Saturday, September 5th, 2026
CrowdStrike has started intercepting npm install and pip install at the endpoint, blocking a package before its embedded scripts can run. That the defence has moved to the last moment before execution is an admission about everything upstream of it.
A flaw in JFrog Artifactory rated 9.8 lets an unauthenticated attacker on the network take administrative control under default configuration — minting admin tokens, forging credentials, reading the whole access topology. Disclosed on 28 August, observed being exploited in the wild by 1 September.
John Ternus took over Apple on Monday. Tim Cook moved to executive chairman and, by several accounts, kept the company's relationships with Washington and Beijing. The handover says less about two men than about a job that no longer fits inside one post.
Buyers have stopped asking whether a supplier's software is secure, because they cannot find out. They have started asking who owns the supplier, where it builds, and what it would have to disclose.
Procurement has learned to ask what open-source components a vendor ships. It still rarely asks what is running on the controller beneath the operating system, where the code is older, the provenance is thinner and the update path frequently does not exist.
Incident communication began as courtesy and has become evidence. The wording of a status update now determines credits, contract remedies and whether anyone believes the next one.
State unemployment insurance runs on software and staffing calibrated to a low claim rate, which is exactly the condition that stops holding in a downturn.
Engineering organisations are building the same abstraction over the same infrastructure, independently, because the alternative is asking every team to learn all of it.
Imaging systems and infusion pumps are capital assets depreciated over a decade or more, running software the manufacturer stops supporting long before the hardware wears out.
Authentication requirements that were optional for years are enforced, and organisations that never thought about their sending domain are discovering their mail has quietly stopped arriving.
Industrial equipment outlives its control software by decades. Patching it means stopping production, and the vendor that wrote it may no longer exist.
Companies used to satisfy data residency with a paragraph and a regional bucket. The requirements have grown teeth, and satisfying them is now a question about how the software is built.
Work moved into the browser years ago and the security stack did not follow. Enterprises are now treating the tab, rather than the device or the network, as the place controls belong.
Software companies spent a decade giving away a usable product to build a funnel. The economics of that giveaway changed when the marginal cost of a free user stopped rounding to zero.
Companies have always known their software sits on components maintained by volunteers. Insurers, auditors and regulators are now asking which ones, who maintains them, and what happens when that person stops.
Logging, metrics and tracing bills have grown faster than the infrastructure they monitor. Engineering teams are discovering that the instrumentation is now a line item that needs its own budget review.
Companies that ignored security consultants for years are now doing exactly what their insurance carriers demand, because the alternative is being uninsurable.
A decade of frictionless departmental purchasing produced portfolios nobody inventoried. The consolidation now underway is being run by procurement, not engineering.
Passkeys work, are broadly supported, and are being adopted at a pace that has frustrated everyone who built them. The obstacles are almost entirely organizational.
The systems running banks, insurers, states and hospitals are older than the people maintaining them. The modernization wave has finally started, forced by retirements rather than ambition.
Repatriation was dismissed for years as a vendor talking point. It is now a line item, driven less by ideology than by workloads whose usage stopped being unpredictable.
The scramble of a thousand developer-tool startups is resolving into something duller and more durable: infrastructure priced, regulated and consolidated like the utility it always was.
Right-to-repair laws opened the door, but what pushed repairability into the mainstream was simpler: customers started paying for it.
The pandemic-era video visit flattened. What is growing instead is narrower and more durable: virtual clinics built around single conditions and long-term protocols.
Stored credentials, agent-driven purchasing and pay-by-bank rails are dissolving the traditional checkout page, along with the merchant's last moment of control.