In the weeks since the EU Pay Transparency rules came into full effect, how have organisations responded to the change?

In early June, changes were made to how companies in EU member states are required to disseminate employee-relevant information. The EU Pay Transparency Directive is a policy that aims to reduce the gender pay gap, ensure fairer pay structures and create an atmosphere in which professionals and jobseekers can have open conversations about pay and other topics.  

Having first been passed in 2023, countries were given three years to align themselves with the new rules and make any necessary changes. A month has gone by now since that final deadline, but what has changed?

Job search platform Mokaru analysed 1,776,876 global job listings posted between April and June, on the career sites of 48,758 employers, across more than 46 applicant tracking systems. What was discovered is that one month after the EU Pay Transparency Directive deadline, only 6.6pc of EU job ads are disclosing salary information. This is compared to nearly 40pc in the US. 

Mokaru’s experts said, “If you are job hunting in Europe, you already know the ritual, read the listing, scan for the salary, find nothing, apply anyway and hope the number at the end of four interview rounds does not waste everyone’s time. Our data shows exactly how bad it is and how different it could be.”

With US figures notably higher than the available European data, Mokaru said, “Here is the uncomfortable timing, the EU Pay Transparency Directive, the law that, among other things, gives applicants the right to salary information before the interview, had its implementation deadline on 7 June, 2026. One month later, European employers’ job ads are still overwhelmingly silent.”

Evolving landscapes

Canada and the US are setting the pace as research found that salaries are disclosed in more than one-third of listings. For comparison, the UK trailed behind at 21pc, the Netherlands at 12pc, Ireland at 10pc, France at 9pc and Austria also at 9pc. 

Mokaru also found that numbers varied dramatically, even in cases where employers from different regions were utilising the same job promotion platforms. Germany is one such example as on Workday only 2.8pc of employers chose to disclose salary information, compared to more than 40pc of US-based employers. 

Sweden lies at the bottom of the list, having the least transparent jobs market, at just 0.4pc, or fewer than one in 200 job listings. Despite the law coming into effect and the European Commission sticking to the timeline, many countries have elected to ‘postpone’ implementation, with Sweden pausing it completely for the time being. 

Mokaru said, “To be fair to the directive, it is early days. Four weeks is not enough time to rewrite hiring workflows and in most member states the national law that actually binds employers is not yet in force, the bulk of implementations will land between now and January 2027, with enforcement and sanctions following later. 

“The honest conclusion from this data is not that the directive has failed, it is that, one month in, employer behaviour has not yet started to move.”

Rising trends

The research highlighted other patterns and trends that stand out, such as the impact the policy has had so far on remote job listings. What the data uncovered is that remote job listings in the EU are almost twice as likely to disclose salary as on-site listings, at 11.5pc and 6.2pc respectively. 

The report said, “Employers hiring remotely compete in an international talent pool, one where US-style transparency is increasingly the norm. Competition is currently doing more for European pay transparency than regulation. In the US, the remote/on-site gap barely exists (39.5pc versus 37.4pc), transparency laws there apply regardless of where the work happens.”

Looking at the data that is specific to Ireland, Mokaru also found that as seniority rises, transparency has a tendency to fall, as junior roles disclose at around 32pc, compared to 11pc of senior roles and 9pc of lead roles. 

The report said, “more than four in five Irish job ads keep candidates guessing and the higher the role, the quieter the ad, junior positions disclose pay three times more often than senior ones.”

Ultimately, Mokaru’s experts are of the opinion that the burden of the European information gap falls largely on those who have the least negotiating power, mainly invested candidates who cannot afford to walk away from multiple rounds of interviews when the offer finally lands below their floor.

And “until the directive has teeth”, European candidates should be aware of the factors that best indicate whether the role they are applying for is at a company likely to embrace the change in policy. 

So, until then be aware of your rights, look into remote friendly opportunities and research market rates because even if your employer plans to keep you in the dark, the information is likely available elsewhere. 

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Chemistry Ventures, the VC firm launched two years ago by Bessemer, Index Ventures and Andreessen Horowitz alums, is raising $500 million for its second fund, according to an SEC filing.

Founded by Mark Goldberg, Ethan Kurzweil and Kristina Shen, Chemistry launched with a $350 million fund, and invests in early-stage startups building developer tools, fintech and infrastructure. Its portfolio companies include Granola, Decagon, Persona, Serval and Nova Intelligence. 

Goldberg previously worked at Index Ventures, Kurzweil with Bessemer, and Shen with a16z. The trio launched the firm to combine their experience working at large venture capital firms. 

The Wall Street Journal reports that the second fund is already oversubscribed and the fundraise is expected to close soon.

Chemistry did not immediately return a request for comment.

A green pipeline is not a governed one, and agentic coding is widening the gap faster than review can close it.

By Shane Warden, Principal Architect, ActiveState

In June 2026, researchers at Novee Security disclosed a class of CI/CD weakness they named Cordyceps. They scanned roughly 30,000 high-impact repositories across the npm, PyPI, crates.io, and Go ecosystems, then flagged 654 and confirmed more than 300 as fully exploitable.

The affected build tooling included projects published by Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, and the entry requirement for an attacker is a free GitHub account. No org membership, no elevated privileges.

