After 5x ARR growth in 2024 and again in 2025, StepSecurity is on pace for its biggest year yet in 2026. What is driving it, and why supply chain security is inflecting.

Cloudflare Radar tracked Internet disruptions driven by natural disasters, government-mandated shutdowns, and DNSSEC key rollovers over the last quarter. This blog post analyzes traffic telemetry to explain how these events impacted global connectivity.

Many of the AI tools we interact with take the form of text boxes. But what if there was a different way to interact with AI? Oleksii Hrzhehorzhevskyi explores a different approach to creating a new AI assistant and how designers can navigate the field as AI continues to change it.

`focusgroup` 属性は、ツールバーやタブリストなどの複合ウィジェットにおける矢印キーのフォーカス移動を宣言的に実装する HTML 属性です。従来必要だった roving tabindex の JavaScript をブラウザに任せ、単一の Tab ストップ、折り返し、最後にフォーカスした項目の記憶などを提供します。この記事では Chrome 150 で利用可能になった `focusgroup` 属性の使い方を紹介します。

In which Adam highlights the integration process and notes some challenges compared to the TanStack setup we covered shortly ago.

※ この記事は、筆者が AI エージェント(Claude Code)と対話しながら執筆しました。読了 ...

第2回となる今回は、Local LLM を開発の相棒として使ってみる、1時間集中の個人参加型ハッカソ ...

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

<p><strong><a href="https://huggingface.co/moonshotai/Kimi-K3">moonshotai/Kimi-K3</a></strong></p>As promised <a href="https://simonwillison.net/2026/Jul/16/kimi-k3/">earlier this month</a>, Moonshot have released the weights for their excellent 2.8 trillion parameter Kimi K3. They're a hefty 1.56TB on Hugging Face.</p><p>Kimi introduced their own janky <a href="https://huggingface.co/moonshotai/Kimi-K2-Instruct/blob/main/LICENSE"&g...

Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

<p><strong><a href="https://www.oneusefulthing.org/p/an-opinionated-guide-to-which-ai-b22">An opinionated guide to which AI to use to do stuff</a></strong></p>It's interesting watching the evolution of Ethan Mollick's guide over time. </p><p><a href="https://www.oneusefulthing.org/p/using-ai-right-now-a-quick-guide">A year ago</a> it was still all about chat - ChatGPT, Claude, Gemini - with o3, Claude 4 Opus, and Gemini 2.5 Pro as the ...

AI Gateway now supports . Set on a request to pin it to the US or EU. Every model provider that supports the selected region handles it the same way. Inference runs there, and any data the provider keeps is stored there.regional inferenceinferenceRegionAI Gateway supports two pinned regions, plus global routing:If no model provider can serve it, the request fails rather than running somewhere else. Every response reports the region that served it, so you can confirm where each request ran.Here's

Safari 26.6 is here.

A practical GitHub Copilot workflow for prototyping, planning, implementing, and reviewing software without chasing every new AI tool.The post The harness is all you need (mostly) appeared first on The GitHub Blog.

agents on Slack can now keep replying in a thread without repeated mentions, cancel an in-progress response or reset a conversation entirely, and react to any event your Slack app subscribes to.eveMentions no longer have to carry the conversation. Once a thread has an active session, your agent can reply on its own.The new hook receives incoming Slack messages, and two helpers decide which ones to handle: detects an explicit mention, and checks whether the message belongs to a thread with an act

New to the GitHub Copilot app? Learn how to start projects, work with AI agents, explore canvases, and streamline your development workflow.The post GitHub Copilot app for Beginners: Getting started appeared first on The GitHub Blog.

pvcli is a curl-like tool designed to simplify the testing of complex privacy protocols like OHTTP.

An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.

