News and Tech Update

Every security team that has run Dependabot against a private registry knows the drill. You need a personal access token, a safe place to store it, a reminder to rotate it, and a way to update it in dependabot.yml before it expires and quietly breaks your dependency updates. None of that is hard. It’s tedious, and people skip tedious security chores. GitHub has now closed that gap for its own registries. As of this week, Dependabot can authenticate directly to GitHub Packages, the GitHub Container Registry ( ghcr.io ), and other GitHub-hosted package registries without a PAT. It uses the same GITHUB_TOKEN mechanism that already powers GitHub Actions workflows, requesting packages: Read access and presenting that token automatically when it pulls a dependency. If a repository already has access to a package through the “Manage Actions access” setting, Dependabot inherits that access the same way an Actions workflow would. That last part is the real change. Dependab...

DevOps is often associated with speed: shorter release cycles, greater automation, faster feedback and increased developer autonomy. In financial services, however, speed is only one part of the equation. A platform supporting banking, payments or other regulated financial workloads also has to account for security, traceability, resilience, access control and operational risk. A deployment that reaches production quickly but cannot be adequately explained, audited or recovered is not necessarily a successful deployment. This changes the way DevOps needs to be implemented. The goal is not to choose between speed and control. The goal is to design delivery systems in which the controls themselves become part of the engineering workflow. Compliance Should Be Designed Into the Pipeline One of the easiest mistakes to make in regulated environments is treating compliance as something that happens after engineering work is complete. A team builds an application, creates its deploymen...

Apica today added an artificial intelligence (AI) agent and Model Context Protocol (MCP) server to version 3.0 of its Ascent platform for managing telemetry data pipelines. Andi Mann, chief product and technology officer for Apica, said the AI agent, dubbed Venn, makes it possible for IT teams to use natural language rather than having to create scripts to build and manage data pipelines at higher levels of scale. The MCP server, meanwhile, makes it possible for IT teams to use third-party AI tools to invoke the Ascent platform and its multiple embedded AI skills within the context of a DevOps workflow. Finally, a flow-only mode capability has been added to the platform to enable telemetry data to flow 10x faster. That additional capacity will prove critical as more AI agents are added to IT environments, said Mann. Just as importantly, however, any change that could delete or materially alter configuration requires the consent of an administrator before being applied to ensure no ...

Boston, MA, USA, September 8th, 2026, CyberNewswire Specialized team of AI agents that discover, attack, and validate web vulnerabilities, leveraging pre-existing site context to eliminate noise and speed remediation. Reflectiz, the continuous web exposure management company, today launched a multi-agent penetration testing platform for websites. Multiple specialized AI agents discover, attack, and validate vulnerabilities across complex web environments, and because they start from an existing model of each site, they cover up to ten times more than conventional pentesting tools. A pentest used to be an event. An engagement, a report, done. The report described a moment. The website kept going: login, checkout, payments, dozens of third-party scripts, all probed by attackers daily. “Websites change every week and get pentested once or twice a year. That gap is where exposure builds up,” said Idan Cohen, CEO and co-founder of Reflectiz. “Teams need testing that ke...

New York, NY, United States, September 8th, 2026, CyberNewswire Mars Security, the autonomous threat hunting and detection engineering platform founded by offensive security veterans, today announced Real-Time Intel-Based Detection, a capability that turns newly published threat intelligence into validated, ready-to-deploy detection rules within minutes of release. Built by former offensive operators, the new capability converts advisories from CISA, Mandiant, and other intelligence sources into MITRE ATT&CK-mapped detection rules across CrowdStrike, Wiz, Splunk, and cloud telemetry, each one tested against 30 days of the customer’s own data before it goes live. Mars believes it is the first platform to automate the complete path from threat advisory to production detection, including backtesting against the customer’s own environment, with no data ingestion and no changes to the existing security stack. Every security team already pays for threat intelligence. Very little of...

Ask any developer who works with multiple AI coding assistants how they choose a model for a given task, and you’ll get some version of the same answer: Trial and error. A quick model for simple edits. A stronger, pricier one for hard debugging. Sometimes a second model gets pulled in just to check the first one’s work. It’s a manual routing problem, and it falls on the developer every single time. GitHub thinks it has a fix. The company just introduced Project HydraFusion , a research preview built into GitHub Copilot that handles that routing automatically. Instead of a developer deciding which model gets which task, HydraFusion evaluates the request and builds the workflow itself. The system leans on three execution patterns. In “single” mode, one model handles the task outright. In “cascade” mode, an efficient model drafts a solution first, and only escalates to a stronger, more expensive model if the draft doesn’t clear a quality g...

During my doctoral research on modern engineering practices and operational efficiency, one pattern kept surfacing that I did not expect to find. The engineering teams making the most measurable progress on sustainability were not the ones that had appointed green committees. They were the ones running tight DevOps discipline: right-sized fleets, lean pipelines, tuned alerting, progressive rollout, carbon-aware routing. The same practices that cut cost and toil were quietly cutting emissions at the same time. Nobody was measuring it that way. That observation became a thread I kept pulling. The more I looked at how modern engineering practices drive operational efficiency, the more I found sustainability outcomes hiding inside work that engineering teams were already doing, and already getting credit for on the cost side. The carbon savings were real. They just were not being captured. The problem is not that enterprises lack green intent. It is that sustainability is being treated as...