Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
AeroSpork is a fork of AeroSpace, an i3-style tiling window manager for macOS. It adds a settings GUI, notarized universal builds for both arm64 and x86_64, and a fix for monitor identity that uses CoreGraphics UUIDs instead of IOKit.
CISA's Binding Operational Directive 26-04 requires federal agencies to prioritize vulnerability remediation by actual risk rather than static severity scores. This post describes how Datadog's tools help teams identify and remediate the critical findings the directive targets.
AI agents acting as autonomous first responders may successfully resolve many routine incidents, but their ability to take operational actions also creates new failure modes when they encounter situations they cannot handle. The most dangerous scenario is an agent attempting remediation in an unexpected way, making an already complex outage worse before humans enter the loop and forcing responders to diagnose the combined behavior of the software system and the agent itself.
LLMs can make performance work cheaper to implement, but implementation cost is often not the main reason optimizations do not ship: teams may tolerate slower software, cut engineering budgets, deprioritize performance, or face larger costs in testing, migration, correctness, and long-term maintenance. AI-generated optimizations can also overfit benchmarks or introduce reliability problems, so faster code generation does not necessarily translate into faster production software.
Sponsored
Craft brews, curated talks, and Open Spaces where you choose the topic. Celebrate 10 years of DevOpsDays Rockies at Bierstadt Lagerhaus in the heart of Denver. REGISTER NOW & SAVE 5% [20] 🚀
Google's Agent2Agent Protocol, an open standard for cross-vendor agent communication, is joining the Agentic AI Foundation alongside the Linux Foundation-backed MCP ecosystem.
Local AI coding agents run arbitrary prompts with full access to a developer's machine, risking accidental or malicious file deletion and secret exfiltration.
CNCF announced that Kubeflow, an open community-built ecosystem for standardizing data and AI workloads on Kubernetes, has graduated, confirming its technical maturity. The project now serves as an operational backbone for enterprises running AI training, fine-tuning, and inference in production, with nearly 260 million PyPI downloads.
Cloudflare has added OAuth scope customization, letting users deselect optional permissions on the consent screen rather than facing an all-or-nothing choice. Client owners can now mark specific scopes as optional when configuring an OAuth app, and any access token generated after consent will only contain the scopes the user approved. Cloudflare says it plans to expand its account and zone-level role surface over the next few weeks to cover nearly every Cloudflare product, adding more API token roles, account membership options, and OAuth scopes.
Bun 1.4 improves Node.js compatibility with more than 1,500 additional passing Node test cases while cutting idle CPU usage by up to 5×, reducing memory use by as much as 48% in some server workloads, and roughly doubling startup speed on Linux. The release also adds new built-ins including image processing, WebView, Markdown parsing, cron jobs, parallel test and script execution, package auditing, and deduplication, while continuing Bun's broader migration from Zig to Rust.
AI is driving a surge in software vulnerabilities and security fixes as models uncover legacy bugs while generating new flawed code, creating competing pressures that may keep patch volumes elevated. The future could range from highly stable, rarely patched software to continuously changing applications where daily builds effectively replace traditional patching.
Datadog built an internal Git mirror service called gitretriever to handle the scale of CI code fetches across its engineering infrastructure. The system now handles more than 100 million requests per week across roughly 5,500 repositories, and served over a billion Git requests and hundreds of terabytes of data in its first four months. Traffic grew about 20 times during that period while median serve latency held at around 40 milliseconds. Moving CI fetch traffic to gitretriever cut fetch-serving CPU on the previous backend by three to four times.
Tencent Zhuque Lab has open-sourced AI-Infra-Guard (A.I.G), a red teaming platform for scanning AI infrastructure, MCP servers, agent skills, and testing large language models for jailbreak vulnerabilities.
Agent Substrate delivers a performant, high-density runtime environment for large-scale agent deployments. The agent substrate control plane provides full lifecycle management for agent sandboxes, delivering sub-second agent resume/suspend operations, and allows heavy multiplexing of agents onto the same computer infrastructure.
A multinational financial services organization migrated from an outdated, stressed single Octopus Server to a five-node High Availability cluster through careful planning, staged testing, backups, and rollback checkpoints. The migration established a stable foundation and led to a regular six-month upgrade cadence with minimal support needs.
Cloudflare researchers demonstrated a remote Spectre attack against its Workers production environment that reliably leaked up to 12 bits per second at 99% accuracy. The attack exploited a gap in Cloudflare's existing Dynamic Process Isolation defense, which only isolates suspicious scripts after an invocation ends, a delay attackers bypassed by keeping a single Durable Object invocation alive for hours via WebSocket messages. Cloudflare says no active exploitation was detected over the past three years. In response, the company has improved its isolation detection, integrated the V8 Sandbox, and deployed Memory Protection Keys to limit cross-isolate memory access within shared processes.
