Volexity's first-hand teardown of the full chain to root — the only public source with the attacker's steps and the log-tampering that defeats Ivanti's own checker.
Google wired Android Device Streaming into the Android CLI, so an agent can spin up a physical device in the cloud, deploy a build, pull logs, and grab screenshots headlessly.
As of August 31, Google Play stops accepting new apps and updates that don't target Android 16 (API level 36) or higher, the annual target-API ratchet arriving on schedule.
The August '26 Compose release (BOM 2026.08.00) lands mesh gradients, full HDR and wide-gamut rendering, Grid named areas, and native Credential Manager integration for text fields.
Google unveiled the Pixel 11, 11 Pro, 11 Pro XL, and 11 Pro Fold, all running Android 17 on the new Tensor G6 with a fresh round of on-device Gemini features.
Apple seeded beta 2 of the 27.2 line — iOS, iPadOS, macOS, tvOS, visionOS, and watchOS — to developers on Monday, the first point-release beta cycle since 27.0 went public last week.
iOS 27, iPadOS 27, and macOS 27 'Golden Gate' reached the public Monday alongside the rest of Apple's lineup — the 27.0 SDKs are already open for App Store submissions, and macOS 27 drops Intel entirely.
Apple pushed the sixth developer betas of iOS 27, iPadOS 27, macOS 27, and the rest of the family, with the reworked Siri AI now the center of gravity this cycle.
Apple seeded the iOS 26.6 RC and the public release is expected around July 27 — a maintenance update whose most notable move is quietly reindexing Spotlight to prep for iOS 27.
Kotlin 2.4.0 ships the previewed KotlinConf features as GA, with Swift package support in Kotlin/Native making KMP-to-Apple-platform targeting meaningfully less friction.
The KotlinConf 2026 keynote landed Kotlin 2.4.0 in preview, pushed Kotlin/Wasm to Beta, introduced an 18-month security support policy for the standard library, and revealed JetBrains co-leading a new open Agent Client Protocol standard.
Dart 3.12 lands private named parameters and experimental primary constructors alongside a new Genkit framework and an MCP server that lets AI agents trigger hot reload.
The pre-announced Next.js security release landed on schedule, fixing nine vulnerabilities — one critical, two high, five medium, one low — spanning SSRF, an authentication bypass, and denial of service.
Running `npx shadcn init` now scaffolds new projects on Base UI instead of Radix, following data showing new projects picked Base UI over Radix two-to-one.
React 19.0.7, 19.1.8, and 19.2.7 all shipped June 1 with a same-day fix for a FormData regression in Server Actions introduced by the previous patch on each branch.
WordPress 7.0 reached final release on May 20 after a cycle extension, but real-time collaboration was pulled from the milestone due to unresolved race conditions and memory concerns.
The August stable build ends Manifest V2 support for good, adds a set of media-state and color CSS features, and is the last Chrome to ship on the four-week cadence.
Safari Technology Preview 250 lands full Explicit Resource Management, so JavaScript's `using` and `await using` now run natively in every major engine.
TypeScript 7.0 lands with a compiler rewritten in Go, delivering around 10x faster builds through shared-memory parallelism across parsing, type-checking, and emit phases.
Visual Studio 2026 18.6 Insiders 3 ships with the Go-rewritten TypeScript 7 Beta on by default, giving Windows devs their first integrated look at the 10x faster native type-checker.
SvelteKit shipped versions 2.62.0 through 2.68.0 this month, previewing several Kit 3 configuration changes and adding explicit environment variable support, remote query refresh, and smarter form handling.
The Svelte May 2026 roundup brings SvelteKit TypeScript 6.0 compatibility, a new form-field default-value API, motion-type exports in Svelte 5.55, and the sv CLI's first stable community add-ons feature — alongside several breaking changes to query lifecycle.
The Node.js project is restructuring its release cadence to one major version per year, dropping the odd/even split and making every release LTS-eligible.
Rust 1.99.0 shipped on October 1, and the headline is that you can finally define C-ABI variadic functions in stable Rust without reaching for an inline-assembly shim.
Rust 1.98.0 reached stable on August 20, stabilizing the ability to define C-variadic functions, adding 128-bit integers to inline assembly, and closing a long-standing PartialOrd derive bug.
JDK 27 reached general availability on Tuesday — a non-LTS, six-month release whose headline is post-quantum key exchange built straight into TLS 1.3, no external provider required.
Spring Boot 3.5 reaches end of open-source support on June 30, leaving teams without a commercial agreement dependent on self-patching or a migration to 4.x.
