News and Tech Update

Open source can be just as safe as proprietary software, though government agencies (and private enterprises) should take additional measures to secure it properly, according to a new guide published by the U.S. Cybersecurity and Infrastructure Security Agency ( CISA ). The report, “ Open Source Software: Security Principles and Practices ,” provides with guidance to help agencies comply with two Presidential Executive Orders ( 14144 and 14306 ) which both urged them to do a more thorough job securing the software they use, a response to recent exploits like Log4Shell and XZ utils. CISA acknowledges that open source can provide immeasurable benefits to government agencies, not merely because it is available without licensing fees, but also because agencies can extend the software to meet their own requirements. But at the same time, open source software must be managed differently than proprietary software. Malicious hackers (and increasingly AI agents) use vulnerabilities to gain ...

Modern engineering teams have invested heavily in observability. Dashboards are populated, alerts are configured, on-call rotations are set. Yet when production incidents occur, the average time to resolution hasn’t dropped nearly as fast as the tooling has improved. The reason, in many cases, comes down to one overlooked gap: logs aren’t being used the way they should be during active incidents. This isn’t a tooling problem. Most organizations already have log data flowing somewhere. It’s a workflow problem, specifically, how logs integrate (or fail to integrate) into the broader incident response process. The Three-Tool Problem A typical incident response scenario looks something like this: an alert fires, the on-call engineer opens a metrics dashboard to understand the scope, then switches to a separate logging tool to investigate root cause, then jumps to a tracing tool to follow the request path. Three tools. Three contexts. Three sets of query syntax. B...

CISA just gave software supply chain security a long-overdue refresh. Working with the NSA, the FBI, and a roster of international partners, the agency released the 2026 Minimum Elements for a Software Bill of Materials, updating and replacing the baseline that the National Telecommunications and Information Administration published back in 2021. Five years is a long time in software security terms, and the update shows. The timing isn’t random. The revision incorporates feedback from more than 90 comments submitted during a public comment period, and CISA circulated a draft in 2025 specifically to update elements like SBOM author, software producer, and component version for better clarity. This wasn’t a quiet policy tweak. It was a deliberate, multi-year rework built on real feedback from people who actually generate and consume SBOMs for a living. What’s New The headline change is scope. The minimum elements now apply to SBOMs across all software types, including...

Tricentis today revealed it is acquiring Tabnine to gain access to a knowledge graph that will be used to provide context to AI agents that have been trained to automate a range of testing tasks. Once the acquisition is complete, Tricentis plans to integrate the knowledge graph developed by Tabnine, dubbed the Enterprise Context Engine, into the company’s Agentic Quality Engineering Platform. Coupled with a vector model, that knowledge graph makes it possible to extract entities, relationships, dependencies, and architectural patterns from repositories, documentation, tickets, application programming interfaces (APIs) and infrastructure metadata in a way that is much easier for AI agents to consume and understand. The end result will be a platform that continuously ingests code, documentation, tickets, and APIs, providing organizational intelligence in real time and enabling multiple AI agents to share memory and context to both verify outputs and better understand the potential dow...

The gap between how fast AI writes code and how reliably teams verify it is quietly becoming a balance-sheet risk. Enterprise leaders are learning to measure it before it forces repayment. Every engineering organization that adopted AI coding assistants over the past two years has quietly taken on a liability that never appears on the dashboards leadership actually reviews. Developers now generate more code than their teams can meaningfully verify, and the gap between the two compounds on every passing build until an incident forces the account to settle. The cost tends to land late and all at once, usually as an outage or a failed audit that traces back to a change nobody fully checked. For the executives who answer for delivery risk, the trouble is not the tooling their engineers reach for but the plain fact that verification capacity never scaled to match the new pace of output. The Liability That Never Reaches the Dashboard Leadership reporting evolved to track the things that ...

Not long ago, some business leaders seemed to view enterprise search as a “nice-to-have.” Or, at the very least, they considered it more of a supporting utility than a strategic, business-critical platform. Organizations use enterprise search tools to help employees locate internal documents and enable support teams to surface relevant information. And, of course, retailers have long needed search to help customers navigate their product catalogs. But historically, expectations have been relatively modest: Users entered a few keywords and received a list of links, and then they did the remaining legwork themselves to figure out which results were relevant. It’s little surprise, then, that many companies have historically relied on self-managed open-source solutions like Apache Solr for enterprise search. But even though the role of enterprise search has changed, many organizations’ approach to search has not. The rise of GenAI has trained customers to expect companies’ search tools ...

OpenAI has released its Codex Security command-line interface and software development kit as open source software under the Apache 2.0 license, providing a new way to bring its AI security scanner into development workflows. The CLI can scan repositories, review staged and unstaged changes before a commit, compare findings across scans and export results for use in other code-scanning tools. Teams can also run it in CI and set a severity threshold that returns a failing status when a completed scan identifies a finding at or above that level. OpenAI recommends starting with advisory results before allowing findings to affect the CI check. Because the client code is public, teams can inspect and adapt the CLI or SDK to fit their own tooling. But that openness stops at the integration layer, as the service that performs the underlying analysis remains under OpenAI’s control. “OpenAI open-sourced the client and kept the scanner. That is distribution, not openness,” said Mitch Ashley, ...

