GitLab Orbit now in Google Antigravity MCP Store

As AI shrinks time to vulnerability discovery, engineering teams need the right context to remediate issues quickly with their security teams before bad actors exploit them. Premium and Ultimate customers using Antigravity can now tap Orbit's context directly, so coding agents gain context from across their full GitLab instance including security findings. More below:

A coding agent sees the files in your editor and the terminal, but it doesn't know which services depend on the code you're changing, or who reviewed a similar change last quarter. That context lives in GitLab. Before editing a line of code, Orbit now gives developers working in Google Antigravity the power to ask one question about their GitLab instance and get back what depends on it, which open merge requests touch key files, what projects are impacted, and who owns them. Learn more below.

We're focused on partnerships that give customers flexibility in how they reach GitLab's capabilities, wherever their teams already work. Premium and Ultimate customers using Antigravity can now tap Orbit's context directly, so coding agents gain context from across their full GitLab instance. Check it out!! More below

Giving agents the right context is a foundational challenge in agentic coding. An agent that can't see what depends on the module it's editing will make changes that break things nobody knew were connected. Orbit is now in Antigravity's MCP Store, giving teams a governed knowledge graph linked directly into the coding platform. Agents can query what a change actually touches in their GitLab instance before they make it. Read the blog:

Another step forward in the GitLab × Google partnership. GitLab Orbit is now live in the Google Antigravity MCP Store — bringing the same governed knowledge graph that powers Duo Agent Platform natively into Google's agent-first development environment. Developers get structured agent access to their GitLab projects, pipelines, MRs, vulnerabilities, and source code. Directly from Google's agent-first development platform. No setup friction. What that unlocks in practice: up to 11x faster responses, 4.5x fewer tokens, 45x fewer hallucinations in early internal tests. Thank you for your partnership Granville Valentine Chris Eck Allison O'Holleran Alex Picker Eliran Mesika Nitin Singhal BJ Adesoji Regnard Raquedan Michael Angelo Rivera Meg Corren

A bot that runs fine in development can silently fail in production in ways you never expect. Recently I ran a full audit on a production Hetzner dedicated server running three Playwright-based scraping bots for a client. The server was hardened, monitored, and I was confident everything was solid. Then I simulated a crash. One of the bots restarted — but the browser never came back up. No obvious error in the app logs. Just silent failure on every request. Dug deeper. Found zombie Chrome processes. Then found the real culprit: /tmp/.X99-lock Xvfb, the virtual display Chrome depends on inside the container, had left behind a stale lock file from the previous crash. On restart, it tried to claim display :99 again, saw the lock, and silently gave up. No Xvfb meant no display. No display meant no Chrome. No Chrome meant every request failed. One line in the entrypoint script fixed it: rm -f /tmp/.X99-lock But the audit also surfaced something else worth sharing. The server had been live for 8 days. In that time, Fail2ban had already automatically banned 3 IPs attempting SSH brute force attacks — from China, Russia, and a known scanner in the Netherlands. Password authentication was still enabled from initial setup. That got disabled immediately. Two lessons from this: 1. Crash testing is not optional. A container being up does not mean it is functional. Test the restart, then test what happens after the restart. 2. A public server gets probed within hours of going live. SSH hardening, key-only authentication, and Fail2ban are not optional extras — they are baseline. Production is a different environment. Audit it like one. #DevOps #Linux #Docker #ServerSecurity #Playwright #SRE

Your CI/CD pipeline probably has stronger controls on what comes in than what goes out. GitHub Actions runners have unrestricted outbound internet access by default. If a compromised dependency, malicious Action, or supply chain attack makes its way into the pipeline, it can communicate with destinations your organization never intended it to reach. Learn how to apply default-deny egress enforcement to GitHub-hosted, self-hosted, and Kubernetes-based runners to help contain supply chain attacks before exfiltration occurs. 👇🔗 #CloudSecurity #DevSecOps #ZeroTrust

Most teams are running Kubernetes in production. Most of them have no idea how badly it can be misconfigured. Our next BreachForce session is a hands-on K8s penetration testing workshop — covering real misconfigs, pod security gaps, and how to actually assess a cluster, not just read about it. Speaker: Abhishek Pal Difficulty: Intermediate (some Docker/container familiarity helps) You'll need to bring your laptop with a lab VM pre-loaded — setup instructions are in the event link below. 📍 Online | Free to attend 🔗 Register on Luma: breachforce.net/upcoming If you've been putting off understanding the security side of container infra, this is the one to show up for. BreachForce | Community-run. No paywalls. No fluff. Tag someone who keeps saying "we should look into K8s security" and never does. 👇

Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)