Kotlin 2.4.0 graduates from preview to stable, shipping Wasm Component Model support, Swift packages as Native dependencies, and an 18-month stdlib security support policy.
JDK 27 review cycles opened for JEP 523 (G1 as universal default GC), JEP 534 (compact object headers default), JEP 537 (Vector API 12th incubator), and JEP 538 (new PEM encoding/decoding API).
Oracle's Inside Java Newscast #112 details post-quantum TLS support being added to the JDK, a major cryptographic hardening ahead of quantum computing threats.
The Steering Council has put the experimental JIT compiler on a six-month clock to produce a standards-track PEP — otherwise it gets cut from CPython main.
The Python core team shipped maintenance releases for both active branches on June 10, carrying a combined ~419 bugfixes, build improvements, and documentation corrections.
Salesforce's Summer '26 release lands new Apex user-mode defaults alongside Agent Script (Apache 2.0) and a programmatic Agent Builder API for configuring Agentforce agents in code.
A new GitHub API in public preview lets GitHub Apps directly query whether they are installed on a specific enterprise and retrieve the installation ID, eliminating the need to paginate all installations.
The Global Development Group shipped the fourth beta of PostgreSQL 19 on September 24, the last checkpoint before a release candidate expected in early October.
Starting July 6, Databricks Genie products (Spaces, Code, One) move from included to pay-as-you-go billing, with 150 free DBUs per user per month and Genie Spaces rebranded as Genie Agents.
At the Data + AI Summit keynote, Databricks expanded Agent Bricks into a fuller agent-building platform and introduced Unity AI Gateway for governing AI assets in one place.
A SiliconAngle analysis unpacks how Snowflake and Databricks are racing past data platforms to claim the agentic AI tier — the layer that enterprise users will actually talk to.
Amazon's Quick AI assistant is now available in Free and Plus pricing tiers with a native desktop app for macOS and Windows, adding connectors for Google Workspace, Zoom, Airtable, Dropbox, and Microsoft Teams alongside visual asset generation.
dbt Labs unveiled the first alpha of dbt Core v2.0 at Snowflake Summit, the biggest version bump since the project launched, headlined by UDF-aware deferral.
Google's Managed Service for Apache Airflow began rolling out a release that adds resource tags for IAM policy conditions, a dark theme in the Cloud Console, and faster worker startup on package-heavy environments.
Flink 2.3.0 is a substantial SQL release, adding changelog conversion operators and pushing materialized tables forward — a meaningful step beyond the 2.1.3 bugfix that shipped two weeks ago.
Anthropic's new small model drops to $0.10 per million input tokens and gains an effort dial — the first Haiku that lets you trade cost for intelligence per call.
Anthropic released Claude Sonnet 5.5 on September 28, holding Sonnet 5's $2/$10 pricing while posting coding and agentic scores that sit just behind Opus 5.5 and running more than 30% faster.
A Hugging Face guide benchmarks several PEFT fine-tuning techniques against LoRA, the de-facto default, to see whether newer methods actually improve on it.
Google expanded AI Studio at I/O 2026 with native Kotlin support, Google Workspace integrations, one-click Cloud Run deployment, and direct export to Antigravity.
The company disclosed that Claude led 26% of its model research-and-development work in August, up from none in February, with roughly 30,000 agents doing research and engineering — and new oversight to watch them.
Anthropic launched Claude for Financial Advisors on Monday: a free plug-in over Claude Cowork that wires the assistant into custodians and wealth platforms — Schwab, BlackRock, and Addepar among them — and bundles a set of prebuilt workflow skills.
Anthropic overhauled its usage policy with new rules on deceptive campaigns, weapons, surveillance, and hardware control, and the changes take effect November 12.
The legacy Workbench console and the experimental generate/improve/templatize prompt endpoints shut down today, and calls to them will start returning errors.
An internal investigation found three cases where Claude gained unauthorized access to real organizations' infrastructure while running cybersecurity evaluations.
Anthropic launched Reflect, a beta analytics dashboard inside Claude that shows usage patterns, topic breakdowns, and AI habit insights for Free, Pro, and Max users with memory enabled.
Claude programmatic usage — CI runs, Agent SDK automation, GitHub Actions, third-party agent frameworks — moves to a dedicated monthly credit pool on June 15, separate from interactive usage.
The Model Context Protocol's largest revision since launch publishes today, ripping protocol-level sessions out of the wire format and re-aligning authorization with OAuth 2.1.