Last week, OpenAI evaluated two models on an exploit benchmark within an isolated sandbox. Guardrails were reduced for testing, and the models found a vulnerability in their environment, accessed the internet, and reached Hugging Face's production database.No human directed the action, but the breach is a clear example of how much more capable malicious attackers are when equipped with powerful AI models. But defenders have the same tools, and a clear advantage: knowledge of their own codebase.

now supports WebSocket mode for the OpenAI Responses API. You can keep a persistent connection open and continue each turn by sending only new input items plus , instead of re-sending the full context over a fresh HTTP request every turn.AI Gatewayprevious_response_id up to ~40% faster end-to-end execution on WebSockets for agentic rollouts with 20 or more tool calls.OpenAI reportsThe Responses route opens at and accepts raw frames over a persistent WebSocket connection. The mode is compatible w

The Ember project is excited to announce the release of Ember v7.1. This is a standard minor release as part of the Ember Release Train process.This release contains some serious improvements to the Developer Experience for people using GJS files, adds some new built-in helpers, and furthers our commitment to reduce the number of deprecated npm package warnings seen when generating a new Ember application.Ember.js 7.1Ember 7.1 introduces a number of long-awaited new built-in helpers ({{element}}

Nuxt 4.5.1 and 3.21.10 are out now, fixing several security issues, alongside a critical fix in @nuxt/devtools 3.3.1. We recommend upgrading as soon as possible.

The team has released Nuxt 4.5.1 and 3.21.10, along with 3.3.1, to address eight security advisories, including a high-severity server-side remote code execution vulnerability.Nuxt@nuxt/devtoolsVercel received advance notice of the server-side remote code execution vulnerability, , and deployed platform-wide WAF mitigations before public disclosure.GHSA-9473-5f9j-94wqApplications deployed on Vercel are automatically protected by these mitigations, with no configuration changes required. However,

and its faster serving path, , are now available from US-based providers on AI Gateway, including Baseten and Fireworks. (ZDR) is also supported for both models. Kimi K3 from Moonshot AIKimi K3 FastZero Data RetentionRunning Kimi K3 on US-based providers lets teams with data residency and compliance requirements use the model on US infrastructure. Because AI Gateway serves the models from multiple providers, it automatically routes across them for failover, higher uptime, and more available thro

You can now run with .Claude Managed AgentsChat SDKClaude Managed Agents handles the agent loop server-side, including the model, tools, session state, and sandboxed web research.Chat SDK gives that agent a chat interface through a single type-safe handler, with adapters that carry it to Slack, WhatsApp, and more.To see it work, a new builds a working research analyst you chat with in the browser. It runs on Chat SDK's web adapter, so there's no platform registration, webhook verification, or tu

For CSS Day this year we created a set of cheatsheets explaining Flexbox, Grid, Anchor positioning and Invoker commands. They came out…

はじめに はじめまして、CyberAgent group Infrastructure Unit（C ...

<p><strong><a href="https://vectoral.com/blog/token-relay-market">An Inside Look at the Relay Market Powering Token Resellers and Fraud</a></strong></p>Fascinating investigation by Matt Lenhard into the market that has grown up around reselling LLM tokens at a discount by pooling API keys from various sources.</p><p>This looks to be mostly a thing in China. Resellers sell access to an LLM proxy that offers significant discounts on regular API pric...

記事は ics.media へアクセスしてご覧ください。

Measure how entire components render with the Container Timing API: how it differs from Element Timing, where it helps, and how to try it today.

CSS Grid Lanes は、高さの異なるアイテムを複数のレーンへ隙間なく配置するレイアウト方式です。`display: grid-lanes` を指定することで、JavaScript を使わずに Masonry レイアウトを実装できます。この記事では `display: grid-lanes` の基本的な使い方を紹介します。

はじめに はじめまして。CyberAgent group Infrastructure Unit（C ...

<p><strong><a href="https://astral.sh/blog/ruff-v0.16.0">Ruff v0.16.0</a></strong></p>Astral shipped a significant new version of their Ruff Python linting tool a few days ago on July 23rd. I noticed today because my various CI jobs all started failing thanks to new default Ruff checks and my unpinned <code>"ruff"</code> dev dependency.</p><p>From Brent Westbrook's announcement post:</p><blockquote><p>Ruff now enables...

