GitHub CodeQL Code Scanning Now Supports Setting a Threat Model

GitHub has recently extended its CodeQL-based code scanner by adding the possibility to specify the desired threat model. The new feature is available in beta for the Java language.

LeftoverLocals May Leak LLM Responses on Apple, Qualcomm, and AMD GPUs

Security firm Trail of Bits disclosed a vulnerability allowing malicious actors to recover data from GPU local memory on Apple, Qualcomm, AMD, and Imagination GPUs. Dubbed LeftoverLocals, the vulnerability affects any application using the GPU, including Large Language Models (LLMs) and machine learning (ML) models.

Actionforge is a VS Code Extension to Build GitHub Workflows Visually

Actionforge provides a visual, node-based interface to create and maintain GitHub Action workflows masking their underlying YAML textual definition. Packaged as an extension for Visual Studio Code, the tool does not require any external services and is now available in beta.

DigitalOcean Introduces CPU-based Autoscaling for its App Plaform

DigitalOcean has launched automatic horizontal scaling for its App Platform PaaS, aiming to free developers from the burden of scaling services up or down based on CPU load all by themselves.

Docker Desktop 4.29 Improves Container Isolation and Error Management, Integrates Moby 26, and More

The latest version of Docker Desktop implements socket mount permissions to enhance container isolation, updates error management to improve efficiency and reliability, integrates Moby 26, and speeds up file operations thanks to synchronized file shares.