News and Tech Update

AI coding assistants have become an essential part of developers’ work, automating many of the repetitive tasks – think boilerplate coding and scaffolding – that in the past ate up a lot of their time. More jobs can now get done faster. That said, such agents also represent a significant security risk, making developers – who were already targets of cybercriminals – even more attractive. In recent weeks, cybersecurity researchers have reported on such threats as “ HalluSquatting ” and “ GhostApproval ,” which target developers and their AI tools. That’s in part because the adoption of AI coding agents is outpacing the development of security tools to protect them. Cyberhaven Lab researchers noted in May that adoption of AI coding agents was growing faster than the use of any other AI tool, jumping 357% between February 2025 and this year. They also are the highest-risk category. “When a developer pastes a code block into a coding assistant, or when an agentic coding tool browses a ...

A developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore through the @redhat-cloud-services npm namespace in June, its malicious releases carried real SLSA provenance, because they were built in Red Hat’s own GitHub Actions workflows and published with legitimate OIDC tokens minted for those runs. To a registry scanner, the poisoned versions were indistinguishable from a routine update. The closest analogy is a deepfake. On a video call, a synthetic face can pass at first glance, and you only catch it when something underneath gives it away. Software supply chain attacks have reached the same point, with one difference that makes them worse: A deepfake at least gives you something to catch. Miasma’s packages offered nothing at the level scanners look. The provenance was genuine; every signal a scanner checked was real, just worn by the wrong ...

When a certificate expires, it can take down a production system, and teams usually only find out after something goes wrong. These issues are hard to catch because they rarely trigger alerts. Expired certificates often remain unnoticed in a config file or an old key until they cause trouble. Enterprise apps are no longer single, self-contained programs. Today, a typical app includes many services, APIs, mobile clients, and new cloud workloads are added all the time. Instead of asking, “Are we secure enough?” it is better to ask whether security was built in from the beginning or added later. Most teams still add it later, which often ends up costing more. According to IBM’s 2023 Cost of a Data Breach Report, the global average cost of a data breach is $4.45 million, and credential and identity failures are a common cause.​ The Cryptographic Foundation Most Teams Overlook Much of this depends on Public Key Infrastructure (PKI), but many teams do not fully understan...

Harness today extended the reach of its core continuous integration/continuous delivery (CI/CD) platform to enable DevOps teams to build and deploy artificial intelligence (AI) agents. At the core of that capability are five additions to the Harness portfolio, including an AI Asset Catalog that automatically discovers every agent, skill, and plugin that exists within repositories and, just as importantly, who within the organization owns them. There is also a Harness AI Evals tool that measures the quality of an AI agent by creating gates that automatically catch regressions whenever an agent or model changes. Additionally, an Agent Deployments offering extends the canary releases, approvals, and Open Policy Agent (OPA) guardrails that Harness already applies to Kubernetes deployments to managed agent runtimes like Amazon Bedrock AgentCore and Google’s Agent Runtime. AI Configs, meanwhile, provides access to a feature management tool to manage prompts and model changes at runtime. ...

AI code generation has delivered on its first promise. Teams are shipping more, covering more test cases, and moving faster than they could have imagined just a year ago. The productivity gains are real and the organizations that have leaned into AI adoption have proof points to show for it. That first wave of wins is also creating a second wave of questions, and the engineering leaders who are building influence now are the ones who saw those questions coming. The Quick Wins are Real; So is What Follows Most teams start using AI code generation in low-risk, repetitive work: Documentation, unit testing, and simple functions. Data from recent research bears this out, and the productivity gains in these areas are real. The problem is what happens at scale. As AI generates more code, it creates more to review, more to maintain, and more places for issues to hide. Review load compounds. Pull requests change in size, frequency, and composition. The code looks different than it used to,...

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Greenhouse Tines Remote, US Senior Site Reliability Engineer – Government Cloud $210,000 to $220,000 Axon New York, NY Senior Site Reliability Engineer, Axon 911 $141,000 to $216,600 Rew...