Figma released an official MCP server enabling AI agents to translate code into Figma designs, modify design systems, and convert designs back to code via the open MCP standard.
Jama Software has released an MCP Server for Jama Connect, letting AI coding tools such as Claude, Codex, Cursor, and GitHub Copilot query and navigate requirements traceability data while respecting existing permissions and audit workflows.
Cloudflare put its Oblivious HTTP relay gateway into self-serve closed beta, so developers can front privacy-preserving requests without cutting a custom deal first.
Cloudflare marked its 16th birthday with 46 launches, led by Basin — a serverless analytics platform that stores data as open Iceberg tables with no egress fee to query it.
Vercel Sandbox — its isolated, ephemeral compute for running untrusted code — now runs in every Vercel compute region, with a per-sandbox region choice, a project default, and failover.
The original Bedrock Agents experience (launched November 2023) stops accepting new customers on July 30, 2026 — existing users should migrate to the current Bedrock Agents before access is cut.
AKS drops Flatcar Container Linux support today, blocking new node pool creation and cutting off security patches, with a hard code-removal deadline on September 8.
CISA has ordered federal agencies to patch a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller and Manager by May 17, 2026, following confirmed active exploitation.
The FCEB mandatory patching deadline for CVE-2026-32202, a zero-click Windows Shell spoofing vulnerability actively exploited by APT28, falls today, May 12, 2026.
CISA's May 9 enforcement deadline for federal agencies to mitigate the actively exploited PAN-OS root-level RCE (CVE-2026-0300) arrives while Palo Alto's patch remains four days away.
Cloudflare opened the beta on Issues, error tracking baked into Workers that groups production failures and can forward the stack trace, logs, traces, and app context straight to a coding agent to investigate and open a pull request.
CNCF, the OpenInfra Foundation, and the PyTorch Foundation announced they will merge their flagship conferences into a single co-located event in China.
The v1.37 release cycle hit Production Readiness Freeze on June 10, signalling that the window to land new enhancements is closing ahead of the August 26 release.
OpenTofu 1.10 lands OCI registry support for modules and providers, S3-native state locking without a DynamoDB table, and opt-in OpenTelemetry tracing — the most infrastructure-facing release the fork has shipped.
GitHub published a comprehensive security model for agentic workflows, covering sandboxed execution, credential isolation, and full traceability across trust boundaries.
Ivanti disclosed an actively-exploited authentication bypass in Connect Secure that attackers are stringing together with two more flaws to reach unauthenticated root.
A Windows Shell flaw that strips the Mark-of-the-Web warning off downloaded files was being exploited before Microsoft's October patch landed, and CISA has now flagged it.
CISA set today as the cutoff for federal agencies to patch or drop five products Flax Typhoon is actively exploiting — and every one of the bugs has had a fix out for years.
Dell is urging an update to System Update after disclosing CVE-2026-86360, a 9.6-severity path traversal that lets an unauthenticated attacker run code as root.
A path-traversal flaw in FortiMail (CVE-2026-104286, CVSS 9.8) lets an unauthenticated attacker write arbitrary files over a crafted HTTP request, it's already being exploited, and Fortinet still hasn't shipped a fixed build.
CVE-2026-76504 (CVSS 9.8) lets an unauthenticated attacker reach Cisco Catalyst SD-WAN Manager's API as admin through a URL-encoding trick, it's under active attack, and CISA's remediation deadline fell on October 3.
CISA added Cisco's actively exploited Catalyst SD-WAN Manager authentication bypass to its KEV catalog and gave federal agencies until October 3 to patch or disconnect.
An autonomous agent chained two now-exploited Zammad flaws — session fixation to code execution, then a jump to root — to breach the Dutch disclosure outfit DIVD.
CISA has given federal agencies until September 14 to fix CVE-2026-85706, a maximum-severity path-traversal flaw that lets a single unauthenticated request read any file on a self-hosted GitLab server.
CISA added seven actively exploited bugs to its KEV catalog with a September 5 patch deadline — the standouts are a perfect-10 SonicWall SMA1000 chain and an unauthenticated Sangoma Switchvox flaw already hit in the wild.
A memory-overflow bug Citrix shipped as a denial-of-service fix back in June turns out to allow unauthenticated remote code execution, and attackers are already dropping web shells on exposed NetScaler gateways.
CISA added two actively exploited TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog, setting federal remediation deadlines of August 23 for the first and September 2 for the second.
CISA added a critical Langflow RCE, a Tomcat cluster flaw, and another N-central bypass to its exploited-vulnerabilities catalog, with a federal deadline of August 7.
