Microsoft's AI security tool tripled monthly CVE patches with higher severity ratings

·1 views

An independent analysis of Microsoft's Security Update Guide data found that monthly CVE counts surged roughly three times above the pre-2026 baseline after Microsoft deployed AI-powered vulnerability scanning. The July 2026 patch package contained 1,150 CVEs, compared to an average of 383 in the eight sampled months before the increase. Severity metrics also rose sharply, with the CVSS median jumping from 6.5 to 7.5 and remote code execution vulnerabilities nearly quadrupling. Microsoft had publicly warned in a July 2026 blog post that AI-assisted discovery would increase patch volumes, but offered no specific figures. Analysts suggest the surge reflects a long-standing backlog of discoverable bugs rather than a sudden increase in new vulnerabilities.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds custom orchestration layer after hitting Codex subagent limitations

A developer who uses OpenAI's Codex daily built a custom orchestration layer on top of it after finding that subagent capabilities vary inconsistently across the desktop app, CLI, and tool-backed sessions. While Codex natively supports parallel subagents, custom roles, and per-agent model settings, the developer found that fields like model choice and reasoning effort were not reliably exposed at spawn time in all surfaces. Two internal implementations, V1 and V2, handle subagent orchestration differently, with V2 still behind a feature flag and not recommended for stable use by OpenAI collaborators. The custom layer was not intended to replace Codex but to add programmatic control over model selection, reasoning effort, and job queue size. The developer also flagged Codex Ultra's multi-agent mode as a token-intensive option whose underlying architecture has not been publicly confirmed by OpenAI.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineer Shares Terraform Cloudflare DNS Checklist to Prevent Silent Outages

A software engineer at kuryzhev.cloud has published a 14-step checklist for safely running Terraform applies against Cloudflare DNS zones, prompted by a real incident last quarter. A staging record was accidentally set to proxied=true via the Cloudflare dashboard, causing Cloudflare to intercept SSH traffic on port 22 and making a bastion host unreachable for forty minutes. The checklist covers provider version pinning, API token scoping, secrets management, and state isolation across dev, staging, and production environments. It also addresses Cloudflare API rate limits — capped at roughly 1,200 requests per five minutes per token — which can become a bottleneck when managing large numbers of DNS records in bulk. The guide is intended as a recurring pre-apply discipline rather than a one-time setup reference, given that DNS misconfigurations surface immediately as user-facing failures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Agents Fail: Poor Specs, Not Bad Code, Are the Real Bottleneck

Software developers using AI agents in 2026 are finding that output quality depends heavily on the specifications fed into the agent's context window, not just the code itself. A common workflow improvement — storing product requirement documents in a repository — initially boosts agent performance but breaks down as specs grow large, drift from actual code, or contradict each other across modules. When specs go stale or are owned by no one, AI agents can misinterpret outdated requirements as ground truth and inadvertently introduce regressions. The core argument is that plain markdown files in a repo lack validation, schema enforcement, or consistency checks, making them unreliable inputs for agentic pipelines over time. The article calls for purpose-built tooling focused specifically on keeping specifications accurate, current, and coherent rather than relying on general-purpose project management or documentation platforms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds Firebase AI image analyzer using Antigravity CLI and Stitch MCP Server

A developer has demonstrated how to build an image analysis application using Angular, Firebase's Hybrid and On-device Inference Web SDK, and Google's Gemini AI models. The app lets users upload images to receive alternative text suggestions, tags, design recommendations, and CSS tips. When run on Chrome 148 or later, the app uses an on-device Gemini Nano model with zero token consumption, while other browsers fall back to the cloud-based Gemini 3.5 Flash model. The workflow involved installing specialized skills in the Angular project and registering both Angular and Stitch MCP servers within the Antigravity CLI to handle infrastructure, services, and UI development. Google's Stitch design-to-code tool was used to generate interactive UI screens from natural language prompts, though users in Hong Kong must enable a VPN to access its AI features due to geofencing restrictions.

0 comments Read more at DEV Community