Oasis Security Identifies Security Weakness in Cursor AI Coding Tool
Oasis Security this week warned application developers of a security flaw in the Cursor artificial intelligence (AI) code editor developed by Anysphere, Inc. that potentially could be used to allow a maliciously crafted code repository to execute code as soon as it’s opened using Cursor. Erez Schwartz, threat research engineer at Oasis Security, said that […]
JFrog CEO: AI Agents Require Practices Beyond Security, Traceability
NAPA, Calif. — A new persona in software development, artificial intelligence (AI) agents rather than human developers, has made it imperative that foundational platforms incorporate agentic practices alongside security, traceability, and visibility to succeed in the AI era. “Every foundational platform requires a single system of record,” Ben Haim told the crowd. “If you don’t […]
John Willis: The True North of DevOps and DevSecOps
Over the last 14-plus years of my journey through DevOps, I’ve had the good fortune to meet some of the smartest, most generous, most forward-thinking people in our industry. It’s one of the things I’m most thankful for—the friendships and shared learning that come from being part of a community that is always pushing boundaries. […]
Tackling the DevSecOps Gap in Software Understanding
When I first read the recent article from CISA titled “Tackling the National Gap in Software Understanding,” I had the same reaction I imagine many of you did: Well, of course this is necessary. Who in their right mind doesn’t want better visibility into the software used in our most mission-critical systems? But then I […]
Veracode Allies with Wiz to Bring More Context to DevSecOps Workflows
Veracode today revealed an alliance through which it will integrate its application security posture management (ASPM) platform with the cloud native application protection platform from Wiz.
Kusari Adds AI Security Tool to Inspect Code as Pull Requests Are Made
Kusari has added an artificial intelligence (AI) tool that runs a security risk assessment every time an application developer makes a pull request. Company CTO Mike Lieberman said Kusari Inspector is designed to make it simpler for security to be shifted left toward application developers in a way that doesn’t impinge productivity. Most application developers […]
AWS Extends Cloud Security Reach to Include DevSecOps Tools to Scan Code
Amazon Web Services (AWS) this week made Amazon Inspector, a code scanning tool for surfacing vulnerabilities that is designed to be natively integrated with GitHub and GitLab platforms, generally available. Announced at the AWS re:Inforce 2025 conference, Amazon Inspector combines a static application security testing (SAST) tool for analyzing application source-code with a software composition […]
Survey Surfaces Uneven Adoption of SBOMs to Secure Software
A survey of 100 security professionals finds nearly half (48%) of security professionals admit their organizations are falling behind on meeting software bill material (SBOM) requirements as specified by the U.S. Office of Management and Budget (OMB) Memo M-22-18, Executive Order 14028, and the European Union (EU) Cyber Resilience Act. Conducted during the recent RSAC […]
North Korean Bad Actor’s Fake Job Offer Scam Targets Developers
Freelance developers around the world are being targeted by North Korean bad actors posing as job recruiters who as part of the fake application process entice them to run software jobs that actually compromise their systems with infostealer malware.
6 Essential Components of a Successful Security ‘Rewards Program’ for Software Developers
The software development industry could use a rewards program especially when it comes to ensuring a ‘security first’ mindset among developers.
Breaking Free from Ransomware: Securing Your CI/CD Against RaaS
For developers, few things are more precious than their codebase. Yet, a chilling trend is emerging: Ransomware-as-a-service (RaaS) attacks targeting CI/CD pipelines, holding valuable code hostage.
CloudBees Acquires Launchable to Advance Testing Using AI
CloudBees today revealed it has acquired Launchable, a provider of a test automation platform, to enable DevOps teams to improve both application security and software quality. Financial terms of the acquisition are not being disclosed.
Lineaje Adds Module to Manage Open Source Software Security Lifecycle
This can help DevSecOps teams identify open source software projects that are not being well maintained.
Sumo Logic Previews GenAI Tool to Improve DevSecOps Observability
Sumo Logic this week at the RSA Conference previewed a copilot that leverages generative artificial intelligence (AI) to make it simpler for IT and cybersecurity professionals of varying levels of experience to derive benefits from its observability platform via a user interface (UI) the company is in the process of revamping. In addition, Sumo Logic […]
What OpenTofu 1.7 Means for DevSecOps
With built-in end-to-end encryption, OpenTofu is a natural DevSecOps fit.
Datadog DevSecOps Report Shines Spotlight on Java Security Issues
Datadog today published a State of DevSecOps report that finds 90% of Java services running in a production environment are vulnerable to one or more critical or high severity vulnerabilities introduced by a third-party library, versus an average of 47% for alternative programming languages. Based on an analysis of IT environments being monitored using the […]
Microsoft kills Python 3.7 ¦ … and VBScript ¦ Exascaling ARM on Jupiter
In this week’s #TheLongView: VS Code drops support for Python 3.7, Windows drops VBScript, and Europe plans the fastest ARM supercomputer.
80% of Bosses ‘Regret’ Stopping WFH ¦ PSA: Disable STS!
In this week’s #TheLongView: Rethinking return-to-office mandates and a ridiculous, ancient Windows bug.
92% of Devs Use AI, Survey Says ¦ Intel One Mono Font
In this week’s #TheLongView: GitHub touts unbelievable AI stats, and Intel’s beautiful open source typeface.
Microsoft’s 9th Outage in 2023 ¦ RISE of RISC-V ¦ Meta Ends WFH
In this week’s #TheLongView: Redmond SaaS keeps failing, RISC-V is RISEing, and Meta is enforcing hybrid work.
US DoJ Makes PyPI Give Up User Data ¦ Tape Storage: Not Dead
In this week’s #TheLongView: PyPI complies with a “string of subpoenas,” and LTO continues to grow, despite predictions of its demise.
FIDO/WebAuthn Passkeys is Inevitable: Get on the Train ¦ IBM CEO Hates WFH
In this week’s #TheLongView: The Passkeys authentication standard gets a huge boost, and Arvind Krishna wants workers back in the office.
Linux 6.3: What’s New ¦ AWS Layoffs are a Worry
In this week’s #TheLongView: A new Linux kernel drops and layoffs at Amazon Web Services point to trouble.