News and Tech Update

Avalara’s new agent hub brings together specialized AI agents to execute complex tax and compliance workflows while keeping people in control of the decisions that matter. FORT LAUDERDALE, Fla. — September 23, 2026 — Avalara, Inc. , the agentic AI leader in global tax and compliance, today unveiled Avalara Aviator at its CRUSH customer and partner conference. The new agent hub for tax and compliance turns days of manual work into minutes of oversight, with an audit-defensible record for every action. As businesses expand across markets, channels, and business models, tax and compliance requirements are becoming more interconnected, more digital, and increasingly real-time. For years, tax software has automated individual compliance tasks, but much of the work between those tasks has remained manual and siloed. Avalara Aviator is designed to close that gap with intelligent agents that can understand context, coordinate work, monitor variance, and take action. Humans delegate the wor...

Cycode today revealed it is providing early access to an extension of its platform for securing software supply chains that prevents developers from downloading malicious or suspicious software packages onto their workstations. A Workstation Protection capability that has been added to that platform enables DevSecOps teams to apply policies and controls that prevent developers from downloading potentially malicious instances of software packages from a software repository. Specifically, the Cycode agentic development lifecycle (ADLC) Protection platform applies two controls in real time. The first inspects software packages against a threat intelligence feed to prevent downloads of known malicious software packages. The second will automatically prevent the download of any software package that has been too recently updated on the assumption that there has not been enough time to properly vet it, otherwise known as a cool down period. Devin Maguire, senior product marketing manager ...

Most developers who install an AI coding assistant assume it reads the files it needs. Few expect it to package the entire workspace and ship it somewhere else. That’s what users say happened with ZCode, the AI coding assistant from Chinese AI company Z.ai, also known as Zhipu. After a week of public backlash, the company disabled the features involved, apologized, and brought in outside firms to confirm the data was gone, Reuters reported. The trouble surfaced when an independent Chinese blogger who goes by Ferstar noticed abnormal disk usage and traced it to ZCode background processes. He found that whenever a user was logged in, ZCode packaged the entire workspace, including the full .git history, Git LFS cache, reflogs and global app configs. It then encrypted the bundle and uploaded it to Aliyun OSS, Alibaba Cloud’s object storage service. The source was a Codebase Indexing feature that supported session checkpoints, version rollbacks, and wiki generation. It was on ...

Shift left is dead. For more than two decades, it has been the default philosophy of secure software development : Catch problems as early as possible, and everything downstream gets faster, cheaper, and safer. That philosophy no longer holds, because AI-driven development has broken the assumptions it was built on. The concept was introduced in 2001 by software engineer Larry Smith, who argued that testing and quality assurance should move earlier in the development process rather than be left until the end. It went on to become one of the most influential ideas in the software development ecosystem. In the security niche specifically, it helped dev teams find and fix vulnerabilities during design and coding rather than waiting for testing or deployment, turning security from a roadblock into an accelerator of rapid, secure releases. That’s because AI-driven development has introduced a new category of risk that shift left was never built to address: Exposure that happens befor...

A malicious npm package that has been downloaded millions of times comes with a new way of spreading the malware that makes it easier to bypass security protections, say researchers with security vendor Checkmarx. Rather than using more common preinstall or postinstall scripts, the bad actors instead created a malicious package – indexed-btree – that mimics the legitimate sorted-btree package and hides the malware in the package’s runtime code, according to Checkmarx security researcher Bruno Dias. Indexed-btree “runs entirely from application code at runtime,” Dias wrote in a report . “Additionally, this package achieved almost 2 million weekly downloads, which shows not much has changed in the npm ecosystem despite the limitations put on lifecycle scripts.” The latest malware targeting npm packages hides inside the Btree.prototype.set, the standard method in JavaScript B-Tree data structures. Because there’s no install hook inside the package.json file, installing the packag...

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Dice Booz Allen Hamilton McLean, VA DevOps Engineer $77,600 to $176,000 Alarm.com Centennial, CO DevOps Engineer $120,000 to $130,000 HarbourVest Partners Boston, MA DevOps Engineer $135,00...

GitLab is introducing new rate limits for its cloud-based DevOps platform as growing demand from AI agents and automated development tools increases pressure on its infrastructure. The changes , which begin October 19, will restrict the volume of requests users can send to GitLab.com based on their subscription plans. Free-tier customers and users making unauthenticated requests will face the new restrictions first, while Premium and Ultimate customers will see changes in January 2027. The restrictions address a challenge facing developer platforms as AI coding agents generate vast volumes of automated requests. GitLab forecasts several times more traffic on its infrastructure for 2026, prompting the company to establish usage limits designed to maintain service performance. GitLab is certainly not alone in addressing this issue. GitHub and Anthropic have also introduced rate limits as AI-powered development tools greatly boost the use of computing and network resources. Automated ...