Apr 23, 2026 Trivy, KICS, and the shape of supply chain attacks so far in 2026 We caught a malicious image pushed to checkmarx/kics on Docker Hub, the image was quarantined, and we coordinated response with Socket and Checkmarx. This blog walks through what happened and why we believe open, fast collaboration is the key to responding to this new pattern of emerging supply chain attacks. Read now
Author: drweb
News JetBrains PHPverse – a community-inspired professional event for PHP developers – returns once more on June 9, 2026. This year, we’re gathering some of the most influential voices in the PHP ecosystem to share their insights on shaping the modern PHP language, the internals of ecosystem tools and frameworks, and the adoption of agentic workflows for shipping PHP code. Expect a one-day event of curated talks, live Q&As with the speakers, several special announcements, and even a few surprises (after all, it’s PHP’s 31st birthday). When: 11:00 am – 3:50 pm UTC on June 9, 2026. Where: Streamed live…
I still remember the moment when I was building a regression model and noticed something strange. The average of my squared predictions was always higher than the square of my average prediction. At first I thought I had a bug. Then I realized I was watching Jensen’s inequality in action. In this article I walk through Jensen’s inequality step by step, explain why the geometric intuition makes sense, verify it with Python code, and show where it appears across machine learning, statistics, and information theory. TLDR For convex functions: E[g(X)] >= g(E[X]). The expectation of a transformation exceeds the transformation…
Every Linux user eventually runs a command they’d rather not preserve – a curl with a hardcoded password, an export with an API key, or a one-liner that would confuse any sysadmin who read it three months later. Knowing how to control what ends up in your bash history is as much a security habit as locking down SSH. You’ve probably been there: you paste a command with a password embedded, hit Enter, and immediately wonder how many places that string just landed. Bash stores every command you type in ~/.bash_history by default, and on most systems, that file is…
The era of the “human-only” software engineer is rapidly receding into the rearview mirror. Google CEO Sundar Pichai revealed Wednesday that a whopping 75% of the company’s new code is now generated by artificial intelligence (AI), marking a major shift in how the tech giant builds its products. The velocity of this transition has caught even industry observers off guard. Just 18 months ago, in early 2024, AI-generated code accounted for only a quarter of Google’s output. By late 2025, that figure had climbed to 50%. Today’s 75% milestone signals that AI has moved from a supplemental “autocomplete” tool to…
I keep coming back to CAPM whenever I need to explain to someone why some stocks are riskier than others. The model is simple enough to implement in an afternoon, but it captures something real about how the market prices risk. If you have ever wondered whether a particular stock is appropriately priced given its risk level, CAPM gives you a straightforward answer. This article covers the Capital Asset Pricing Model from the ground up. We look at what beta means, where the formula comes from, and how to implement it in Python. By the end, you will understand the…
I ran into this exact expression while solving a palindrome problem on a coding challenge platform. The line int(a[::-1]) looked cryptic at first glance — three colons, a negative step, wrapped in int(). But once I broke it down, it turned out to be one of the cleanest one-liners in Python for reversing and converting in a single shot. This article covers how slice notation [::-1] reverses any sequence, how int() converts strings to integers, why combining them works, and where this idiom shows up in real code. By the end you’ll understand exactly what every character in that expression…
LocalStack today announced it has extended its ability to simulate Amazon Web Services (AWS) environments to provide an ability to debug applications before deploying them. Company CEO Colin Neagle said App Inspector makes it possible for developers to debug their applications running in a simulated AWS environment inside a container on a local server. Simulating the full application stack within a local sandbox container makes it possible to better understand application behavior such as data flows between AWS services, event execution paths and resource dependencies that may have been inadvertently misconfigured, noted Neagle. Once discovered, App Inspector then generates a…
Security tools promise to help developers. In practice, many of them just relocate the burden. The vulnerability still needs to be understood, researched, and fixed, only now the developer is doing it across two or three tools instead of one, hours or days after they wrote the code in question. The real test of an IDE security tool isn’t whether it finds issues. It’s whether a developer’s day actually gets better because of it. Fewer interruptions, fewer broken builds, fewer cycles spent fixing the fix. Here’s what that looks like with Checkmarx Developer Assist across a typical working session. Morning:…
I don’t have SQL Server installed on my laptop. In an effort to keep things clean and smooth in case I need to rebuild things, I’ve gone with containers. I can easily copy a folder with all my docker compose files and data to another machine and be up and running.One other benefit is upgrades. This post looks at the process of upgrading/patching SQL Server on my laptop.Getting the Latest VersionA normal process for me in the past (and on my desktop) is to download a patch, run the installer, and then have SQL Server upgraded. Sometimes there’s a reboot…