In 2026 and beyond, AI will not just change how software is developed, but change the very fundamentals of how people work. Far from being sidelined, senior engineers will become more important than ever. Not all is positive; the combination of agentic AI and Model Context Protocol (MCP) may accelerate software development, but they also broaden potential attack surfaces. Other developments on the horizon, including ambient AI, AGI, and breakthroughs in biotech, signal AI’s profound impact not just on DevOps but society as a whole. Context Engineering Will Dramatically Improve AI Results Compared to Simple Prompt Engineering, but Getting the Right…
Author: drweb
The moment you push your code, deployment fires off on its own. The pipeline kicks in, the tests sail through, and within a few minutes your app is live in production. There is no manual sign-off and no one scanning through the final changes. Everything is running on the decisions of an AI agent plugged straight into the pipeline.At first it feels great. Stuff moves faster. That long stretch from development to live is just a sprint now. Teams get hooked because it slashes delays and smooths over all the bottlenecks everyone used to grumble about.And for a while it…
A dangerous vulnerability found in Anthropic’s popular Claude Code developer model could have allowed bad actors to grab control of a victim’s system by luring them into clicking on a crafted malicious deeplink.Once in, the attacker could exploit the remote code execution (RCE) security flaw to execute arbitrary commands – such as shell commands – into the target’s Claude Code model.The vulnerability in version 2.1.118 of the model has since been fixed, but it’s another example of the security issues in these developer-focused tools that arise as adoption accelerates.A survey of more than 1,000 developers around the world by CodeSignal,…
DevOps teams don’t have a firewall problem; they have an identity problem. When you consider the recent security incidents in cloud-native environments, the vast majority do not begin with a network breach. It begins with weakened credentials, overprivileged service accounts or tokens that are long past their expiry dates. With infrastructure being made ephemeral and pipelines being completely automated, identity becomes the actual control plane. This is where smart KYC enforcement layers fit in — not a compliance box, but an engineering control that is directly part of DevOps processes. This is not about banking-style KYC. It is regarding the implementation of constant identity validation principles to human beings and machines that are…
Redgate is a for-profit company. We look to make money by building and selling tools that help you. If we do a good job, we make money. If we don’t, you shouldn’t buy our tools.I found this value to be very interesting:The next page has this statement:Focusing purely on the numbers is a sure way to kill Red Gate’s culture. We believe that if we focus on the game – building awesome products that people want to buy, and then persuading them to buy them – then success will follow.Profits matter. Certainly all of us want to be paid (and…
We are looking for a strong Vue / Nuxt Developer to help build and maintain the frontend of multiple digital brands within a shared, scalable platform.This is a hands-on role for someone who is comfortable taking ownership, writing clean and reliable code, and contributing to a live product that is evolving quickly. We are looking for someone pragmatic, quality-focused, and able to collaborate closely with backend, product, design, and QA teams to ship features effectively.Ownership is an important part of this role. We are not only looking for someone who can implement tasks, but someone who can understand context, think…
It was a Sunday evening. Around 8:15 PM. The kind of evening where the whole house smells of cardamom and warmth, and you trick yourself into believing that time has stopped moving. Here is the story of AI, Disposable Apps, and the Sunday Evenings We Are Losing.My wife had a novel open in her lap. I was on the sofa, half-asleep, letting the weight of a long work week melt into the cushions.And our teenage daughter was sitting right next to us. Right there on the same sofa, in the same warm room, breathing the same cardamom air. We could…
Modern engineering teams ship software faster than ever, but this velocity often comes at the cost of security. Vulnerabilities frequently slip into production because security checks occur too late in the development life cycle, typically after code has already been merged or deployed.DevSecOps aims to solve this by embedding security directly into development workflows. In this article, I will elaborate on how I designed an AI-powered DevSecOps guardrail pipeline using GitHub Actions. The pipeline automatically analyzes code for security violations before The full implementation is available on GitHub. The Problem: Security Checks Happen Too Late In many organizations, security reviews occur after code reaches staging or production. This reactive model creates several challenges: Vulnerabilities reach production environments Security teams become bottlenecks Developers receive feedback too late Incident response becomes reactive instead of preventative Traditional scanning tools help, but they often require complex integrations and manual configurations. What teams need instead are automated, enforceable security guardrails built directly…
ps aux shows you what is running on your system, but witr goes a step further and tells you why it is running by tracing where it came from. If you’ve ever looked at ps aux late at night trying to figure out why a Node.js process is using too much memory, you’ve probably seen the PID, user, and command, but that still doesn’t answer the real questions: who started it, what started it, and why is it still running? To find that out manually, you usually end up running multiple commands like systemctl status, lsof, ss -tlnp, and digging…
Modern CI/CD pipelines have become one of the most attractive attack surfaces in enterprise environments. As organizations push for faster releases, broader automation, and greater reuse of third-party components, the software supply chain has quietly expanded beyond the direct control of any single team. Source code is only one small piece of what ultimately runs in production. Artifacts, dependencies, and delivery pipelines themselves now represent critical trust boundaries, and increasingly, they are where attackers focus. For practitioners, the challenge is not whether supply chain attacks are real. That question has already been answered. The real question is how to design CI/CD pipelines that move…