Apple Brings Whole-Program C++ Hardening to Clang
Apple has added a new tool to the upstream LLVM project that could change how teams harden large C++ codebases. The clang-ssaf-driver, merged into LLVM Git this week, analyzes an entire project as it builds and then rewrites source code based on what it finds. The driver is part of Clang’s Scalable Static Analysis Framework […]
GitLab Fixes CVSS 10 Flaw in CI/CD Regex Engine, Plus 23 Other Vulnerabilities
GitLab is telling every self-managed customer to upgrade now. On October 12, the company shipped versions 19.4.2, 19.3.5, and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE). The releases fix 24 security vulnerabilities. One has a CVSS score of 10.0, the highest rating possible. GitLab.com already runs the patched code. GitLab Dedicated customers […]
GitHub Narrows App Permissions to Pull Teams Off Classic PATs
GitHub is giving DevOps teams more ways to limit an automation job to only the access it needs. A batch of GitHub Apps updates released Oct. 13 adds narrower permissions, relaxes a long-standing install restriction for repository administrators, and makes it easier to move users to expiring tokens. GitHub says the goal is to help […]
npm Puts a 48-Hour Clock on Unused Trusted Publishing Configurations
GitHub has added an expiration date to unused npm trusted publishing configurations. Any configuration that doesn’t complete a successful publish within 48 hours of creation now expires and can no longer authorize a release. It’s a small change. But it closes a gap that matters to anyone who publishes packages from a CI/CD pipeline. How […]
Noma Security Discloses Claude Code Desktop Exploit
Security researchers at Noma Security uncovered SneakPeek, a vulnerability in Anthropic’s Claude Code Desktop that allowed malicious JavaScript embedded in large HTML files to bypass sandbox protections and silently steal sensitive local data. The flaw exposed credentials, API tokens and Kubernetes configurations through the application’s preview pane. Although Anthropic has released a security update addressing the exploit, the discovery highlights growing software supply chain risks as AI coding tools become embedded in developer workflows without sufficient security oversight.
LocalStack Extends Emulation Reach to Microsoft Azure Services
LocalStack has made available a public beta of its platform that enables application developers to emulate Microsoft Azure cloud services on their local machines. Colin Neagle, head of marketing for LocalStack, said LocalStack now enables application developers to build software locally that can run across more than 40 Azure services. Following initial support for cloud […]
The Agent Failure Your Approval Gate Can’t Catch
An agent that does the wrong thing leaves evidence — a bad diff, a malformed record, a customer complaint. An agent that does nothing and reports success leaves a green checkmark, and green is the one signal your incident process is built to trust. Worry more about the second failure, because everything a DevOps team […]
IBM and Red Hat Disclose Discovery of More Than 400 Java Vulnerabilities
IBM and Red Hat this week reported they have identified and remediated more than 400 previously unknown vulnerabilities in Java libraries since launching a Lightwell initiative earlier this year. Additionally, Lightwell Clearinghouse, a program that enables IT organizations to submit specific open source software dependencies for priority review and remediation, is now generally available. Ben […]
New Relic Debuts Command-Line Observability Tool for Developers and AI Agents
New Relic has unveiled Ground Truth CLI, a command-line tool that enables software developers and AI agents to analyze system performance and verify whether technical issues have been resolved without needing to use dashboards. The release reflects a big shift in enterprise IT as AI agents take on more advanced troubleshooting tasks. Traditional observability dashboards […]
GitHub Slams the Brakes on Private Vulnerability Reports
Drowning in AI-generated bug reports? GitHub has a radical answer: Stop accounts from reporting them. GitHub’s new limits on bug reports aren’t a solution to the AI bug-report flood. Anything but! They’re an admission that the traditional security-disclosure workflow, with human maintainers in the loop, simply doesn’t scale. The scarce resource is no longer discovering […]
How to Move AI SRE Agents From Demo to Production
An AI agent that works on an engineer’s laptop can feel like a breakthrough. It can read logs, query observability tools, inspect cloud resources and connect a failed deployment to a bad configuration change in minutes. For a single investigation, under close human supervision, that is real progress. It is also the easy part. The […]
Base44 Unveils AI Platform to Transform Application Development