Rust 1.98 adds algebraic floating-point operations that let the compiler reorder calculations and enable broader vectorization, trading strict floating-point determinism for more optimization opportunities without introducing undefined behavior. The release also adds faster buffered integer formatting through format_into, which performs similarly to the popular itoa crate, and stabilizes a range of string, atomic, and numeric APIs.
Sponsored
Build v. Buy looks different now. Does that mean it's time to build your own observability solution? New Relic's Senior Director of
Docker is expanding its software supply chain security platform with hardened images and packages, extended lifecycle support, customizable builds, Helm charts, MCP servers, and Scout policies.
Summing individual experiment wins overstates their true combined effect on a business metric.
Datadog has added AI-native static application security testing (SAST) to its Code Security product, with coverage for the OWASP Top 10 for LLM Applications.
Sponsored
Ever wish it was someone else who scrambles to root cause an incident on a Friday evening? Meet your new teammate. They're happy to troubleshoot while you're building what's next. >> Autonomously investigates issues and identifies root causes across AWS, multicloud, and on-premises environments >> Delivers prioritized recommendations to continuously improve application reliability >> Reviews code changes and runs autonomous testing so you ship to production with confidence
Ready to put AWS DevOps Agent to work? GET STARTED [6]→
AWS GovCloud now offers Claude Opus 5 through Amazon Bedrock, bringing stronger coding, long-running agent, reasoning, and complex document analysis capabilities to government workloads. Zero data retention is enabled by default, while regional data residency and AWS-managed features support enterprise data governance requirements.
celld is an open source, self-hosted implementation of Cloudflare Workers and Durable Objects that uses S3-compatible storage, SQLite, and Rust's Tokio runtime. The project aims to provide the same stateful serverless model without vendor lock-in and potentially at substantially lower cost, though Cloudflare disputes the reported savings.
DuckDB 2.0 will add client/server operation through the Quack protocol, triggers, asynchronous I/O, a new storage format, and a new extensible SQL parser. The release also improves query execution and remote-storage performance, with DuckDB reporting roughly 40× faster execution for one recursive CTE benchmark and new partition-aware optimization for lakehouse workloads.
Automating Kubernetes release validation in CI/CD reduced manual verification from about 45 minutes to 2 minutes by checking pod readiness, failure states, and a 60-second stability window before marking releases successful. The approach improves consistency, surfaces failures earlier, and ensures a green pipeline reflects application health rather than deployment completion alone.
Acadia is a public-alpha programming language that compiles typed, functional database code into SQL, aiming to bring custom types, compiler-verified migrations, better error messages, and end-to-end type safety to SQLite-backed applications. Developers define tables and transactions with constructs like map, filter, and typed bindings, while Acadia generates and optimizes the underlying SQL and integrates those types with client and server code.
OpenViking is an open-source context database for AI agents that stores memories, resources, and skills as a virtual filesystem under the viking:// protocol. Agents navigate their own context using commands like ls, tree, and find rather than querying a vector store. Content is organized into three tiers: L0 abstract, L1 overview, and L2 details, loaded on demand.
ai-memory is an open source tool that gives AI coding agents persistent memory across sessions and across different agent tools, so work started in Claude Code can be picked up in OpenAI Codex without re-explaining context. It stores session history as plain markdown in a git repo, using SQLite with FTS5 search and optional vector embeddings, with no vector database required. The tool supports Claude Code, Codex, OpenCode, Kiro CLI, Grok Build CLI, and several other agents. It runs as a single Rust binary and is available via Docker for amd64 and arm64, or as native packages for macOS and Arch Linux.
LLM coding agents can optimize aggressively for benchmark scores without improving—and sometimes while hurting—real-world performance, making even broad benchmark suites easier to game unless results are independently audited. In one experiment, an agent-built regex engine appeared 40% faster than Rust's regex crate on its target suite but was dramatically slower on a holdout workload, with later inspection also finding benchmark-specific shortcuts and outright cheating.
GitHub suffered a nearly eight-hour incident affecting Issues, Pull Requests, APIs, Actions, Copilot, and authentication, with web/API error rates reaching about 20% and some downloads reaching 50%. A traffic spike exhausted an Istio sidecar's concurrency limit, a misconfigured autoscaling policy prevented it from scaling, and the failure cascaded into overloaded HAProxy nodes. A VS Code retry bug separately amplified Copilot token traffic by roughly 10× and delayed recovery.
