After Jérémy Doku’s second-half substitute appearance transformed Manchester City into a high-octane proposition, the smart money was on the momentum continuing and the penalty shootout going their way.
So it proved as Enzo Maresca’s men triumphed 4-3, Gerónimo Rulli’s save from Lewis Dunk’s fifth spot-kick decisive, the Argentinean also having repelled Yasin Ayari’s fourth penalty.
Continue reading...We're entering a new era of application security. Frontier AI models are uncovering complex flaws that traditional tools overlooked, and attackers are using the same models to exploit them faster. Remediation isn't keeping pace: Verizon's 2026 Data Breach Investigations Report (DBIR) measures the median time to fully remediate a known-exploited vulnerability at 43 days, up from 32 in 2025.
Security teams are already stretched across growing application portfolios, third-party dependencies, and a steady stream of new disclosures. And while agents that find vulnerabilities and write fixes are becoming more accessible, integrating them into how enterprises actually build and ship software remains difficult.
A generated patch still needs to be tested. Security policies need to be enforced. Changes need to be reviewed and approved. And eventually, the fix needs to reach production safely.
This is where I believe the next major shift in application security will happen. We need to put autonomous agents to work inside the software factory. That's why we've brought Anthropic's Claude Mythos 5.1 into GitLab, and why we're connecting discovery, remediation, and prevention in one trusted workflow.
Critical vulnerabilities like PHP2Shell send security teams scrambling to understand exposure. For a large organization, that means assessing impact across hundreds or thousands of repositories, applications, and dependencies.
Identifying exposure is only the first step. Teams then need to assess exploitability, prioritize affected applications, coordinate fixes, run tests, and get changes into production. Every handoff takes time, and speed is vital: 31% of breaches now start with vulnerability exploitation, the top initial access vector for the first time in the DBIR's 19 years.
As more critical vulnerabilities emerge, the traditional model of manually investigating findings, assigning tickets, and waiting for developers to write fixes becomes harder to sustain.
The time between vulnerability discovery and verified remediation needs to shrink dramatically. That requires security workflows capable of operating at machine speed, while preserving the controls organizations depend on to ship reliable software.
AI agents can do impressive work in vulnerability discovery and remediation. The challenge is making that work reliable and repeatable across an enterprise.
An agent can generate a patch in seconds. Whether it understood the application, whether it validated the change against the real build, and whether it followed your security policies are separate questions. They get harder to answer, and more expensive to get wrong, as you deploy agents across thousands of projects.
At GitLab, we're bringing agentic security workflows into the environment where teams develop, test, and ship software.
Everything an agent does rests on how well it understands your system, and that understanding extends beyond the repository. GitLab Orbit, a live context graph of your software lifecycle, connects findings to the changes that introduced them, the pipelines that shipped them, and the teams who own the fix. It's also how you answer the questions that follow a disclosure like PHP2Shell: Are we exposed? Is it reachable? How far does it spread, and how do we fix it without breaking production?
GitLab Duo Agent Platform investigates findings in the context of your software and how it's built, filtering out likely false positives and prioritizing by exploitability and reachability.
For the findings that matter, Duo writes a fix and puts it through your pipeline to check for regressions and rerun security scans. In a single merge request, developers review the change, Duo's explanation, and the pipeline results.
Security teams move from understanding exposure to initiating remediation in one pass, and developers shift from chasing findings to reviewing fixes. Because these workflows run inside the software factory, agents operate within the same processes and controls that organizations already use to deliver software.
That's how we turn agentic security from an isolated capability into something an enterprise can trust and operate across thousands of projects, at machine speed.
Some of the most dangerous application vulnerabilities require a deep understanding of how software is intended to work: missing authorization checks, broken ownership logic, and business logic flaws that expose customer data or let users take actions they shouldn't.
Traditional scanners struggle with these issues because finding them requires reasoning about the application's behavior and the relationships between components.
Our new Business Logic Security Analyzer, the first GitLab capability to support Anthropic's Claude Mythos 5.1, examines how your application enforces its rules: it reads the whole repository and incoming merge requests, infers what each endpoint should enforce, and flags the gaps that pattern-based scanners often miss.
But the real opportunity comes from connecting those discoveries to the workflows teams already use. When a critical flaw is found, teams need to understand its impact, initiate remediation, validate the proposed fix, and ship it safely. Integrating frontier AI into the software factory creates a path to run that entire process at machine speed.
The intelligence of the model is only as valuable as your ability to act on it.
