Blog
Insights on software development, security, and technology from our team.
4 million developers on AI coding agents. Is anyone checking the output?
OpenAI's Codex hit 4 million weekly developers this month, up from 3 million just two weeks earlier. GPT-5.5 dropped the same week. Meanwhile, security research keeps showing that AI-generated code leaks secrets at double the human rate and nearly half of it contains known flaws. We break down what development teams should actually do about this.
Three Windows zero-days are in the wild. One is patched. Here's what to do about the other two.
A frustrated researcher leaked three Windows privilege escalation exploits, attackers are already using them against enterprise targets, and only one has a patch. We break down what development teams should do right now.
AI is finding your bugs faster than you can patch them
Anthropic's Mythos model found thousands of zero-days in major software this week. A critical Python notebook flaw got exploited in 10 hours. The vulnerability window has collapsed, and most teams aren't ready.
The LiteLLM supply chain attack is a wake-up call for every team running AI tooling
A 40-minute window on PyPI compromised thousands of environments. The Trivy/LiteLLM supply chain attack is the biggest development security story of the week, and it has practical lessons for any team with unpinned Python dependencies.
Apple is pulling vibe-coding apps, and honestly, we get it
Apple removed the AI app-builder "Anything" from the App Store last week, citing code execution rules. It's the third vibe-coding tool Apple has targeted this month. Here's why this matters for every team building on iOS, and what to do about it.
AI agents are touching your keyboard now. What could go wrong?
Claude can now control your Mac, OpenClaw is going viral, and every AI lab wants their model clicking buttons on your behalf. Here's what development teams should actually worry about, and what to do about it.
A Chrome zero-day is being exploited right now. Here's what your dev team should actually do.
CVE-2026-3910 targets Chrome's V8 JavaScript engine and is already being used in real attacks. It affects every Chromium-based browser your team uses. We break down what happened, why it matters beyond "just update Chrome," and the practical steps most teams are still skipping.
Your AI coding tools are fast. Your pipeline isn't. That's the real problem.
This week's Harness DevOps report and Anthropic's new Code Review tool tell the same story: teams are generating code faster than ever, but testing, security, and deployment can't keep up. Here's what we think you should actually do about it.
Cursor's always-on coding agents are here. Are your teams ready?
Cursor launched Automations this week, letting AI coding agents run continuously without human prompting. We break down what this means for dev teams, code quality, and security posture.
That BeyondTrust RCE is worse than you think
CVE-2026-1731 went from disclosure to active ransomware exploitation in under a week. If your team uses remote support or privileged access tools, here's what you should be doing right now, and what this pattern means for how you architect access going forward.
A 9.9 CVSS bug in your remote access tool is now in ransomware campaigns
CVE-2026-1731 in BeyondTrust Remote Support went from disclosure to active ransomware exploitation in under two weeks. If your team uses remote access or privileged session tools, here's what you should be doing right now.
Laravel's AI SDK just dropped. So did six zero-days. Here's what matters.
Laravel shipped a first-party AI SDK with unified provider support and an Agent pattern. Meanwhile, Microsoft's February Patch Tuesday fixes six actively exploited zero-days. We break down what both mean for development teams right now.