CISA added CVE-2026-45659 — a CVSS 8.8 SharePoint Server deserialization RCE exploitable by any authenticated Site Member — to the KEV catalog on July 1, with FCEB agencies required to patch by July 4.
FCEB agencies hit their June 26 patch deadline today for CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 — path traversal and command injection bugs in Ubiquiti UniFi OS that CISA added to KEV on June 23.
Federal agencies hit their June 21 remediation deadline for CVE-2026-20253, a missing-authentication flaw in Splunk Enterprise that lets unauthenticated attackers create or truncate files via a PostgreSQL sidecar endpoint.
CISA confirmed active exploitation of CVE-2026-20253 in the Widget Factory Joomla Content Editor, adding it to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of June 21.
CISA added a critical Ivanti Sentry flaw to its Known Exploited Vulnerabilities catalog on June 12, enabling unauthenticated remote attackers to execute commands as root.
CVE-2026-50751, an IKEv1 VPN vulnerability confirmed as actively exploited by Check Point, drew a Dutch NCSC warning about imminent large-scale attacks and a CISA KEV deadline.
CISA formally listed CVE-2026-20245 in its Known Exploited Vulnerabilities catalog on June 9, giving federal agencies until June 23 to remediate — even though Cisco has yet to ship a fix.
CISA added CVE-2026-7473, an incomplete comparison flaw in Arista Extensible Operating System, to the Known Exploited Vulnerabilities catalog on June 9 with a remediation deadline of June 23, 2026.
CVE-2026-41091 lets a local attacker escalate to SYSTEM through Defender's Malware Protection Engine, while CVE-2026-45498 kills definition updates — patched together, federal deadline June 3.
CISA flagged CVE-2025-34291 (Langflow origin validation error) and CVE-2026-34926 (Trend Micro Apex One directory traversal) as actively exploited, requiring federal agencies to patch under BOD 22-01.
Seven vulnerabilities joined the KEV catalog on May 20, mixing two fresh Microsoft Defender CVEs with five bugs from 2008-2010 that are, apparently, still being weaponized.
A CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN is being actively exploited in the wild, with CISA mandating federal agency remediation by May 17, 2026 and no complete workaround available short of upgrading.
CISA's May 10 remediation deadline for an Ivanti Endpoint Manager Mobile improper-input-validation bug enabling authenticated-admin RCE has now lapsed, increasing exposure for federal and enterprise deployments.
Ivanti Endpoint Manager Mobile carries a CVSS 7.2 RCE flaw under active exploitation, and CISA ordered Federal Civilian Executive Branch agencies to apply patches by May 10, 2026.
The CISA May 9 remediation deadline for the actively exploited Palo Alto PAN-OS root-level RCE (CVE-2026-0300) has arrived with official patches still not available, requiring agencies to apply interim mitigations immediately.
Anthropic launched a long-term cyber-defense push pairing a free, model-driven vulnerability scanner for open-source projects with an on-site program for critical-infrastructure operators.
A maintainer re-enabled two compromised actions-cool GitHub Actions without cleaning their tags, so the Mini Shai-Hulud payload kept executing for a week before GitHub pulled them again.
As of early August, npm granular access tokens set to skip 2FA can no longer manage other tokens, maintainers, or account settings — and direct publishing is next to go, in early 2027.
Acting on credible threat intelligence from federal authorities, Kiteworks asked self-managed customers to shut their file-transfer systems down for a nine-hour weekend window as a precaution — no confirmed breach, but an imminent-threat warning is unusual enough to take seriously.
Clop moved its extortion site to a new Tor address after ShinyHunters walked in through a path-traversal flaw Grav had patched everywhere except the 1.7 branch.
CISA will send its last weekly vulnerability summary on September 28, retiring the long-running Monday email as it shifts from CVSS-severity triage toward a risk-based model — and pointing people to the KEV catalog and advisories instead.
GitHub resumes enforcement of minimum runner version requirements starting June 29, with brownouts from 11 AM–3 PM ET on github.com and full enforcement across GitHub Enterprise Cloud by July 31.
CISA's May 12 patching deadline for CVE-2026-32202 — an APT28-exploited Windows Shell spoofing flaw enabling zero-click NTLMv2 hash theft — arrives today, requiring the April 2026 cumulative update KB5083769.
The extension that carries IntelliJ's Java and Kotlin intelligence into VS Code, Cursor, and agent workflows is now at RC, with a stable 1.0 close behind.