Canvas UI は HTML-in-Canvas API を活用し、液体シミュレーションやシェーダーといったクリエイティブな UI を構築するためのコンポーネントライブラリです。

Hermes Agent と Slack を連携して要件を整理し、Linear のチケット作成から Coding Worker による実装・検証・Draft PR 作成までを自動化するワークフローを紹介します。

mrmustard 0.7.4 on PyPI was a credential stealer that ran on import, exfiltrating SSH keys, AWS, and Kubernetes credentials. Here is the analysis, IOCs, and how to respond.

はじめに CyberAgent group Infrastructure Unit（CIU）の川原で ...

<blockquote cite="https://twitter.com/bcherny/status/2080713091688583312"><p>More than any of these eval scores, what is most exciting to me is something else: Opus 5 is our least prompt injectable model yet. It is a bit buried in the system card, but across PI evals and red teaming, Opus 5 is very hard to prompt inject successfully.</p></blockquote><p class="cite">— <a href="https://twitter.com/bcherny/status/2080713091688583312">Boris Cherny</a...

A test of the `modern-web-guidance` skill against a real React app, to see whether it actually catches stale frontend patterns and surfaces current best practices.

<p><strong><a href="https://www.anthropic.com/news/claude-opus-5">Introducing Claude Opus 5</a></strong></p>I've been offline <a href="https://en.wikipedia.org/wiki/Elkhorn_Slough">kayaking with sea otters</a> for much of today so I haven't had a chance to put Anthropic's new model Claude Opus 5 through its paces yet. The buzz is positive, and Anthropic's description of it as a "thoughtful and proactive model that comes close to the frontier intel...

Compare the top LLM security tools for AI applications, including Aikido, Snyk, Semgrep, Endor Labs, and Wiz, across code, supply chain, and runtime.Category: DevSec Tools & Comparisons

The can now protect a Vercel Blob store. The same rules that guard your deployments (deny, challenge, rate limit) now apply to blob traffic with no changes to your code, blob URLs, or . Vercel WAF@vercel/blobEvery blob is already served through , so protection is a switch on the store, not a new proxy. Stop scrapers, geo-restrict downloads, rate limit expensive assets, or block abusive IPs before a byte is served.Vercel's CDNRules evaluate at the edge, matching on IP, country, path, and :moreThe

By doing in-depth testing, we found nearly 70% of BGP paths experience ORIGIN attribute rewrites by transit providers seeking traffic advantages. We examine the global impact of this practice and argue for deprecating ORIGIN in route selection.

Certainly it isn't the *only* way, but you've got a lot of angular control with conic-gradient() and it's fun to work with.

A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Exploring Acunetix alternatives? Its DAST covers rule-based checks but can't reason about business logic or produce audit-grade pentests. Five options that go further.Category: DevSec Tools & Comparisons

Workflow steps on Pro and Enterprise plans can now run for up to 30 minutes (1800 seconds), up from 800 seconds, using (in beta).extended function durationsTo opt in, set to in your project's Environment Variables, then redeploy. Requires and a supported Node.js or Python runtime.VERCEL_ENABLE_WORKFLOW_EXTENDED_MAX_DURATION1Fluid computeExtended durations are not available on Hobby plans, which remain limited to 5 minutes (300 seconds).See in the documentation.function duration limits by planRea

HighlightsIn ESLint v10.8.0, the following rules have been updated to avoid incorrect or unexpected behavior in some edge cases:class-methods-use-thisprefer-object-spreadprefer-templatepreserve-caught-errorno-unreachable-loopFeatures2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)Bug Fixes6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (P

Webpack 5.109

from Anthropic is now available on AI Gateway.Claude Opus 5Opus 5 improves on previous Opus models for long-horizon agentic coding, handling multi-file features, larger refactors, and end-to-end feature work, and completing full tasks rather than leaving stubs or placeholders.Opus 5 is effective at low and medium effort, which produce quality at a fraction of the tokens and latency of higher settings. Vision is stronger on charts, documents, diagrams, and UI replication, and Opus 5 makes effecti

はじめに CIU（CyberAgent group Infrastructure Unit）で Ia ...

