DevOps.com

Where the world meets DevOps. Powered by @TechstrongGroup.

[DevOps.com @devopsdotcom]

Observability has officially crossed the threshold from an operational line item into strategic infrastructure essential for deploying AI safely. According to research from Futurum Group, 36% of enterprise IT leaders plan to spend over $1 million on observability in 2026, with budgets shifting toward strategic risk management and system control.

Find out more by accessing the Techstrong Group Observability report here: https://t.co/MMxZ0vhlrf

#Observability #AIOps #AgenticAI #PlatformEngineering #DevOps

[DevOps.com @devopsdotcom]

AWS launched Continuum for code vulnerabilities, using AI to detect, prioritize and generate fixes for security flaws. Human approval remains required before patches are applied.

Read more: https://t.co/7YH5XxiJmd

#AWS #DevSecOps #Cybersecurity #AI #ApplicationSecurity

[DevOps.com @devopsdotcom]

Axon's new AI-powered Body 5 Pro camera can scan licenses, translate conversations and alert supervisors to escalating encounters, raising questions about privacy and AI reliability.

Read more: https://t.co/5iT7Dx0aCM

#Axon #AI #LawEnforcement #PublicSafety #AIInnovation

[DevOps.com @devopsdotcom]

An analysis of 100 million pull requests by Jellyfish finds Claude Code is the AI coding tool used most often to merge them at 31%, followed by GitHub Copilot at 23%, with agents involved in 28% of merged PRs but a median of just 0.5% merged without human review.

Throughput roughly doubled since August while release rates rose 48%, suggesting DevOps teams are creating more code than ever that is not making it into production, and the issue they need to address next is the process used to build and deploy software with AI.

Read the full findings on why there is no substitute for human judgment across the software development lifecycle: https://t.co/FGvayT2y34

#AI #AICoding #DevOps #ClaudeCode #GitHubCopilot

[Security Boulevard @securityblvd]

ProjectDiscovery added Neo Triage, a free tool that validates every security finding by reproducing it in an isolated sandbox, then determines actual severity, suggests a fix, drafts a reply to the researcher and retests once the fix lands.

The company claims it turns roughly 50,000 hours of manual work into about 8,300 hours of review, and since only a small percentage of discoveries are actually exploitable, validating first is what earns developers' trust in the findings.

Read the full article on why another list of vulnerabilities won't cut it in the AI era: https://t.co/uHEGKZMLIa

#Cybersecurity #VulnerabilityManagement #ProjectDiscovery #OpenSource

[Techstrong TV @TechstrongTV]

Proactive IT management powered by AI predicts ticket volume from outages, allowing for mitigation before issues arise. Mike Vizard (Techstrong Group) with Priya Kumar (@manageengine) https://t.co/BhivEnJQIG #AI #ITManagement

[Techstrong.IT @TechstrongIT]

The chairman and CEO of Everpure said today it's only a matter of time before IT architects must revisit how data is stored across the enterprise, because multiple copies of the same data sets create conflicting versions, and whenever an AI agent encounters those, the chances its output will be flawed only increase.

Resolving that will require a data plane through which data becomes accessible to any application or AI agent, and as Giancarlo puts it, the relationship between data and the application needs to be inverted.

Read the full article on why the data silos characterizing most IT environments will need to be greatly reduced: https://t.co/ttk54IsQ9w

#AgenticAI #DataManagement #AIAgents #Everpure

[DevOps.com @devopsdotcom]

A campaign Wiz calls Gheist has spent more than a month using stolen GitHub tokens to plant workflows that print repository secrets into their own logs, pull the logs through the API, and delete the run within seconds.

GitHub's July control blocks those runs in public repositories, but it does not cover private repositories or GitHub Enterprise Server, where Wiz recovered more than 13,500 branches from over 850 compromised accounts.

See what the researchers found and where the protection stops: https://t.co/g3kwzW8HNz

#Cybersecurity #GitHub #SupplyChainSecurity #InfoSec #AppSec

[DevOps.com @devopsdotcom]

Shipping daily but firefighting after hours? Release frequency may be hiding delivery problems.

Join Eric Minick of Harness tomorrow to learn how to reduce manual bottlenecks and improve reliability.

Tomorrow Oct. 28, 1 PM ET.
Register: https://t.co/AG4jqLmMMO
#DevOps #CICD

[DevOps.com @devopsdotcom]

Anthropic's Frontier Red Team, working with Theorem, used Claude to formally verify security properties in the compiled RISC-V assembly of 123 open source libraries, producing about 180 million lines of Rocq that a proof checker validated while surfacing bugs years of continuous fuzzing had missed.

Nobody has to review that output by hand, because machine-checked proofs shift what people must review from reading code to checking the spec, the trusted models, and every patch the agent made to get a proof through.

See what the proofs covered and what remains unverified: https://t.co/6ATlQjeLYa

#Cybersecurity #AI #Anthropic #FormalVerification #OpenSource #AppSec #DevOps

[DevOps.com @devopsdotcom]

Compliance as code has always been close to this author's heart, but the traditional OPA workflow always felt like more operational overhead than it was worth, until TFLint's Rego ruleset plugin made it possible to define policies alongside your Terraform and enforce them through tooling you already run.

