ActiveState and Docker will both resell each other's hardened libraries and images, certified to SLSA Level 3, with Docker bringing more than 4,000 curated images and ActiveState offering an SLA that produces a hardened library within five days of an upstream fix.

That matters because 90% of application development teams are still running lightly modified public images with little to no hardening, even as AI cuts the time from disclosure to exploit down to hours.

Read the full article on why hardening moves the work to suppliers, and what that still leaves teams to verify: zpr.io/7SfQSwybBP4S

#DevSecOps #SupplyChainSecurity #Docker #ActiveState

Anthropic's IPO bet, open source strain and GitHub security: @mvizard @poller @jswartz @JeffReichCSO @TracyRagan examine the stakes. #Anthropic #OpenSource #GitHub #DevSecOps #AISecurity x.com/i/broadcasts/1…

More than 1,400 vulnerabilities in one Microsoft Patch Tuesday, another 174 from Adobe, and then PHP2Shell sends organizations scrambling to secure a runtime used across much of the web, with governments taking public services offline while their teams work through the exposure.

Patch immediately is the right advice, but by all means tell the team to patch faster, then fund the work, establish who owns it and make sure the business can contain an incident while remediation proceeds, otherwise it is just management passing the problem down the hall.

Read the full piece on what "fixed" actually means in production: buff.ly/a3vZJRG

#Cybersecurity #PatchManagement #PHP2Shell #InfoSec #AppSec

Cisco's Splunk State of Observability 2026 report reveals a real challenge for companies adopting agentic AI: the technology needs extensive monitoring, yet the monitoring itself creates major costs, with 57% of organizations spending more on telemetry than on the infrastructure being monitored and 55% unable to adequately control their AI costs.

More than half can't measure essential indicators like LLM response quality, and 38% report no clearly designated owner for the task.

Read the full findings on where observability spending is going: buff.ly/2Cq5EqB

#AIAgents #Splunk #Cisco #AIOps #FinOps

Hackers compromised LiteLLM this week by injecting malicious code into all seven of its published Python wheels on PyPI, shipping an infostealer and a remote access trojan in version 1.107.0 and the official Docker images, an incident contained quickly but the second time this year the AI gateway has been hit.

The attacker held three sets of developer GitHub CLI credentials, one belonging to an organization owner who disabled branch protections and force-pushed a change that pointed the release workflow at a lookalike repository, and researchers at Wiz say the payload itself carries strong indications of LLM-aided development.

Read the full article on how the attack chain worked and why AI infrastructure layers are now attractive targets: buff.ly/WXX2iB3

#Cybersecurity #SupplyChainSecurity #LiteLLM #AI #InfoSec

Two critical PHP vulnerabilities carrying a 9.2 severity score threaten the 70% of websites running the language, and researchers at Wiz, OpenAI and Calif found them by using frontier AI models to chain steps that sat at the edge of what human researchers could practically achieve.

As the Wiz team put it, PHP2Shell could mark a turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding vulnerabilities, and in-the-wild exploitation attempts are already hitting watchTowr's sensors.

Read the full article on the flaws and what teams should check before the next crisis: buff.ly/JSBlz1m

#Cybersecurity #PHP #InfoSec #AI #AppSec

IT is changing, but just throwing AI at it isn't the answer. Start by solving 3 fundamental problems slowing down your everyday IT. Mike Vizard (Techstrong Group) with Rakesh Jayaprakash (@manageengine) techstrong.tv/videos/intervi… #AIStrategy #ITOps

GemDB is betting that by making it simpler for developers to use GemDB there will be more downloads that eventually lead to its object database being deployed more often in production environments.

Via @devopsdotcom

devops.com/gemdb-extensio…

A new Linux Foundation study finds that generative AI is delivering big productivity gains for open source developers, cutting code-authoring time by an estimated 52%, but it is also creating an influx of low-quality submissions that need time-consuming human review, with roughly 25% of incoming pull requests now considered "AI slop" and 31% at larger projects.

Those additional contributions don't always translate into more usable software, and with only 35% of projects having formal AI policies and 32% having none and no plans to write one, the burden of sorting the usable from the unusable lands on maintainers who are often volunteers.

Read the full findings and what the Foundation recommends: buff.ly/KUtJ4b8

#OpenSource #AI #DevOps #AICoding #LinuxFoundation

AI workloads are putting new demands on familiar infrastructure.

Kubernetes, containers and cloud platforms provide the foundation. Supporting AI applications adds decisions about data, inference, agent orchestration and operational control.

Cloud Native Now 2026 brings those practical sessions focused on The AI Stack.

Hear how practitioners approach real architectures, production challenges and the trade-offs involved in building and operating AI-powered applications.

📅 October 29, 2026
💻 Free virtual event

Explore the agenda and register 👉 cloudnativenowevent.com

#CloudNative #AIInfrastructure #Kubernetes #DevOps

AI adoption in software development is increasing pressure on testing teams as they work to keep pace with frequent code changes, manual testing demands, and the maintenance of existing automation.

In partnership with @UiPath, @TechstrongGroup surveyed 137 software testing ion-makers to examine how organizations are managing testing workloads and preparing for AI-powered and autonomous testing.