<p><strong><a href="https://martinalderson.com/posts/huggingface-openai-exploit/">The first known runaway AI agent - or a very bad marketing stunt?</a></strong></p>Martin Alderson's commentary on the <a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">OpenAI accidental cyberattack against Hugging Face</a> includes a couple of details I hadn't considered.</p><p>First, Hugging Face offers a truly rich target if you're try...

Perhaps you’ve seen something that should sail out of cache get dragged back to the origin by a stray Set-Cookie or Cache-Control, headers that can be difficult to change on the origin itself. Cache Response Rules is the fix, applied at the right time.

Some API keys are meant to be public. Betterleaks now removes them from generic secret findings, dropping thousands of false positives per scan. Category: News

A new default three-day cooldown delays version update pull requests so maintainers and security researchers can address findings in a release before it gets into your code.The post The case for a cooldown: Why Dependabot now waits before issuing version updates appeared first on The GitHub Blog.

Here's an example. You can list multiple comma-separated box-shadows, but if you apply a *new* box-shadow, it overrides anything set before. Not true here.

Run CKEditor AI from your own code, mark AI-generated edits in track changes, and use stable multi-root AI support in CKEditor 5 v48.3.0.

Connect your Supabase project to Grafana Cloud in one click. A pre-built dashboard, alerting, and metrics: available on every plan, including free.

<blockquote cite="https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/"><p>The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was <a href="https://github.com/pypi/warehouse/pull/19727">put in place</a> to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has ...

はじめに こんにちは。LegalOn Technologiesのデータチームで Head of Data をしている若菜です。前回の記事「全社横断のデータガバナンスを実現するためにデータワーキンググループを設立・運営した」では、データマネジメントとガバナンスを統括する専門部会「データワーキンググループ（DWG）」の体制を紹介しました。あわせて、その基盤となる情報資産ガイドラインについても紹介しました。 前回の記事では、問い合わせの一次受けとしてCustom GPTやコーディングエージェントを活用している話に触れました。今回はその発展形として、DWGが日常的に運用している2つのClaude / …

チーム全員でコードを育てアジリティを高めるAI時代のカミナシの開発スタイル おはようございます。夏休みの息子を連れて大阪の箕面の実家ですごしている daipresents です。実家には食べ物と飲み物が無限にあります。 先日、レバテックさまからのお誘いをいただきまして「Claude Code時代の「職能越境」を支える、環境構築とワークフロー設計」というイベントに参加しました。テーマは「職能越境」で、AIの登場により働き方が変わり、職能を超えた動きが出てきた事例を紹介する内容でした。 僕はカミナシの一部事例を紹介させていただいたのですが、資料を公開しても何が話されたか伝わりにくいと思ったので、こ…

Orchestration Guildメンバーの迫川です。普段はAgent platformの開発をしています。この記事は、社内ワークショップOrchestration Development Wor...

StepSecurity now shows which GitHub Actions secrets are actually used, which workflows use them, and which can be replaced with OIDC.

There are two scenarios I keep seeing with AI in production, and they are the same scenarios in different disguises. The first: a team has seen a demo, the demo was dazzling, and now probabilistic output is headed somewhere that needs exactly one right answer - a total, a status, a legal something. Everyone's excited. The second: a team has a genuinely perfect AI use-case - a summary, a suggestion, a first-pass guess - and they've blocked it, because "we can't have it giving different answers ea

In this release, we're shipping one of our most requested tools to date, Java, alongside a

All teams want their website to feel like the products they admire. Motion that's smooth, responsive, and never overbearing. The kind of motion that conveys a feeling without a user reading a word of copy.Wanting and doing are two different things. Animation is tough for humans and agents alike to get right, and in the face of a deadlines it's often the first thing that gets cut.Animation can even be risky. Get it wrong, and the whole site feels cheaper, or performance can tank.Read the full art

