News
GitHub Puts Copilot in the Approval Seat for Pull Requests
Tom Smith | | AI code review, AI coding, AI Governance, automated code review, branch protection, code review, Copilot code review, developer productivity, developer tools, devops, Engineering Governance, github, GitHub approvals, GitHub Copilot, PR approvals, pull requests, software development, software lifecycleGitHub Copilot can now submit binding pull request approvals, moving AI code review from advisory feedback into the merge decision itself ...
Debian’s AI Vote Bets on Accountability Instead of a Ban
Tom Smith | | AI coding, AI Governance, AI policy, AI-assisted development, AI-generated code, code review, confidential data, Debian, developer productivity, devops, generative AI, Human Oversight, open source, software development, software securityDebian’s new AI contribution policy avoids bans and mandatory disclosure, instead making developers responsible for reviewing AI-generated work and protecting sensitive data ...
Broadcom Launches TrueSource Service to Secure Spring Framework
Mike Vizard | | AI coding, Apache Tomcat, application security, Bitnami Secure Images, Broadcom, container security, dependency security, devsecops, java, kubernetes, node.js, open source security, open source vulnerabilities, patch management, Python, SBoM, secure software development, software artifacts, Software Supply Chain Security, Spring framework, Spring Security, Tanzu, TrueSource Trusted Artifacts, VMware explore, vulnerability managementBroadcom launches TrueSource Trusted Artifacts to provide hardened Spring dependencies, secure open source packages and automated vulnerability remediation ...
A Simple Website Summary Just Exposed the Limits of AI Coding Guardrails
Tom Smith | | agentic AI security, AI agent security, AI coding assistants, AI guardrails, AI security, Anthropic, Auto Mode, Claude Code, Claude Opus 5, devops security, indirect prompt injection, Johann Rehberger, network egress, platform engineering, prompt injection, Python module shadowing, RCE, remote code execution, sandboxing, struct.pyClaude Code’s Auto Mode was bypassed in an attack chain that turned a routine webpage summary into remote code execution, highlighting the limits of AI agent guardrails ...
GitHub Tightens Copilot’s Billing and Governance Rules Ahead of a Busy Fall
Tom Smith | | AI cost management, AI Governance, Balanced review, chat data retention, Copilot billing, Copilot Business, Copilot Chat, Copilot cloud agent, Copilot code review, Copilot Enterprise, developer tools, GitHub AI Credits, GitHub Copilot, GitHub Mobile, Lite review, platform engineering, token-based billing, usage based billingGitHub Copilot is tightening enterprise controls with upfront seat billing, longer chat retention and a Balanced code review default ...
Report Shines Spotlight on 91 Vulnerabilities Fixed in Latest Update to Spring Framework
Mike Vizard | | AI cybersecurity, AI vulnerabilities, application security, Broadcom, CVEs, devsecops, Java security, open source security, open source vulnerabilities, patch management, security automation, software components, Software Supply Chain, sonatype, Spring framework, Spring vulnerabilities, technical debt, virtual patching, vulnerability managementSonatype says 91 Spring vulnerabilities affecting more than 209,000 software components highlight how AI is accelerating vulnerability discovery and creating a new patching challenge for DevSecOps teams ...
Dash0 Acquires Polar Signals for Continuous Profiling and GPU Visibility
Observability startup Dash0 announced this week that it acquired Berlin-based continuous profiling specialist Polar Signals. The deal adds continuous profiling to SignalStore, Dash0’s OpenTelemetry-native data platform. Continuous profiling has been part of ...
Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack
Jeff Burt | | arrayref, information stealing, North Korea, Rust programming language, software supply chain attacks, StepSecurity, typosquatting, Wiz ResearchSecurity researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the account of the maintainer of multiple Rust crates and introducing four more ...
Critical Flaw in isolated-vm Can Lead to Sandbox Escape, RCE Threat
Jeff Burt | | Activepieces, AI security, C/C++, Endor Labs, isolated-vm, JavaScript security, Mastra, n8n, Node.js security, remote code execution, Sandbox, software vulnerability, TOCTOU, V8 Isolate, vm2Developers for years have been using vm2, an open-source Node.js library, to run untrusted JavaScript inside a secure and isolated sandbox environment. It uses Node.js’s built-in modules and JavaScript Proxies and lets ...
Cursor Launches Origin Code Hosting Platform as GitHub Rival
AI coding provider Cursor has launched Origin, a code hosting platform that puts source code and AI coding agents inside the Cursor development environment. The new coding platform expands the company into ...
Claude Code’s Temporary Usage Boost Expires Tonight. Here’s What Actually Changes
Tom Smith | | AI agents, AI coding agents, AI coding costs, AI coding tools, AI subscription pricing, Anthropic, CI pipelines, Claude Code, Claude Code usage limits, developer productivity, devops, Fable 5, software development, token limits, weekly usage capsAnthropic’s temporary 50% increase to Claude Code weekly usage limits expires August 19, reducing available capacity for developers and DevOps teams without lowering subscription prices ...
Adronite Unveils AI Coding Tool Based on Embedded Context Engine
Mike Vizard | | ACE, Adronite, Adronite Context Engine, AI code generation, AI coding assistants, AI coding tool, AI-generated code, code review, codebase context, Codistry, developer tools, devops, open-weight AI models, software development, token efficiencyAdronite launches Codistry, an AI coding tool that uses a context engine to map codebases, reduce token usage and generate more production-ready code ...
