News and Tech Update

Security researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the account of the maintainer of multiple Rust crates and introducing four more attacker-owned crates. In addition, researchers with Wiz wrote that there also appears to be overlap with supply chain campaigns run by nation-state actors linked to the government of North Korea. According to multiple reports, unknown threat actors this week compromised the maintainer account behind arrayref, a widely used package with more than 245 million downloads that Sai Likhith, backend engineer with StepSecurity, described as a “tiny array-conversion utility” that is “one of the Rust ecosystem’s quiet load-bearing crates.” Over the next 23 minutes, as part of the same attack, the hackers poisoned two other crates from the same owner, append-only-vec and internment. In addition, the attackers published versions of four other crates – ...

Post-quantum cryptography is often framed as an algorithm replacement exercise. The discussion usually moves quickly toward RSA, elliptic curve cryptography, ML KEM, digital signatures, hybrid key exchange and the question of which algorithms should replace today’s public key systems. For DevOps teams, however, selecting a replacement algorithm is only one part of the problem. The harder task is determining where vulnerable cryptography exists, which applications and infrastructure depend on it, who owns those dependencies, and how difficult each one will be to change. That makes cryptographic inventory one of the most important foundations of quantum readiness. NIST’s current Migration to Post Quantum Cryptography project specifically identifies cryptographic visibility and risk management as a core workstream and recommends building and maintaining a comprehensive cryptographic inventory to guide migration. The inventory covers algorithms, protocols, keys, certificates, ...

Every team that has turned coding agents loose on real work has run into the same wall. The agents write fast. They write a lot. And somewhere between the tenth and twentieth pull request of the day, the humans responsible for reviewing that code start falling behind. That’s not a hypothetical. It’s the operating reality on teams that have adopted agentic development this year, and it’s the problem Tessl is aiming to address with the launch of Tessl Code Review, a new tool the company rolled out this week and is offering for free during its beta period. The pitch is simple: teams don’t need another reviewer catching naming nits and formatting issues. They need a reviewer that runs on its own, filters out the noise, and actually knows the team’s standards. Tessl Code Review checks pull requests against those standards, written once and stored as a skill the team owns and controls. That last part matters more than it might sound. A lot of AI code review to...

Developers for years have been using vm2, an open-source Node.js library , to run untrusted JavaScript inside a secure and isolated sandbox environment. It uses Node.js’s built-in modules and JavaScript Proxies and lets developers whitelist particular built-in Node modules or limit what the script can access. During that time, vm2 has been the default for safely running untrusted JavaScript, which Cris Staicu, senior security researcher for Endor Labs, calls “one of the hardest problems in the Node.js ecosystem.” However, over the years, there have been some two dozen instances of code breaking out of the sandbox, including one Endor Labs documented earlier this year . The problem is that vm2 is used to build a security boundary inside a single V8 execution environment using proxies and prototype scrubbing, and untrusted code shares some of the same elements, according to Staicu. Another method, isolated-vm, uses stronger techniques, a key one being that each sandbox given its own V...

The DevOps community has already experienced technological extremes. You might recall the time when automation was thought of as a panacea for all possible engineering issues, and the slogan “Automate Everything” was ringing out everywhere. Over time, the industry came to an important conclusion: Automation should not become the end goal. Along with faster software delivery, companies ended up with new dependencies, more complex infrastructure, and additional tools that also needed to be maintained. Today, a similar story is unfolding around artificial intelligence. Only instead of the call to automate everything in sight, we’re increasingly hearing a different mantra: Implement AI everywhere. Is this really necessary, though? Why AI Adoption Pressure is Growing in DevOps Three principal factors can be highlighted here. The first one is the pace of change. It’s hard even to mention a week that does not bring news about some AI solution for DevOps: From Terraform generation assistan...

Adelaide, Australia, August 19th, 2026, CyberNewswire Independent assessment provides Australian organisations with additional evidence when evaluating application control for sensitive, government, defence and critical infrastructure environments. Airlock Digital, a global provider of application control and allowlisting solutions, today announced that it has completed an independent Information Security Registered Assessors Program (IRAP) assessment at the PROTECTED classification level. The assessment was conducted by an Australian Signals Directorate (ASD)-endorsed IRAP assessor against the Australian Government Information Security Manual (ISM). It provides Australian organisations with additional independent evidence when evaluating Airlock Digital’s security controls and their alignment with applicable Australian Government security expectations, including the ISM and Protective Security Policy Framework (PSPF). For Australian security teams, confidence in a technology pr...

OpenTelemetry solved a real problem. Before it, every APM vendor had you install a proprietary agent, which meant switching vendors meant re-instrumenting everything. OTel gave engineering teams a vendor-neutral way to generate traces, metrics, and logs once and send them wherever they wanted. That part of the pitch is true, and open-source deserves credit for it. What gets left out of most OTel adoption conversations is what happens after the SDKs are wired up. The framework is free. Running it well is not. The Pain Points That Show Up After Rollout Collector sprawl. A production OTel deployment usually means running collector instances per region or per cluster, tuning batch and memory limiter settings, and watching for the collector itself becoming a bottleneck under load. This is the infrastructure your team now owns and patches, on top of the infrastructure it was supposed to help you monitor. Storage and retention decisions become your job. OTel defines how telemetry is gener...

When an end-to-end test fails after a front-end change, the repair often looks routine. A class name changed. A button moved. A selector that used to be unique now matches two elements. A self-healing system inspects the page, proposes a new locator, reruns the test, and gets a green result. That green result is useful, but it does not prove the test was repaired. The new locator may point to the wrong button, a hidden duplicate, or an element from another part of the page. The run passes because the automation found something clickable. The test may no longer check the behavior it was written to protect. I call that a false heal. It is worse than an ordinary failure because it removes the visible warning. A red test creates work. A false heal makes the suite look healthy while weakening its signal. The practical fix is to treat an AI-generated repair like any other untrusted code change. The healer can propose the patch, but a separate deployment gate must decide whether the patch...

In the tricky business of choosing the right artificial intelligence coding models for security and cost, development teams need to keep in mind two important factors. First, even the best and best-known AI coding assistants vary widely in performance, both between and within individual frameworks. Each has strengths and weaknesses, and there is no across-the-board best of the bunch; a model that leads the pack in one framework may be in last place in another. And second, when it comes to generating secure code, you don’t necessarily get what you pay for. The real costs of using AI agents can mount quickly depending on an agent’s use of tokens, and some models are more inclined than others to make extensive use of them, but there’s no correlation between cost and the level of security provided. Those are among the findings of an in-depth study conducted by Secure Code Warrior and the Royal Melbourne Institute of Technology (RMIT) to evaluate the security behavior of leading AI codin...