That setup gives instant feedback in the editor and automated validation before code reaches source control, with no custom plugin, no policy bundles and no separate enforcement pipeline.

Read the full walkthrough and the Rego policy it starts with: https://t.co/IjEjh36P38

#Terraform #OPA #TFLint #IaC #Rego #DevOps

[DevOps.com @devopsdotcom]

Release engineering and platform observability lead this week's DevOps openings, with Verkada's firmware role, Fastly's platform observability posting and Snowflake's Observe position all centered on knowing what production is actually doing.

Two roles are fully remote, and OpenAI tops the range at $485,000 for CI/CD and ML infrastructure work.

Browse the roles and where they're based: https://t.co/RGOVDJILgm

#DevOps #Jobs #TechJobs #Hiring #Careers #DevOpsJobs

[DevOps.com @devopsdotcom]

Recursive Superintelligence, the lab led by former Salesforce chief scientist Richard Socher, has released Flint, an open-weight coding model with 40 billion total parameters that activates only about 2.5 billion per token so it can run on a developer's laptop instead of a cloud API, which matters for teams that can't send source code to a third party.

A small team plus AI agents built it from scratch in under four months, and while the speed claims are Recursive's own and still unverified, the release shifts agent governance onto every developer's laptop and outside the platform team's view.

Find out more about what Flint can do and what to test before adopting it: https://t.co/S7cudr4JQ3

#AI #AICoding #OpenSource #DevOps #LocalAI

[Techstrong.ai @Techstrongai]

Google Cloud has unfurled Agent Compute Engine, a service built to run, secure and scale enterprise AI agents in microVMs hosted on stateless appliances with Titan security chips, keeping credentials outside the sandbox and validating every request through dual proxy layers.

It also attacks the cost problem, detecting idle agents and hibernating their sandboxes so a single physical node can host orders of magnitude more living agent microVMs than conventional VMs.

Read the full article on how Google is approaching agent infrastructure: https://t.co/3htuAFtTge

#GoogleCloud #AIAgents #CloudSecurity #CloudNative

[Techstrong TV @TechstrongTV]

Even at industry events, experts often struggle to define DevOps. It is time to move past the confusion and build a shared, community-driven standard. Alan Shimel (@ashimmy) with Marc Hornbeek (Engineering DevOps Consulting), Markus Bause (@PeopleCert) https://t.co/2G1GZngsok

[Security Boulevard @securityblvd]

Sweet Security this week added virtual patching to its runtime security platform, letting teams identify a vulnerability from a catalog and apply a policy control to every node running an affected workload with a single click, then remove it once a real patch ships.

That matters because in the AI era exploits often appear days or weeks before a fix exists, and with this month already being called Black October for its patch volume, few teams will keep pace with everything they're being asked to install.

See how virtual patching works when the patch doesn't exist yet: https://t.co/pwN8hKoTFl

#Cybersecurity #CloudSecurity #VirtualPatching #SweetSecurity

[Security Boulevard @securityblvd]

Mondoo has extended its exposure management platform so AI can close the remediation loop, scanning source code, catching internet-facing exposures and delivering validated pull requests through Microsoft Intune and CrowdStrike Falcon, with each fix tested on a real system and rescanned to confirm it holds.

That matters with roughly 180 new CVEs forecast this year, because humans are becoming bottlenecks that won't keep up with the rate of change.

Read the full article on how defenders are trying to match machine speed: https://t.co/PTDqI1n9Tu

#Mondoo #AI #AIAgents #InfoSec #DevSecOps #Cybersecurity

[Techstrong TV @TechstrongTV]

Machine learning spots patterns like holiday traffic spikes, so IT can fix issues before users ever notice. Mike Vizard (Techstrong Group) with Gowrisankar Chinnayan (@manageengine) https://t.co/joPsJSJq8R #AIOps #ProactiveIT

[Techstrong.ai @Techstrongai]

OpenAI completed a three-week pilot granting METR and Redwood Research evaluators employee-like access to its internal codebase, documentation and technical personnel, a concrete step toward the pledge Sam Altman made in September.

The researchers found several novel vulnerabilities, including an exploit that could let automated agents bypass monitoring for hundreds of recent actions, which OpenAI has since patched, though questions remain about how external evaluators stay independently funded from the labs they audit.

Read the full article on what the pilot revealed and what comes next: https://t.co/W4oUo0v1ex

#AI #OpenAI #AISafety #AIGovernance

[Cloud Native Now @ContainerJrnl]

ActiveState and Docker will both resell each other's hardened libraries and images, certified to SLSA Level 3, with Docker bringing more than 4,000 curated images and ActiveState offering an SLA that produces a hardened library within five days of an upstream fix.

That matters because 90% of application development teams are still running lightly modified public images with little to no hardening, even as AI cuts the time from disclosure to exploit down to hours.

Read the full article on why hardening moves the work to suppliers, and what that still leaves teams to verify: https://t.co/ND9z3jQO1v

#DevSecOps #SupplyChainSecurity #Docker #ActiveState