Design and Specifications Are Not What Is in Your Infrastructure
Cyber Asset Intelligence helps CTOs uncover hidden dependencies, reduce technical debt and make smarter architecture decisions with runtime visibility.
GitHub Adds Tools to Manage AI Coding Agents Running in Parallel at Scale
GitHub today made a bevy of updates that collectively promise to make it simpler for DevOps teams to build and maintain workflows using artificial intelligence (AI) agents. Announced at the GitHub Universe conference, Jay Parikh, executive vice president for CoreAI at Microsoft, also provided additional insights into the investments that Microsoft is making to ensure […]
Rethinking Application Updates: Solutions for Faster, More Efficient CVE Patching
Slow CVE patching leaves applications exposed. Discover how buildpacks, shared components and AI agents can accelerate vulnerability remediation.
CI/CD Cache Poisoning Is No Longer a Theoretical Attack
CI/CD cache poisoning can turn untrusted code into compromised releases. Learn how to secure caches, isolate workflows and protect software supply chains.
The Rise of Playwright: Why Browser Automation Had to Change
Playwright is transforming browser automation for modern CI/CD, but AI-generated tests raise new questions about reliability and trust.
I Spent 5 Years Preparing for UPSC. Then I Became a DevOps Engineer
After five years preparing for UPSC exams, a career switch to DevOps led from ₹13,000 a month to 16 LPA — and inspired a creation.
How to Secure AI-Generated Code Across an Enterprise SDLC
Broken access control has topped the last two editions of OWASP Top 10, with OWASP finding some form of it in every application in its dataset. AI coding assistants are making this worse because correct access rules depend on business logic that rarely makes it into the prompt and is hard to test. For enterprises, […]
AWS Delivers AI Service to Discover Vulnerabilities and Generate Patches
Amazon Web Services (AWS) has made generally available a service through which it finds and validates code vulnerabilities and provides a patch that DevSecOps teams can then automatically apply or set up a pull request to implement. Dr. Neha Rungta, director of applied science at AWS, said the AWS Continuum service for code vulnerabilities is […]
Why Continuous Vulnerability Management Belongs in Every DevSecOps Strategy
DevSecOps is part of the larger shift-left IT paradigm, which aims to identify and address vulnerabilities before they lead to security incidents. NIST’s guidance on secure software development emphasizes integrating security throughout the development lifecycle, rather than treating it as a separate concern addressed late in development or after deployment. By prioritizing a proactive approach […]
Report: Claude Code Exceeds GitHub Copilot for Merging Pull Requests
An analysis of pull requests published today by Jellyfish, a provider of an engineering intelligence platform, finds that Claude Code is the artificial intelligence (AI) coding tool used most often to merge pull requests (31%), followed by GitHub Copilot at 23%. Based on analysis of 100 million pull requests made in September by 276,000 developers […]
One Build, Ten Locales: How We Bake Translations at Compile Time Instead of Resolving Them at Runtime
For applications supporting multiple languages, localization architecture can dramatically affect build times, bundle sizes and caching. This technical deep dive explores why one development team chose a custom webpack plugin to compile once, inline translations and generate locale-specific bundles without runtime translation overhead.
Gheist Hackers Abuse GitHub Tokens to Steal Repository Secrets
The evolving Gheist campaign uses stolen GitHub tokens and malicious Actions workflows to extract repository secrets and cloud credentials. While GitHub protections have blocked observed attacks on public repositories, private environments remain exposed.
Reddit’s r/opensource AI Ban Targets the Wrong Problem
Reddit’s largest open-source community is cracking down on AI-generated projects, prompting criticism over sweeping restrictions that could exclude legitimate developers. As Linux takes a different approach, DevOps teams face a more important question: How can they enforce code quality and accountability without banning the tools developers use?
AI Made Building Apps Easy, but Who Really Runs Them?
A few months ago, a product manager at an agency reached out to us. They had built a client reporting app over a weekend using an AI coding tool and made it live so customers could try it. It worked great until we found that authentication was broken and the app’s admin interface was accessible […]
Ten Great DevOps Job Opportunities
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of […]
What Session-Level Tracing Taught Me About LLM Applications
I work on observability tooling for LLM-backed applications and the thing that surprised me most wasn’t a technical problem; it was how confidently wrong these systems can be while every dashboard stays green. Here’s a scenario that makes the point concrete. The Call That ‘Succeeded’ Picture an AI phone agent handling insurance calls. A customer […]
Stop Overlapping Cron Jobs With a File Lock
At 10:00, a report job starts rebuilding a shared working directory. At 10:05, its next scheduled run begins. The first process is still uploading. Now two processes can delete, replace or publish each other’s files. Moving the schedule to every 10 minutes buys time. It does not establish who may enter that directory. For a […]
Running Experiments on a Busy Backend Without Taxing a Single Request
Once a product reaches a certain scale, A/B testing and cohort targeting stop being a nice-to-have. There are plenty of good commercial platforms for this, but at scale they push you into a trade-off: Pay a big vendor bill, or send your customers’ data to a third-party API just to figure out which button someone […]
Implementing OPA with Terraform the Easy Way
Terraform compliance doesn’t have to mean complicated policy pipelines. By combining TFLint with OPA and Rego, developers can enforce infrastructure guardrails directly in their editors, pre-commit hooks and CI/CD workflows, catching violations before deployment.
Recursive Flint Puts a Fast Agentic Coding Model on Developers’ Laptops
Recursive has unveiled Flint, a 40-billion-parameter, open-weight coding model designed to run locally on developer hardware. Built with help from the company’s Eureka Machine research system, Flint promises faster inference, greater source-code privacy and freedom from per-token API fees. For DevOps teams, the launch raises fresh questions about AI agent governance, code quality and continuous model evaluation.
Claude Writes 180 Million Lines of Proofs to Verify 123 Open Source Libraries
Formal verification has long been the gold standard for software correctness. It has also been too expensive for almost everyone. New research from Anthropic suggests that’s changing. Anthropic’s Frontier Red Team, working with formal methods company Theorem, used Claude to prove security properties in the compiled code of 123 open-source libraries from Google’s OSS-Fuzz project. […]
Report: AI Agents Increase Observability Costs
Cisco has released its Splunk State of Observability 2026 report, revealing that companies face growing costs and operational challenges as they deploy AI agents without sufficient monitoring capabilities. The report found that 57% of organizations spend more on telemetry, the data used to monitor IT systems, than on the infrastructure being monitored. Additionally, 55% of […]
When 200 OK Isn’t OK: Observability for LLM Systems
Traditional monitoring can show an LLM-powered application as healthy even when it delivers incorrect answers. Drawing on experience at Varo Bank, this article explains why AI observability must go beyond the four golden signals and how automated evaluation, groundedness checks and CI pipelines can catch silent failures before they reach customers.