Las Vegas, USA, July 29th, 2026, CyberNewswire Catches rogue AI agents – and stops them in live production before they cause damage Sweet Security , the proactive runtime enforcement company for cloud and AI, today announced its further expansion into AI security with Agentic AI Blocking . Sweet now blocks rogue agent behavior in real time – extending Sweet’s runtime enforcement from the cloud to the AI agents that are acting alongside it. Eighty percent of the world’s businesses are already AI enterprises, and their agents take on identities, reach sensitive data, and act on their own. Yet no one verifies that the behavior an agent carries out is the behavior that was intended. Every other security tool detects and alerts; by the time a team reads the alert, the agent has already acted. “AI has collapsed the cost of attack, and it has put autonomous software inside the enterprise. Someone has to decide, in the moment, what an agent is allowed to do,” said Dror Ka...

DevOps used to be a manageable rhythm: several core tools, a handful of respected blogs, and a few incident write-ups that made everyone slightly uncomfortable in a useful way. Now it feels like a firehose aimed directly at the on-call rotation. DevOps teams now have more information than they can reasonably track. Critical updates are scattered across numerous topics and sources, and as the information grows more fragmented, it becomes harder to tell what actually matters. Why DevOps Teams Cannot Keep Up In many organizations, “staying current” is treated like a personal hobby – something engineers do after hours or during lunch. But the modern stack does not reward casual catch-up. It punishes it. A DevOps practitioner is expected to have informed opinions on: Cloud pricing shifts and service deprecations (often buried in release notes) Kubernetes ecosystem churn (which somehow never slows down) SRE practices and incident learnings (valuable, but not always transferabl...

In today’s enterprise software delivery environment, AI has moved from a distant possibility to an active area of experimentation across the CI/CD pipeline. The conversation around AI in software delivery often runs ahead of the underlying reality, and most organizations are still working through what it takes to operationalize AI inside delivery architectures that were built long before AI was a practical consideration. Techstrong polled its community of DevOps, platform engineering and software delivery professionals to understand where AI adoption in CI/CD really stands, where it is being applied today, and what is standing in the way of broader operationalization. Our findings reveal that active interest is running ahead of operational readiness, with most organizations either experimenting in isolated areas or beginning to expand AI use in selected parts of the pipeline, while fragmented toolchains, governance concerns and integration complexity remain the primary barriers to sca...

The tech landscape constantly evolves, making it tempting to chase every new trend. Ironically, in today’s business world, the word “innovation” has become almost synonymous with technology adoption. Yet after years of leading digital transformations, I’ve learned that sustainable innovation isn’t about having the latest technology—it’s about solving business problems and delivering measurable impact. In 2025, the hype was “we’re building an AI strategy.” In 2026, it’s becoming clearer that many of those strategies were more aspirational than actionable—some even serving more as positioning than practical guidance. The latest wave of generative AI has carried a magic-wand promise: that simply generating outputs would unlock transformation overnight. But enterprises are quickly realizing that generating output was never the hard part. The real challenge—and the real differentiator—is governing it responsibly, securing it end-to-end, controlling its b...

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Greenhouse Ripple Chicago, IL Site Reliability Engineer, Observability $160,000 to $200,000 EarnIn Mountain View, CA Staff Site Reliability Engineer $252,000 to $308,000 Ashby Element 84 Ale...

GitHub has moved Copilot cloud agent’s integration with Linear out of preview and into general availability, and the update brings more than a stability label. Along with GA status, GitHub added a set of controls that let teams shape exactly how the agent behaves on a per-issue or per-team basis, without leaving Linear. The core workflow stays the same as it was in preview: Assign a Linear issue to Copilot cloud agent, and it analyzes the issue contents, opens a draft pull request, and works independently inside its own ephemeral development environment powered by GitHub Actions. Progress streams back to the Linear activity timeline, and the agent requests a pull request review once the work is done. What’s new at GA is the control layer sitting on top of that workflow. Teams can now pick which model Copilot uses for a given task, point the agent at a custom agent defined in their repository so it follows team-specific conventions, and set the base and working branch to co...

GitHub and the Python Package Index (PyPI) just added a new layer of defense against supply chain attacks, and it doesn’t involve scanning code or blocking uploads outright. It involves waiting. GitHub’s Dependabot now applies a default three-day cooldown before opening a pull request for a routine version update. PyPI, meanwhile, will no longer accept new files uploaded to a release once it’s more than 14 days old. Neither change stops a bad actor from publishing malicious code in the first place. Both are designed to shrink the window during which that code can quietly work its way into production systems before anyone notices. The reasoning behind both moves is simple. A newly published package version often gets pulled into build pipelines within minutes of going live, well before a person or a scanner has had time to review it. Security tools are usually fast at flagging something suspicious. But flagging isn’t the same as fixing. A maintainer still has to...

CodePen has spent 14 years as the place where front-end developers show off CSS tricks and JavaScript experiments. That reputation is about to change. The company just shipped CodePen 2.0, a full rebuild that turns individual “Pens” into deployable, file-based, version-controlled projects. For a platform best known for demos, that’s a meaningful shift toward production use. One Editor to Replace Three Until now, CodePen ran three separate editors: the Classic Pen editor, a Projects editor, and a Vue-specific editor. CodePen 2.0 merges all three into a single tool, and co-founder Chris Coyier says it was built to do everything the old editors could do, plus a long list of new capabilities. The company also says it kept backward compatibility with existing Classic Pens as a priority during the rebuild. The most notable addition is one-click deployment. Every Pen built in 2.0 can now be pushed to a live *.codepen.app subdomain, updated on save, or pointed at a custom ...