TL;DR — Key Takeaways npm v12 blocks dependency lifecycle scripts by default unless they are explicitly allowed, closing off a common software supply chain attack path. Checkmarx warns attackers may respond by shifting malicious behavior from install-time scripts to code that executes when compromised packages run. Approval fatigue could weaken the protection if developers routinely allow scripts without sufficiently reviewing them. For years, one of the easiest ways to sneak malware onto a developer’s machine has been to hide in plain sight. Install a package from npm, and any lifecycle script bundled with it runs automatically — no review, no…
Author: drweb
Aug 18, 2026 17,600 Actions: Agent Security Is a Systems Problem The OpenAI/Hugging Face incident exposed a new challenge for AI agent security. 17,600 attacker actions show why AI agent security can’t rely on human review. Explore the controls needed to constrain, observe, and govern agents at speed. Read now
TL;DR — Key Takeaways Outdated screenshots, diagrams and console captures can create implementation errors, inconsistencies and longer troubleshooting cycles. Predictive AI can automatically evaluate visual documentation and identify quality problems before assets are published. AI validation can detect cropped or outdated screenshots, missing diagram labels, inconsistent annotations and unreadable console output. Documentation quality gates can be integrated directly into CI/CD and Git workflows so visual assets are checked alongside code. Every release changes documentation alongside the code. Developers depend on that documentation during implementation, maintenance and troubleshooting. A diagram becomes misleading once services are renamed or integrations change without a…
Linux has long been the operating system of choice for servers, databases, containers, and cloud workloads. For some time, it existed without much scrutiny from attackers. However, this has changed over the years. When threat actors want to cause maximum damage, they go after the infrastructure layer. Increasingly, that means going after Linux because each of these computing resources runs on Linux, making it a single point of failure that attackers know how to exploit. A compromised Linux server is rarely an isolated incident and, in many environments, it is enough to take down the network around it. There is…
TL;DR — Key Takeaways DevOps teams risk repeating the mistakes of the “automate everything” era by trying to implement AI everywhere without a clear business need. AI productivity claims can be misleading: Research cited in the article found experienced developers were actually 19% slower despite expecting AI to make them faster. Poorly planned AI adoption can increase architectural errors, infrastructure costs, inconsistent engineering practices and operational complexity. Teams should assess their AI SDLC maturity, establish clear objectives and success metrics, and build internal AI expertise before expanding adoption. The most effective strategy is to start small, measure results and scale…
These eleven SQL Server interview questions look far too easy, and every one of them has stopped somebody senior. I ran all eleven on a real instance, so the results below were observed rather than reconstructed from memory.Most interview question lists are useless, and they are useless for a specific reason. They ask things that can be memorised. What is the difference between DELETE and TRUNCATE. Explain normalisation. Name the isolation levels. Describe a clustered index in your own words.A candidate can answer all of that perfectly and still not notice the query in front of them is going to…
Adelaide, Australia, August 19th, 2026, CyberNewswireIndependent assessment provides Australian organisations with additional evidence when evaluating application control for sensitive, government, defence and critical infrastructure environments. Airlock Digital, a global provider of application control and allowlisting solutions, today announced that it has completed an independent Information Security Registered Assessors Program (IRAP) assessment at the PROTECTED classification level. The assessment was conducted by an Australian Signals Directorate (ASD)-endorsed IRAP assessor against the Australian Government Information Security Manual (ISM). It provides Australian organisations with additional independent evidence when evaluating Airlock Digital’s security controls and their alignment with applicable Australian Government security expectations, including…
TL;DR — Key Takeaways Cursor’s new Origin platform expands the company beyond AI coding into Git-based code hosting and pull request workflows. Origin is designed to work alongside GitHub, letting enterprises test Cursor’s repository capabilities without immediately migrating existing infrastructure. Tight integration between Cursor’s editor, AI agents and hosted source code could make agent-driven development workflows more efficient. AI coding provider Cursor has launched Origin, a code hosting platform that puts source code and AI coding agents inside the Cursor development environment. The new coding platform expands the company into a market long dominated by GitHub.The rollout arrived as GitHub…
I recently started playing with the MCP Server for SQL Server, which is a part of the Data API Builder (DAB). I’m not sure why there wasn’t a separate piece of technology used, but I do think the DAB server is very useful, and I wish more people used it. Adding MCP to it makes some sense, as the REST and GRAPHQL endpoints can be disabled.This post will look at a few things I did to get the MCP server working.A Default for New ProjectsBy default, if you have v2.xx of the Data API Builder, when you create a new…
TL;DR — Key Takeaways No AI coding model is universally best for security. Performance varies significantly by framework, with different models leading in Java, Python, Swift, APIs and other environments. Cost does not equal security. Models that consume more tokens or make more tool calls can cost dramatically more without delivering proportionally safer code. Teams need to evaluate models in context. Security scores, framework performance, total agentic workflow cost and developer skills should all factor into model selection. In the tricky business of choosing the right artificial intelligence coding models for security and cost, development teams need to keep in…