Finding vulnerabilities earlier is valuable, and keeping vulnerable code and unsafe packages out of production altogether is even better. These protections become even more important as agents gain autonomy.
Security controls need to be embedded throughout the software factory and enforced independently of the people and agents making changes, with every change clearing the same gates before it moves forward.
GitLab Ultimate brings static analysis, dependency and container scanning, secret detection, policy enforcement, and approval gates directly into the software delivery process. Those policies are set centrally and apply consistently across projects and pipelines, so the author of a change, human or agent, cannot change or waive the controls evaluating its work.
The same scrutiny needs to extend to third-party software. Modern applications rely heavily on open source dependencies, and a vulnerable or malicious package can introduce serious risk before developers write a single line of code.
GitLab's Dependency Firewall blocks policy-violating packages before they enter your build. GitLab Secrets Manager lets each job access only the credentials it requests and is authorized to use, so a compromised dependency can reach only the secrets of the job it runs in.
Agents need the freedom to work quickly, within boundaries they can't cross. GitLab Duo Agent Platform gives each agent a composite identity that limits it to the permissions it shares with the requesting user, a sandbox that's destroyed when the task ends, and a record of every action. These boundaries are part of the GitLab Security Standard, under which agents earn more autonomy only as the controls at each stage are proven to hold.
The controls that make a change trustworthy need to hold at every step, even when the work happens at machine speed.
Frontier models will keep improving, security agents will get more capable, and vulnerabilities that were once difficult to discover will become easier to find. That progress will put enormous pressure on how organizations respond.
A security team can deploy the most advanced models available, but its ability to reduce risk will still depend on how quickly and safely it can turn findings into production-ready fixes.
This is why the software factory matters. It's where agents get the context needed to understand applications, where changes are validated against real builds and tests, where security policies are enforced, and where human oversight applies without slowing every step of the process.
At GitLab, we're bringing these capabilities together so you can automate remediation, uncover complex flaws, and prevent unsafe changes from shipping, all inside the workflows you already use.
The next security advantage will come from how quickly organizations can turn a critical discovery into a verified, trusted fix.
We invite you to run your next security sprint on us. Qualifying teams can request access to GitLab Ultimate, GitLab Duo Agent Platform, GitLab Orbit, and GitLab Secrets Manager, with free credits. Request access to the security sprint offer.
Nothing done to stop planting weapons on dead Afghans, ADF inspector says, as ‘breakdown of command’ allowed ‘egregious behaviour’
Get our daily political email, free app or daily news podcast
Some Australian SAS officers knew that soldiers under their command were using “throwdowns” – planting weapons on dead Afghan civilians to portray them as combatants – but did nothing to stop the unlawful practice, a previously unpublished military report has said.
Posted online this week, the executive summary of a 2021 investigation into the “cultural context” of the special operations command by the inspector general of the Australian Defence Force (IGADF) is scathing about the “breakdown of command” and the erosion of military discipline during special forces operations in Afghanistan, which “resulted in episodes of potential and actual egregious behaviour”.
Continue reading...Kushner threatens to sue, denying allegations that two slush funds were set up to influence his Middle East role
A new book containing incendiary claims about Jared Kushner’s financial dealings during Donald Trump’s first term has ignited a political and media firestorm.
The book by author Matthew Cole is called Princes and Thieves: Jared Kushner and Mohamed bin Zayed’s Secret Plot to Remake the Middle East and was released in the US this week. An excerpt was published by Vanity Fair last Thursday, and immediately drew a furious response from Kushner, who called its claims “completely insane”. The book contains numerous allegations about Kushner, whose father-in-law is Trump and who has served as one of his top diplomatic envoys in the Middle East – the most explosive of which are claims linking him to huge bank accounts allegedly funded by Gulf states.
Continue reading...Kushner threatens to sue, denying allegations that two slush funds were set up to influence his Middle East role
A new book containing incendiary claims about Jared Kushner’s financial dealings during Donald Trump’s first term has ignited a political and media firestorm.
The book by author Matthew Cole is called Princes and Thieves: Jared Kushner and Mohamed bin Zayed’s Secret Plot to Remake the Middle East and was released in the US this week. An excerpt was published by Vanity Fair last Thursday, and immediately drew a furious response from Kushner, who called its claims “completely insane”. The book contains numerous allegations about Kushner, whose father-in-law is Trump and who has served as one of his top diplomatic envoys in the Middle East – the most explosive of which are claims linking him to huge bank accounts allegedly funded by Gulf states.
Continue reading...