WCAG Evaluation Methodology (WCAG-EM) 2.0 is published as a W3C Group Note. WCAG-EM describes a methodology with a step-by-step process to evaluate how well digital products conform to Web Content Accessibility Guidelines (WCAG) 2. WCAG-EM 1 was specifically for testing websites and web pages. WCAG-EM 2 also applies to apps and other digital products. For an introduction to WCAG-EM, see WCAG-EM Overview.

now shows a live evaluation view on each flag's detail page. You can see evaluations per minute charted over time, with each flag version marked in the chart so you can tie evaluation shifts to specific configuration changes.Vercel FlagsYou can group and filter evaluations by variant, reason, environment, SDK key, client, and reporting project. Custom clients can set the new property on the client initializer to show up as their own group. This makes it straightforward to confirm rollout percent

You can now connect to any running Sandbox from the Vercel dashboard. Run commands, browse the filesystem, upload and download files, and inspect open ports without leaving the browser.From the same view, you can also manage the sandbox lifecycle: take snapshots, and stop or resume persistent sandboxes. Open the on any sandbox to try it out.Connect tabLearn more about Vercel Sandboxes in the .documentationRead more

version history can now be inspected from the Vercel CLI with the new command.Vercel Flagsvercel flags versionsRun to print the full revision history for a flag, with each revision's author, message, timestamp, and changed environments. Filter to a specific environment with , paginate with and , or add for scripting.vercel flags versions <flag>--environment--limit--cursor--jsonTo compare a revision against the one before it, run . The diff is semantic, surfacing field-level changes to targ...

You can now add to your agent as an extension.GitHub toolseveAdd the package, drop one file in , and your agent gets every tool with Vercel Connect auth, presets, and approval rules built in.agent/extensions/ :Install@github-tools/eve-extension :Then register it from a file inagent/extensions/Get started by creating a and reading the .GitHub connectordocumentationRead morePass a connector and the extension mints short-lived, scoped GitHub tokens at runtime. Connector-backed auth: Vercel Connect,

from Ant Group is now available on AI Gateway.Ling 3.0 FlashThe model is free to use for the next three weeks, through August 3rd.Ling 3.0 Flash is a Mixture-of-Experts model with 124B total parameters and about 5.1B active per token. It has a 256K token context window and runs in thinking and non-thinking modes.Ling 3.0 Flash is built for token-efficient agentic inference at production scale, doing more work within tighter token, latency, and cost budgets across multi-step agent runs. The model

The Vercel MCP server can now deploy code directly to a new or existing project. When your AI assistant finishes building something, it can ship it to Vercel and hand back a shareable URL without leaving the chat.Point the tool at your files and Vercel creates the project, detects the framework, installs dependencies, and builds. You get a URL you can open and share while the build finishes in the background.deploy_to_vercelTo get started, connect the to Claude, Cursor, or any , and ask it to de

<blockquote cite="https://twitter.com/tqbf/status/2080045032162173329"><p>I genuinely believe that if you took an open weights model from 2025 and built a pentest harness for it, it could do this kind of sandbox escape and scan/hack in most networks. This is only surprising because you assume OpenAI has sounder sandboxes.</p></blockquote><p class="cite">— <a href="https://twitter.com/tqbf/status/2080045032162173329">Thomas Ptacek</a>, doesn't ...

<p>This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model's guardrail features turned off. Rather than solve the test, the model broke its way out of OpenAI's sandbox, then found exploits to break <em>in</em> to Hugging Face, all so it could cheat on the test by stealing the answers.</p><p>Along the way it helped make the strongest case yet for how the imbalance of model availability is hurting ou...

<p><strong><a href="https://dylancastillo.co/posts/pelicanmaxxing.html">Are AI labs pelicanmaxxing?</a></strong></p>Excellent piece of work by Dylan Castillo, who took a deep-dive into the frequently pondered question of whether the AI labs have been deliberately training models to draw pelicans riding bicycles in response to my <a href="https://simonwillison.net/tags/pelican-riding-a-bicycle/">deeply unscientific benchmark</a>.</p><p>...