Every one of those pipelines was green. The scanners ran, the checks passed, and the dashboards reported healthy results the entire time the exposure existed. The scanners were never built to see this danger.

The Vulnerability Is in the Composition, Not the File

GitHub Actions workflows are usually triggered by pull_request, which runs in the untrusted context of the fork, without repository secrets and with a read-only token. The trouble starts with pull_request_target and workflow_run, which run in the context of the base repository with access to secrets and a read and write GITHUB_TOKEN.

An attacker can induce both to act on attacker-controlled content from the pull request that triggered them. GitHub Security Lab calls this the pwn request.

Three primitives do the damage. Command injection interpolates attacker-controlled data, a branch name, a title, a comment, straight into a run step, so it lands unescaped inside a shell command and executes. Code injection through actions/github-script evaluates attacker input as JavaScript at runtime.

And cross-workflow privilege escalation lets a low-privilege workflow write untrusted data into an artifact or output, which a second, high-privilege workflow then reads and acts on with the maintainer’s token. Neither workflow is exploitable alone.

The vulnerability exists because of how they connect, which is exactly why the scanners stay green: a SAST or DAST tool pattern-matches a single file, and each file here is valid, well-formed YAML doing exactly what it was told.

“A scanner sees a workflow. An attacker sees a four-step chain to a permanent credential,” explains Warden.

There is no single line to flag, because no single line is wrong.

That is the worst version of a measurement failure, because a red light sends someone to look for a problem and a green light sends everyone home.

One Pull Request, Persistent Write Access to Shipped Security Content

On Microsoft’s Azure Sentinel repository, Novee showed that a comment on a pull request could run anonymous attacker code on Microsoft’s CI and steal a non-expiring GitHub App key, confirmed by Microsoft’s Security Response Center.

Sentinel is Microsoft’s SIEM, and its Content Hub ships detection rules and automated playbooks directly into customer workspaces.

A stolen key there offers persistent write access to the security content thousands of organizations rely on to detect attacks, quietly weakened and shipped downstream as a trusted update.

Google’s AI Agent Development Kit sample repository is a reference thousands of developers copy when building agents on Google Cloud. A single pull request could execute code in Google’s CI and escalate to roles/owner on the associated Google Cloud project, permanent owner-level access, confirmed by Google.

Apache Doris had a comparable path to credential theft, confirmed and fixed by the Apache Security Team. Three organizations, one composition problem, no line of code that a scanner could point to.

Nobody Decided to Trust That Pull Request

The phrase that should stop an engineering leader is “trust boundary that no one audited.” Someone configured a workflow to treat an outsider’s input as if it came from a maintainer. No human made that call on purpose.

This risk accreted, one reasonable-looking commit at a time, and it increases with AI-generated workflows, where the moment of decision may never be audited at all.

I have put AI tooling into production engineering work and measured what it changed, so I will say plainly that the leverage is real and I am not arguing to slow it down.

But Novee is explicit that agentic coding is the multiplier: AI tools generate CI/CD configuration quickly and reproduce the same insecure patterns, so one mistake compounds across potentially millions of repositories, emitted with confidence and no provenance signal.

The volume of workflow decisions an organization now absorbs has outrun a review process sized for human-speed output.

Our standard security systems aren’t ready for this either. Cordyceps is not a CVE, so it never enters the enumeration model. Furthermore, NIST acknowledged in April 2026 that it can no longer enrich every CVE, with submissions up 263% since 2020. Risks are multiplying.

Fortunately, Novee found no evidence of exploitation in the wild, and the named vendors have hardened or patched. However, this is a proven, exploitable pattern, not one single specific breach, and it is largely unpatched by default across the industry.

The immediate fixes are worth doing now: prefer pull_request over pull_request_target for untrusted contributions, never check out pull request head code inside a privileged workflow, pass event data through a quoted env variable rather than inlining it, default permissions to read-only, pin third-party actions to a commit SHA rather than a moving tag, and gate privileged workflows behind manual approval for first-time contributors.

Do all of that and you have closed today’s problems, but not the class of problems. The next pattern will build from individually correct steps, and it will also pass the scan. AI-driven development is widening this software supply chain governance gap, and it’s accelerating.

The durable control is to govern what your build can trust at the source, so the components and workflows entering your pipeline come from a governed origin with verifiable provenance, built from source rather than trusted on faith.

A hijacked upstream that publishes a poisoned package must meet and fail a check at the point of ingestion. A human owns the trust boundaries. That ownership has to operate at the speed AI is now generating decisions, because manual review at the far end of the pipeline cannot catch up.

Cordyceps did not defeat anyone’s security tools. It walked past them, because every individual piece worked exactly as designed. That is the measurement trap in its purest form: the number stayed green while the thing it was supposed to guarantee stopped being true, if it was ever true at all.

Those pipelines were not exposed because the scanners failed. They were exposed because passing the scan didn’t mean they were governed. For a while, nobody went looking.

A green pipeline is not a governed one. Find out what’s really running through yours.

Sponsored and written by ActiveState.

Robot vacuums that clean and mop in a single pass have always carried a serious premium, but this deal turns that long standing assumption completely on its head this week.

That value case gets even stronger once you look at the exact model on offer, the Roomba 505X, now reduced from $999.99 to $499.99, a straight 50% saving worth $500 in total.