The findings show that 43% spend more effort maintaining existing automated tests than creating new coverage. While 62% consider autonomous testing important to their future delivery strategy, only 42% are actively evaluating or adopting AI-powered testing solutions.

Download the full PulseMeter report to explore the research findings and insights into improving testing efficiency, automation reliability, and software delivery.

👉 bit.ly/4dPSOSX

#SoftwareTesting #TestAutomation #DevOps #EnterpriseAI

Moving to Datadog? Don't rebuild everything.

Learn how to migrate SPL queries, dashboards and alerts, parse logs without regex, and search historical logs without rehydration.

Oct. 29, 1 PM ET.
Register: buff.ly/gsle89A
#Datadog #Observability

We've spent plenty of time figuring out how to fit agents into the existing software development lifecycle, but the pull request was built for humans coordinating with humans, and that assumption may be the one that finally has to go.

Review was always a proxy for confidence, and tests, static analysis, mutation testing and progressive delivery can now establish that confidence continuously rather than concentrating it in a single approval step.

Read the full piece on what delivery might look like once the PR stops being the only checkpoint: buff.ly/ekIfmi0

#DevOps #AIAgents #SoftwareDevelopment #CICD

Harness this week added AI Budgets to its Cost Management Agent, letting organizations set spending policies by user, team, developer, model or project and see the tokens going into input, output and reasoning for any given task.

Built first as an internal tool, it delivered a 37% savings according to Harness's own FinOps director, and the point is to stop treating tokens as though they were a virtually unlimited resource.

Read the full article on how organizations are starting to ration AI spending: buff.ly/5RmspVP

#AgenticAI #FinOps #Harness #AICosts #DevOps

AI protests, Kalshi fraud controls and AI reverse engineering: @mvizard @jswartz @TeriRnNY @AndiMann examine trust and oversight. #AI #OpenAI #PredictionMarkets #FraudPrevention #ReverseEngineering x.com/i/broadcasts/1…

Couchbase has extended its database to support AI applications with vector search, semantic caching and integration with Amazon Bedrock, plus a managed MCP server and Agent Memory services that let agents persistently access profiles, conversation history and vectorized facts across sessions.

Legacy databases are not optimized for AI agents, as Couchbase's AI chief puts it, and the challenge now is supporting those workloads without adding another backend platform to production.

Read the full article on how Couchbase is evolving into a data plane for AI: buff.ly/6tqM85Q

#Databases #Couchbase #AI #AIAgents #VectorSearch

Cloud migration and modernization are the prerequisites for AI readiness.

Learn from @awscloud (AWS) and its partners - @softchoice, @kloia_com, @Cognizant, and Evolve Cloud Services - how leading teams keep data, applications, infrastructure, and delivery moving forward after o help you on your AI journey, we have launched the AWS Modernization Learning Hub, a five-part webinar series.

Two sessions are ready to watch today:
• AI Starts with Your Data | Softchoice
• AIDLC: From Knowledge Base to Working Code | Kloia

Three more are coming up live:
• Oct 22 | Continuous Modernization | AWS
• Oct 28 | Engineering Agentic Cloud Migration at Scale | Cognizant
• Nov 4 | The Economics of Infrastructure Modernization | Evolve Cloud Services

Explore the hub and save your seat: bit.ly/4yC5C6S

#AWS #CloudModernization #PlatformEngineering

OpenAI's benchmarks show GPT-6 Astra lifting COBOL from a 10.9% to a 72.1% pass rate and GPT-6.1 Sol hitting 86.6% on COBOL-to-Java migration, but anyone who has worked a COBOL migration knows the hard part isn't syntax.

It's arithmetic, since a rewrite that rounds fixed-point values instead of dropping the extra digits runs cleanly and still produces different financial results, and the benchmark only counts because someone already wrote the hidden tests a real mainframe estate does not have.

See why the test harness, not the model, decides how fast teams can cut over: buff.ly/ZfBztqt

#AI #OpenAI #COBOL #Mainframe #LegacyModernization #DevOps

An ActiveState survey of 307 enterprise technology leaders found 94% of organizations using AI coding tools now depend on more open source software as a result, just as AI models surface more open source vulnerabilities that can be exploited in hours.

Half admit dependencies reach production without review or approval, 32% traced a security incident to an unmanaged dependency in the past two years, and 83% say the cost of managing those risks is rising.

Read the full findings on the paradox at the center of AI-assisted development:buff.ly/o59H71K

#Cybersecurity #OpenSource #SupplyChainSecurity #AICoding

mabl today extended its test automation platform with a harness that enforces guardrails and testing standards for AI agents while using a knowledge graph to assess the impact of a code change, identify the tests needed to validate it and surface coverage gaps before a pull request is even made.

Its agents saved development teams about 100,000 engineering hours in the last 90 days, but as Belcher cautions, DevOps teams cannot rely on AI coding tools to validate the code they create.

Read the full article on why validating AI-generated code has become the bottleneck: buff.ly/77IVqvt

#DevOps #AITesting #SoftwareDevelopment #AIAgents