GitHub's Secure Open Source Fund invested over $500,000 across 50 projects, helping maintainers strengthen security through expert guidance, GitHub tooling, and AI-assisted workflows.
Azure Pipelines now supports arm64 macOS agents in public preview, letting Apple developers build and test applications natively on Apple Silicon instead of running them through Intel emulation.
Linux 7.2 adds cache-aware scheduling, ext4 filesystem improvements, and a range of new hardware drivers.
Sponsored
The CRA's 24-hour reporting clock starts September 11, including for products already shipped. It assumes you can name every dependency in every release. 📦 SBOM requirements [5] across CRA, PCI DSS, and DORA, in CycloneDX or SPDX. ⏱️ FedRAMP's 30/90/180-day clocks wired as engineering SLAs, and why one EOL component regenerates overdue findings on every scan. 🧾 The three statuses every dependency needs: maintained upstream, commercially supported, or scheduled for removal with a date. 👉 48 cited sources. Trusted by Google, Microsoft, FINRA, and Santander.
Argo Workflows 4.1 adds OpenTelemetry tracing, improved resource and artifact management, GPU and device allocation through Kubernetes DRA, stronger database authentication and reliability, expanded CLI capabilities, UI enhancements, and reduced controller memory usage.
Cloudflare has launched tools that let account administrators apply Access authentication policies directly to Workers, the company's serverless application platform. A policy set at the account level automatically covers all Workers in that account, current and future, without requiring individual developers to configure anything. Access can protect preview URLs, production traffic, or both, and authenticated requests now expose user identity data through a context object so developers can personalize responses or log activity per user.
Bitbucket Pipelines provides a built-in CI/CD workflow for automating Terraform and OpenTofu, with reusable YAML steps for formatting, validation, planning, and applying infrastructure changes. The guide demonstrates AWS S3 state storage and OIDC authentication, while highlighting dedicated infrastructure automation platforms as alternatives.
Cloudflare is adding new controls to its Zero Trust platform to help security teams monitor and manage AI agent traffic using the Model Context Protocol (MCP). The new tools include a Gateway selector that detects MCP traffic based on protocol headers, a dashboard showing which hosts and users are generating that traffic, and Traffic Source selectors that let administrators distinguish requests routed through approved MCP Server Portals from direct connections that bypass them. MCP Portals now also support pre-registered OAuth clients, covering providers that require a fixed client ID and secret rather than dynamic registration. Private network connectivity for MCP Portals is in development.
Cactus Compute has released Needle 2, an open 45-million-parameter model for tool calling, device use, and structured data extraction. The entire model is a single 14MB binary that runs a full session in about 28MB of RAM. On benchmarks, it trades wins with models 5x to 70x larger, including FunctionGemma 270M, LFM2.5 230M, and Apple FM, while running at 2-bit quantization against their 16-bit versions. It installs via pip and supports LoRA fine-tuning, with weights available on Hugging Face.
Unsloth is a local tool for running, training, and deploying AI models that supports a wide range of models including Qwen3, DeepSeek, Gemma 4, and image generation models like FLUX. It comes in three forms: a desktop app, a web UI called Unsloth Studio, and a code-based version called Unsloth Core. A feature called Unsloth Start connects external coding agents like Claude Code and Codex to local models with a single command.
Smaller models are improving rapidly at reasoning while retaining less factual knowledge, shifting more of the system's intelligence into retrieval, tools, and external context supplied at runtime. This trade can make models cheaper, more current, and easier to correct because facts live in inspectable data sources rather than opaque weights, while the model focuses on reusable reasoning procedures.
Recent research on AI-assisted software development shows a consistent gap between higher output and better outcomes: teams generate more code, commits, and larger diffs, but often do not ship faster or produce better software. Evidence also points to limitations in long-horizon agent reliability, effective context size, repository-level instructions, and benchmark realism, suggesting AI amplifies existing engineering strengths and weaknesses rather than replacing disciplined development practices.
Docker is introducing a unified virtual machine manager in Docker Desktop 4.86 beta to deliver consistent performance across macOS, Windows, and eventually Linux. The internally built VMM aims to improve startup, recovery, I/O, file sharing, and memory efficiency while reducing platform-specific inconsistencies from third-party virtualization systems.
Sponsored
Keep your workloads running with durability. Recover from failures and scale to production with self-healing workflows, agent-native execution and real-time inference. Try Flyte 2 [16].
PagerDuty's 2026 report identifies 13 questions executives ask after major incidents across immediate impact, root cause, and strategic phases.
KubeVirt cross-cluster live migration is enabled by EVPN/VXLAN overlays that stretch Layer 2 networks and isolate migration traffic through OpenPERouter-managed CRDs.