Eight high-severity NodeBB vulnerabilities, found by our AI Pentest in six hours. Full technical breakdown of the XSS chains, auth bypasses, and post hijacking.Category: Vulnerabilities & Threats

A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Copilot now bills usage at listed API rates. Compare direct model access with the coding workflow, policy, and harness work around it.The post Copilot vs. raw API access: What are you actually paying for? appeared first on The GitHub Blog.

Safari Technology Preview Release 248 is now available for download for macOS Golden Gate and macOS Tahoe.

GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience working with the GitHub team.The post Next chapter: Restructuring GitHub’s bug bounty program appeared first on The GitHub Blog.

The fix for SQL injection is decades old and still works. So why did WordPress core just need an emergency patch for one? The data, and how to defend against it.Category: News

<p>San Francisco tip: it only costs around $15 ($10 in quarters plus a $5 bill for the self-playing violin) to activate every single Orchestrion in <a href="https://en.wikipedia.org/wiki/Musée_Mécanique">Musée Mécanique</a>.</p><p>And because most people are bad at allocating their funds you may well be the ONLY person activating the Orchestrions, which means you get to craft the soundscape for the entire museum.</p> <p>Tags: <a href="https://simonwi...

Upgrading to fix a CVE sounds straightforward. But the patched version often breaks your app, hasn't shipped yet, or doesn't exist. Here's why, and what actually works.Category: News

Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.

LINEヤフー株式会社では、技術に関するイベントや勉強会の主催・協賛などを行っています。最新情報は各リンク先でご確認ください。タイミングによっては、申し込み開始前や既に満席となっていることがあります。...

AI agents underperform not because of the models but because of the architecture around them. Repo boundaries limit what agents can read, what they can write, and what they can remember.

Today we're releasing tsgolint v7, the type-aware linting engine behind Oxlint.This release tracks TypeScript v7.0.2 and brings tsgolint to 59 of typescript-eslint's 61 type-aware rules. Since our alpha release, we have added 16 rules, per-rule timings, improved configuration, and another round of performance work.Getting started ​Install the latest Oxlint and tsgolint, then enable type-aware linting:shpnpm add -D oxlint oxlint-tsgolint@7pnpm oxlint --type-awareTo report TypeScript compiler erro

AI Gateway now supports . Previously, transcription required a complete audio file and returned the full transcript in a single response. Now you can stream audio in as it's captured and get transcript updates back as the model produces them, keeping latency low for uses like live captioning and voice input.streaming transcriptionStreaming transcription is in beta and available through the 's function with any streaming-capable transcription model.AI SDKstreamTranscribeThe example below streams

You can now package tools, connections, skills, instructions, and hooks into extensions that any agent can import. Extensions can be published to package registries, then installed, versioned, and upgraded like any other project dependency.eveA browser-use extension might ship tools for navigating a site, a memory extension can capture context with hooks and recall it with tools, and a self-improvement extension pairs hooks with dynamic instructions.Scaffold a new extension with a single command

Nub looks like an interesting new “toolchain” for Node.js. It’s one of those “it makes everything you already do faster” sort of things, like installing and running scripts. Bytes.dev… … won’t be surprised if it becomes the de facto way to season your Node.js app. You can get some of these advantages by switching runtimes, […]

<p><img src="https://static.inaturalist.org/photos/702321069/large.jpg" alt="California Sea Lion"></p><p><img src="https://static.inaturalist.org/photos/702321114/large.jpg" alt="California Sea Lion"></p><p>California Sea Lion, in San Francisco County, US, CA</p><p>We took some visiting family to Pier 39 to see the sea lions. They're somehow always even more fun than I remember them being last time.</p> <p>Tags: <a href="https...

Tyro CISO Arun Singh on developer trust as a finite resource, and what happens when supply chain attacks force teams to spend itCategory: Guides & Best Practices

Canvases turn AI into interactive workspaces where you can visualize information, explore workflows, and take action across complex tasks.The post How to build interactive experiences with canvases appeared first on The GitHub Blog.