Base44 this week unfurled a cloud-based platform that leverages artificial intelligence (AI) to foster greater collaboration between software engineers, application designers and product management teams. Yoav Orlev, chief product officer for Base44, said at the core of the Base Code platform is a harness the company developed that enables multiple AI models to be used […]
AWS AI Agent Surfaces Recommendations to Optimize Cloud Computing Environments
Amazon Web Services (AWS) today made available a preview of an artificial intelligence (AI) agent that surfaces recommendations to optimize cost, security, performance and resilience based on the business objectives an organization defines. Jill Fariss, vice president of AWS Support, said the AWS Well-Architected Agent generates code that can be implemented via a command line […]
Survey Surfaces Sharp Increase in Amount of Code Written by AI
A global survey of 705 developers and IT leaders finds 42% of respondents reporting that artificial intelligence (AI) now writes at least half their code, with only 21% of developers now spending more than half their week writing new code from scratch. Conducted by BairesDev, a provider of software development services, the survey also finds […]
AWS Benchmark Aims to Reduce Number of False Positives Found by AI Vulnerability Scanners
Amazon Web Services (AWS) has developed a benchmark that can be used to test whether a model can distinguish real vulnerabilities from code that looks risky but is actually safe. The Deception Benchmark was created following an evaluation of the capabilities of 12 models from five different providers. In all, the benchmark includes 14,822 samples […]
DHH Declares End of Hand-Writing Code at Rails World 2026
Controversial developer David Heinemeier Hansson (aka DHH) announced last week at Rails World 2026 that the end of handwritten code is upon us, calling it the modern era’s “Brownie” moment. The moment to which he referred was when Kodak released its Brownie camera that forever changed the trajectory of photography. In this case, the Brownie […]
TeamPCP Supply Chain Attack Leads to CrowdSec Source Code Being Stolen
CrowdSec says attackers stole source code from about 170 private GitHub repositories after a TanStack npm supply chain attack exposed an OAuth token tied to a former employee.
US District Court Decision in AI’s Favor Worries Open-Source Developers
A federal appeals court handed GitHub, Microsoft, and OpenAI an important win in the first major appellate ruling over how AI coding tools can use open-source code. As we all know, all the AI code-generating programs learned their lessons largely from open-source code. So a group of anonymous open-source plaintiffs argued that GitHub Copilot and […]
StackHawk Delivers Wingman to Fix Vulnerabilities as Developers Write Code
StackHawk this week launched Wingman, an artificial intelligence (AI) tool that makes it possible for application developers to automatically fix vulnerability issues as code is being written. Wingman is designed to install into Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity. It scans the live application, interprets findings, and fixes vulnerabilities in a way that […]
Why AI Agents Shouldn’t Guess at Vulnerability Exploitability
Vulnerability prioritization is not a language problem. The safest agent architectures use models to interpret and explain, while deterministic systems traverse the evidence. Ask a security team a simple question: Of the vulnerabilities your scanner reported this morning, which ones can actually be exploited in production? The honest answer is often that nobody knows yet, […]
Atlassian Aims to Fill Context and Governance Gap for AI Coding Agents
Atlassian today extended the capabilities of its portfolio to provide teams of artificial intelligence (AI) coding agents with the level of context needed to build and deploy applications in production environments at much higher levels of scale. Code Context, built on Atlassian’s Teamwork Graph, makes it possible for AI coding agents to generate more reliable […]
Apica Adds AI Agents and MCP Server to Platform for Managing Telemetry Data
Apica today added an artificial intelligence (AI) agent and Model Context Protocol (MCP) server to version 3.0 of its Ascent platform for managing telemetry data pipelines. Andi Mann, chief product and technology officer for Apica, said the AI agent, dubbed Venn, makes it possible for IT teams to use natural language rather than having to […]
Observability 2.0: Why DevOps Teams Are Moving From Monitoring to Intelligent System Understanding
For a long time, monitoring just meant staring at dashboards and waiting for something to flash red. Engineers tracked things like CPU usage, memory, response times, error rates, and uptime. If a number crossed a certain line, you’d get an alert. Then, someone dived in to figure out what was wrong. That basic approach isn’t […]
Showing the 24 most recent articles. Additional archive pages are not yet available.