconti on Node2Shell, PHP and Patch Panic

A merged security fix does nothing for a service still running the vulnerable build. A week of Node2Shell, PHP and GitLab vulnerabilities puts deployment speed, container contents and public exposure under scrutiny. Andrey Devyatkin, Mattias Hemmingsson and returning co-host Julien Bisconti discuss patch delivery, minimal containers, private GitLab access, PHP maintenance and the certificate trust stores that browser updates do not reach. What you will learn Why patching main and patching production are different milestones Why removing a shell does not eliminate interpreter-based attacks How mesh networks can restrict access to self-hosted GitLab When static HTML and CSS can replace a small PHP site Why browser certificate updates leave server trust stores to maintain Full article and show notes: https://devsecops.fm/episodes/115/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

October 19, 2026Episode 11419 min

#114 - Fridge Hacks and Security by Obscurity

A fridge controller exposed to the internet can put a supermarket's stock at risk. A password that changes every day offers little reassurance if anyone can calculate it. Andrey Devyatkin and Mattias Hemmingsson discuss refrigeration attacks, predictable passwords, AI-assisted reverse engineering, regex-based security checks and concerns about remote access to solar inverters. What you will learn Why hiding a password algorithm leaves predictable credentials exposed How VPN access and patching reduce risks to refrigeration controllers Why the hosts expect AI to help bypass regex-based checks How contractor-installed equipment can fall between security responsibilities Why remote access to solar inverters raises wider infrastructure concerns Full article and show notes: https://devsecops.fm/episodes/114/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

October 12, 2026Episode 11340 min

#113 - Books, Juniors and Mattias’s Dark Factories

When AI handles implementation, a junior's first assignment might be approving code headed straight to production. Does that teach enough, or should learning start with the problem and the specification? Andrey Devyatkin, Paulina Dubas and Mattias Hemmingsson debate junior learning in Mattias's dark factory, scope control before AI implementation, practical education and the vocabulary engineers gain from books. What you will learn How Mattias connects GitHub workflows, Kubernetes and Berget AI Why senior oversight and release impact matter for junior reviewers How scope checks before planning help limit oversized changes How answering before asking Claude can indicate an intern's progress Why shared vocabulary helps engineers describe problems to AI Full article and show notes: https://devsecops.fm/episodes/113/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

October 5, 2026Episode 11231 min

#112 - DevOps Careers: What Should You Learn Now?

What is worth learning when agents can handle more of the implementation? Deep knowledge of one vendor still has value, but incident experience, industry constraints and clear communication change what an engineer can contribute. Andrey Devyatkin and Mattias Hemmingsson discuss DevOps careers, failure knowledge, cloud specialization, business understanding and the maintenance burden of replacing SaaS with internal tools. What you will learn Why knowing failure modes remains valuable beyond learning service manuals How project risk changes the review needed for agent output What business understanding means beyond keeping Docker containers running How clear technical language helps agents understand requirements and constraints Why rebuilding SaaS can turn engineers into internal vendors Full article and show notes: https://devsecops.fm/episodes/112/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

September 28, 2026Episode 11129 min

#111 - AI Agents: When Helpful Becomes Harmful

An agent asked to build a service found an Argo CD repository and deployed it to a cluster. Helpful automation gets harder to trust when a request leaves room for actions nobody intended. Mattias Hemmingsson and Paulina Dubas discuss AI-assisted compliance checks, unexpected deployments, evolving guardrails, company AI bans and whether regulation improves transparency or prices smaller competitors out. What you will learn How Claude turned AWS database checks into reusable audit evidence How an agent found a deployment path through Argo CD Why vague instructions and guardrail edge cases cause unwanted actions Why approving a hosted assistant does not make it local Where the hosts see benefits and competitive risks in regulation Full article and show notes: https://devsecops.fm/episodes/111/ Discuss the episode on LinkedIn DevSecOps Talks on YouTube

September 14, 2026Episode 11020 min

#110 - Can Broken GitHub Actions Get Your AWS Account Blocked?

Why would a security improvement break a working deployment? Andrey questions the operational cost of GitHub’s OIDC change, while Mattias explains how repository renames can break AWS access. The hosts share a real incident involving a blocked account and discuss how to prepare for the change. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel

September 11, 2026Episode 10933 min

#109 - Docker Got Quiet. Did You Miss Anything?

What changed in Docker while everyone was watching AI? The hosts review BuildKit, Buildx, security features, provenance, and the updates practitioners should know. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel

September 11, 2026Episode 10830 min

#108 - Assume You’re Vulnerable: Security Beyond Patching

Are AI tools making software safer, or creating an endless patching treadmill? Mattias, Andrey, and Paulina discuss Dependabot, human review, and why teams should assume their software is already vulnerable. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel

September 11, 2026Episode 10730 min

#107 - Continuous Integration in 2026: What Still Matters

CI changed how teams integrate code, but its core promise remains the same: integrate often and keep the mainline green. Andrey and Paulina trace its history and examine how Git, merge queues, and modern pipelines changed the mechanics. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel

September 11, 2026Episode 10640 min

#106 - When Your Pet Project Tells You No

This is a lighter summer episode about building things for yourself. The hosts talk personal projects, fitness data, AI agents, and the honest gap between having a smart plan and doing the work. We are always happy to answer any questions, hear suggestions for new episodes, or hear from you, our listeners. DevSecOps Talks podcast LinkedIn page DevSecOps Talks podcast website DevSecOps Talks podcast YouTube channel