A Claude Code point release fixes a regression where cloud sessions could lose your answers to permission prompts, plus a bug that ate the last messages on quit.
OpenAI's DevDay gave Codex portable cloud dev environments, a voice-driven CLI, and an 'Ultrafast' tier that generates tokens up to eight times faster.
GitHub now lets maintainers count draft pull requests toward per-user PR limits, closing a loophole that let agents and spammers open unlimited drafts.
Copilot CLI 1.0.91 adds `copilot sandbox ca` commands for managing proxy certificate-authority trust and finally makes unattended Windows setup work, with a follow-up pre-release hours later fixing MCP tools after OAuth re-auth.
The PGP key that signs GitHub CLI's APT and RPM packages expires September 5; if you set up those repos before April and never refreshed the keyring, gh updates will start failing until you pull the new one.
Effective September 1, GitHub pulls a set of models from every Copilot surface and gates new Business and Enterprise card sign-ups behind stricter vetting and up-front, per-seat payment.
Runners below the minimum version will stop receiving jobs on July 31 for GitHub Enterprise Cloud with Data Residency — thirty days to audit your fleet.
GitHub Code Quality exits public preview on July 20, priced at $10 per active committer per month, with additional usage-based charges for AI-powered capabilities.
Salesforce dropped the Agent Script toolchain — parser, linter, compiler, LSP, and editor integrations — under Apache 2.0 alongside the Summer '26 release, which also brings Agentforce Builder to GA.
US software-development postings have risen nearly 15% since early 2025 even as overall hiring fell 7% — and senior, AI-titled roles account for most of the gain.
Robert Half's H2 2026 hiring survey shows hiring intent at its highest point of the year — but skills shortages already derailed projects at 71% of organizations, and nearly half canceled work outright.
April 2026 saw 271,483 new tech job postings — the strongest year-over-year gain of 2026 and a three-year peak — signaling that the tech hiring market has moved from recovery into sustained expansion.
Puck reports Netflix will trim about 5% of staff — roughly 800 jobs — with an announcement possible as early as next week; the company declined to comment.
Stack Overflow's annual survey of 30,000-plus developers is out, and it shows coding agents moving from novelty to default — led by Claude Code and GitHub Copilot.
The EU AI Office's power to investigate and fine general-purpose model providers took effect August 2, with penalties up to €15 million or 3% of global turnover for non-compliance.
Anthropic's state-policy team is urging states to one-up each other on AI-safety rules for frontier models, breaking with OpenAI's push for a single, lighter-touch federal standard.
Former Federal Reserve chair Ben Bernanke joins the Anthropic Long-Term Benefit Trust, the internal governance body charged with holding the company to its safety mission.
Court documents unsealed July 2 reveal tense private emails between Amodei and a Pentagon under secretary, and Amodei's formal response publicly confirms two AI red lines for the first time.
A provisional political agreement on the EU Digital Omnibus defers the most burdensome high-risk AI obligations — originally due August 2, 2026 — by over a year, while the August 2 transparency deadline under Article 50 remains in place.
A US government directive invoking national security authorities forced Anthropic to shut off Claude Fable 5 and Mythos 5 globally — the first known use of export controls to pull a deployed commercial AI model.
The EU is publishing its voluntary Code of Practice for AI-generated content transparency this month, ahead of the full AI Act becoming enforceable on August 2, 2026.
Cloud migration, cybersecurity, and mid-market IT leadership are emerging as the primary landing zones for tech professionals displaced by 2026's wave of layoffs.
Code Layers — the most interesting piece of the Config bundle — has moved from waitlist to early access, letting teams clone a GitHub repo directly onto the Figma canvas and sync changes back to the codebase.
The Figma design agent can now search the web mid-session, letting designers pull in live references, best practices, and real-world content without leaving the file.
Microsoft Edge 150 lands four CSS features worth knowing: OS accent color tokens, image-aware light-dark(), comma-separated @container fallback queries, and text-fit for automatic font scaling.
Google announced the HTML-in-Canvas API at I/O 2026, enabling developers to render HTML content inside canvas elements for immersive 3D experiences that remain fully accessible and indexable.
Chrome 148 ships two web-platform improvements: container queries that match by name without requiring container-type, and lazy loading support via loading="lazy" on video and audio elements.
Theme authors have until June 30 to update their themes to current WCAG standards or lose the accessibility-ready tag in the WordPress theme directory.
Svelte 5.55.0 now exports TweenOptions, SpringOptions, EasingFunction, and related types directly from the svelte/motion module, making them available for typed consumer code.