GitLab Fixes CVSS 10 Flaw in CI/CD Regex Engine, Plus 23 Other Vulnerabilities
GitLab is telling every self-managed customer to upgrade now. On October 12, the company shipped versions 19.4.2, 19.3.5, and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE). The releases fix 24 security vulnerabilities. One has a CVSS score of 10.0, the highest rating possible. GitLab.com already runs the patched code. GitLab Dedicated customers […]
GitHub Narrows App Permissions to Pull Teams Off Classic PATs
GitHub is giving DevOps teams more ways to limit an automation job to only the access it needs. A batch of GitHub Apps updates released Oct. 13 adds narrower permissions, relaxes a long-standing install restriction for repository administrators, and makes it easier to move users to expiring tokens. GitHub says the goal is to help […]
npm Puts a 48-Hour Clock on Unused Trusted Publishing Configurations
GitHub has added an expiration date to unused npm trusted publishing configurations. Any configuration that doesn’t complete a successful publish within 48 hours of creation now expires and can no longer authorize a release. It’s a small change. But it closes a gap that matters to anyone who publishes packages from a CI/CD pipeline. How […]
Anthropic Builds Its Own Source Control After AI Agents Outgrow Git
Anthropic has moved its internal monorepo off Git and onto a version control system it built from scratch. The reason is simple. Its AI agents now write code faster than Git-based infrastructure can handle it. In a post on its engineering blog, the company said it averaged about 2,500 merged code changes a day in […]
Noma Security Discloses Claude Code Desktop Exploit
Security researchers at Noma Security uncovered SneakPeek, a vulnerability in Anthropic’s Claude Code Desktop that allowed malicious JavaScript embedded in large HTML files to bypass sandbox protections and silently steal sensitive local data. The flaw exposed credentials, API tokens and Kubernetes configurations through the application’s preview pane. Although Anthropic has released a security update addressing the exploit, the discovery highlights growing software supply chain risks as AI coding tools become embedded in developer workflows without sufficient security oversight.
GitHub Ties Every Commit to the Account That Pushed It
GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer information. A new repository rule can also block pushes when committer details don’t match the authenticated account, helping DevOps teams combat identity spoofing, improve audit trails and strengthen software supply chain security.
AI Is Automating Code. The Job Is Engineering
AI is automating coding, but software engineering still requires human judgment. Explore what shifting developer demand means for DevOps, QA and software delivery.
Cloudflare Brings the Deno Team In to Make Self-Hosted Workers Practical
Cloudflare brings Deno’s team aboard to expand self-hosted Workers and Durable Objects as Deno Deploy winds down and runtime support enters its final year.
LocalStack Extends Emulation Reach to Microsoft Azure Services
LocalStack has made available a public beta of its platform that enables application developers to emulate Microsoft Azure cloud services on their local machines. Colin Neagle, head of marketing for LocalStack, said LocalStack now enables application developers to build software locally that can run across more than 40 Azure services. Following initial support for cloud […]
Ten Great DevOps Job Opportunities
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of […]
The Agent Failure Your Approval Gate Can’t Catch
An agent that does the wrong thing leaves evidence — a bad diff, a malformed record, a customer complaint. An agent that does nothing and reports success leaves a green checkmark, and green is the one signal your incident process is built to trust. Worry more about the second failure, because everything a DevOps team […]
OllyGarden Extends AI Agent to Identify Instrumentation Gaps
OllyGarden expands its Rose AI agent with Minimum Viable Instrumentation to identify observability gaps, optimize OpenTelemetry data and reduce telemetry costs.
IBM and Red Hat Disclose Discovery of More Than 400 Java Vulnerabilities
IBM and Red Hat this week reported they have identified and remediated more than 400 previously unknown vulnerabilities in Java libraries since launching a Lightwell initiative earlier this year. Additionally, Lightwell Clearinghouse, a program that enables IT organizations to submit specific open source software dependencies for priority review and remediation, is now generally available. Ben […]
Attaching Evidence to Alerts: an Enrichment Sidecar for Alertmanager
Every on-call engineer knows the ritual. A page lands in Slack: the 5xx rate on a service is above the threshold. The message tells you that something is wrong and nothing about what. So you open Kibana or Loki in another tab, set the time window to the last few minutes, filter by the service, […]
New Relic Debuts Command-Line Observability Tool for Developers and AI Agents
New Relic has unveiled Ground Truth CLI, a command-line tool that enables software developers and AI agents to analyze system performance and verify whether technical issues have been resolved without needing to use dashboards. The release reflects a big shift in enterprise IT as AI agents take on more advanced troubleshooting tasks. Traditional observability dashboards […]
Docsy for AI Agents, Oh, and People Too
Google’s Docsy is joining the Linux Foundation as AI agents become documentation readers. Prague — When I grew up in programming, if you didn’t understand something in the code or operating system, you were told to Read The Fine (Ah, yeah, fine) Manual (RTFM). Of course, back then we actually had manuals and documentation. Since […]
Harness Acquires Augment Code Assets to Expand Reach into AI Coding
Harness today added an artificial intelligence (AI) coding offering to its portfolio after revealing it acquired select assets from Augment Code. The Harness Cosmos Software Factory is based on Cosmos, a set of AI coding agents, an Auggie command line interface (CLI), a Code Context Engine and other related technologies originally developed by Augment Code. […]
Secrets Sprawl and Rotation: A Practical Vault Management Playbook
In 2025 alone, security firm GitGuardian detected 28.65 million new hardcoded secrets exposed in public GitHub commits — a 34% increase year over year and the largest single-year jump the company has recorded in five years of publishing its annual State of Secrets Sprawl report. Since 2021, that number has grown 152%, far outpacing the […]
Coding Agents Broke Git’s Scaling Math. GitHub Is Rebuilding to Keep Up
GitHub is rebuilding its Git infrastructure as AI coding agents drive billions of commits, promising up to 35x faster writes while exposing new DevOps bottlenecks.
AI Is Taking on Entry-Level Engineering Work. Who Trains the Young Engineers?
When I started my career on a support desk, I dealt with failed logins, missing permissions and recurring system errors every day. The work was repetitive, but repetition taught me to spot patterns, test assumptions and look beyond the symptom a user reported. Over time, I was resolving around 90% of incidents at first contact. […]
HackerOne Report Surfaces Massive Increase in Vulnerability Backlogs
HackerOne research shows vulnerability remediation is getting faster, but AI-driven discovery is expanding exposure debt even more quickly, putting DevSecOps teams under growing pressure.
DevOps Has Always Been Hard to Define. Does a Standard Help?
The new DevOps Standard deserves a serious reading. Its lasting value will depend on whether it helps organizations apply shared principles as people and agents take on different responsibilities.
Federated Query at Petabyte Scale: A Deployment Pattern for a Governed AI-Agent Data Layer
A federated query architecture can reduce data duplication and latency while creating a governed, auditable data layer that enterprise AI agents can safely access.
Showing the 24 most recent articles. Additional archive pages are not yet available.