CISA Updates SBOM Standards for 2026, Mandating Hashes and Covering AI and SaaS

·1 views

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released updated 2026 minimum requirements for Software Bills of Materials (SBOMs), replacing the baseline set by NTIA in 2021. The new standard, developed alongside the NSA, FBI, and international partners, makes component hashes mandatory and adds fields for component license and SBOM generation context. Crucially, the updated rules extend SBOM requirements beyond traditional software to cover open-source projects, AI systems, and SaaS platforms. For SaaS and AI, where no conventional build process exists, the requirements are expected to flow into procurement contracts, since suppliers must provide SBOMs with their services. CISA describes the document as a minimum floor, but experts warn that the harder challenge lies in keeping SBOMs accurate after release, as deployed components can drift from what was originally documented.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Cloud Computing Basics: Service and Deployment Models Broken Down for Beginners

A developer has launched a daily blogging series on AWS and DevOps, with Day 1 covering the fundamentals of cloud computing. Cloud computing, as defined by NIST, enables on-demand access to a shared pool of configurable computing resources over the internet, replacing the need for costly on-premises infrastructure. The three main service models are IaaS, PaaS, and SaaS, each progressively shifting more management responsibility from the user to the cloud provider. Deployment models include public, private, hybrid, and community clouds, each offering different trade-offs between cost, security, and control. The series is set to continue with Day 2 focusing on client-server architecture.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Plan 9: The Forgotten OS from Bell Labs That Quietly Shaped Modern Computing

Plan 9 was an operating system developed by Bell Labs in the late 1980s and early 1990s by the same team behind Unix, including Ken Thompson and Dennis Ritchie. Rather than patching Unix's growing complexity, the team started from scratch with a radical design principle: everything, without exception, is a file. Its core protocol, 9P, allowed windows, network connections, and remote machines to all be accessed as filesystem entries, making distributed computing remarkably simple. Plan 9 also introduced per-process namespaces, where each process could have its own independent filesystem view — a concept that directly inspired Linux namespaces and, by extension, modern container technologies like Docker. Although Plan 9 never achieved mainstream adoption, its foundational ideas continue to influence the operating systems and developer tools used widely today.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CleanSlate: Open-Source Coding Agent Runs Across IDE, CLI, and SDK

A developer has launched CleanSlate, an open-source platform designed to run coding agents on both local machines and the cloud. The tool currently supports IDE, CLI, and SDK interfaces, allowing agents to read codebases, make edits, execute commands, browse the web, and validate their output. CleanSlate is model-agnostic, meaning it is not locked into any single AI provider or ecosystem. The team is working on longer-running autonomous cloud agents that can operate independently without requiring the user's machine to stay active. The project is in early stages, and the developer is seeking feedback from the developer community via GitHub and its official website.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fluentic Style tackles CSS debugging across Next.js server and client boundaries

Developer Fluentic Style is a CSS-in-JS styling library designed to maintain a consistent debugging experience across both server and client environments in Next.js App Router. The core challenge is that Next.js splits rendering across React Server Components, client components, streamed HTML, and hydration, making a unified CSS debugging model difficult to achieve. The library addresses this with a two-part approach: ensuring server-rendered HTML is already styled on initial load, and having the client runtime collect debug metadata to maintain sourcemap and DevTools tracing after hydration. The goal is to keep the same atomic CSS authoring API and developer tooling whether the code runs in a simple single-page app or a full Next.js App Router setup. The integration layer is designed to be transparent, so developers do not need to change their styling code based on the rendering environment.

0 comments Read more at DEV Community