OAuth Client ID Spoofing: Entra ID Credentials Validated Without Logs
Two active threat groups are validating stolen Microsoft Entra ID credentials via OAuth client ID spoofing — no sign-in logs, no CA policy ...
Google Cloud Run Sandboxes: Run Untrusted AI Code Safely
Google’s Cloud Run sandboxes are in public preview. One deployment flag gives your AI agents ...
New York Freezes AI Data Centers: What Developers Need to Know
New York signed the nation's first statewide data center moratorium. The 50MW rule, GEIS timeline, ...
AWS MCP Server Goes GA: OAuth 2.1 Ends Credential Sprawl
AWS MCP Server hit GA on July 9 with OAuth 2.1 browser-based auth for Claude ...
IBM and Red Hat Lightwell: Fix Open Source Deps, Not Just Find Them
IBM and Red Hat commercially launched Lightwell on July 8 — a platform that actually ...
Kubernetes v1.37: containerd 2.0, cgroup v2, and What to Fix Before August 26
Kubernetes v1.37 ships August 26. Three breaking changes will fail your upgrade silently. Here is the pre-flight checklist to run on your v1.36 ...
Cloud Run Sandboxes Hit Preview: AI Code, No Extra Cost
Google shipped Cloud Run sandboxes into public preview at WeAreDevelopers World Congress. Isolated AI code ...
OpenSSH 10.4: Eight Security Fixes and Post-Quantum SSH
OpenSSH 10.4 patches CVE-2026-60002 (CVSS 9.4 CRITICAL) and seven more flaws. Includes the first experimental ...
CoreWeave’s $35B Debt Loop and Your GPU Cloud Risk
Nvidia funds the neoclouds buying its GPUs, then collects revenue back. CoreWeave burned $4.71B FCF ...
DockSec: Fix Docker Vulnerabilities, Not Just Find Them
DockSec is the OWASP-backed Docker scanner that pairs Trivy, Hadolint, and Docker Scout with an ...