Around 66,000 CVEs are expected in 2026. Most won't affect your code, but which ones will? A practical look at layered, AI-supported vulnerability triage.
A look at the Scala Days 2026 agenda: from AI and Scala's type system to security, WebAssembly, and GPUs — the talks worth attending and why.
Most of the AI-generated code already in your codebase arrived through unsanctioned tools on personal accounts. This is Shadow AI — and like shadow banking before 2008, the risk is invisible until it isn't. Here's how to govern it with risk-based triage, traceability, and Continuous Modernization.
Recently, Wasm is used in different areas: safely running AI-generated code, server-side applications with ultra-fast cold starts, and language-independent plugin systems. What Wasm itself can do is just a pure computation. It cannot affect the outside world directly. Things like file I/O, clocks, and networking have to go through interfaces imported from the host. So unless the host explicitly gives it access, a Wasm module cannot perform external effects. This is why Wasm is often described as a sandbox.
Nearly a decade after PSD2 reshaped EU digital payments, PSD3 and PSR are coming. Here's what changes, why it matters for FinTech companies, and how to start preparing before the 2028 deadline.
A curated guide to the most valuable FinTech conferences taking place between September and December 2026, covering events across the US, Europe, the Middle East, and Asia.
Tomek Lelek and I wrote Vibe Engineering because we kept seeing the same mistake everywhere: teams confusing the speed of generation with the speed of delivery. Vibe coding, that intuition-first, prompt-driven mode where you accept what the AI gives you without deep verification, is genuinely valuable. It's the digital sketchpad. It's how you turn a foggy idea into a working interface in an afternoon. I use it. You probably should too.
Languages like Rust mitigate these problems through ownership and lifetimes. But how do we bring these ideas into a GC-based language like Scala in a way that doesn't break existing programs? In other words, we want to track access rights (capabilities) to resources (objects in the object-capability model), while leaving memory management to the GC. Scala 3's answer is Capture Checking + Separation Checking.
This is post #4 in The Agent-Ready SDLC series. In post #1 we laid out the Ferrari-in-a-Fiat-500 problem - the engine is great, the chassis isn't. In post #2 we covered the first bottleneck: context. In post #3 we covered the second: feedback loops. Now we're at the third piece - and it's the one nobody wants to talk about.
LLM coding agents moved fast from cloud demos to tools running on developer workstations. They don't just suggest code anymore. They execute it. They start shells, install packages, edit repos, run tests, and sometimes open PRs. All with the same permissions you have. In the first part of the miniseries, Jakub Bocheński will look at Context, Motivation, and available sandboxing tools.
Open any README in your repository. That flagship one. The one that's 800 lines long with a "Getting Started" section written in 2022. Read it with fresh eyes - as if you were a new developer, or better yet - as an AI agent who's never been to a standup, never seen Slack, never heard the legend of why we don't touch the InvoiceReconciler class in the payment service. Now ask yourself one question: based on this README, can you safely modify anything in this service?
While API based LLMs are great for rapid, fast, and easy development, they can be less secure and costly in the long-term horizon for load-intensive applications. The solution are Small Language Models (SLM), self-hosted and finetuned on the downstream task. This article presents a case study of a Supervised Fine-Tuning (SFT) of the SLM on the Invoice Processing task. It shows that while SLMs have higher investment costs at start, they are faster, cheaper, and more secure in the long-term, especially for high-load intensive applications.
