GitHub is adopting AI-based scanning for its Code Security tool to expand vulnerability detections beyond the CodeQL static analysis and cover more languages and frameworks.

The developer collaboration platform says that the move is meant to uncover security issues “in areas that are difficult to support with traditional static analysis alone.”

CodeQL will continue to provide deep semantic analysis for supported languages, while AI detections will provide broader coverage for Shell/Bash, Dockerfiles, Terraform, PHP, and other ecosystems.

The new hybrid model is expected to enter public preview in early Q2 2026, possibly as soon as next month.

Finding bugs before they bite

GitHub Code Security is a set of application security tools integrated directly into GitHub repositories and workflows.

It is available for free (with limitations) for all public repositories. However, paying users can access the full set of features for private/internal repositories as part of the GitHub Advanced Security (GHAS) add-on suite.

It offers code scanning for known vulnerabilities, dependency scanning to pinpoint vulnerable open-source libraries, secrets scanning to uncover leaked credentials on public assets, and provides security alerts with Copilot-powered remediation suggestions.

The security tools operate at the pull request level, with the platform selecting the appropriate tool (CodeQL or AI) for each case, so any issues are caught before merging the potentially problematic code.

If any issues, such as weak cryptography, misconfigurations, or insecure SQL, are detected, those are presented directly in the pull request.

GitHub’s internal testing showed that the system processed over 170,000 findings over 30 days, resulting in 80% positive developer feedback, and indicating that the flagged issues were valid.

These results showed “strong coverage” of the target ecosystems that had not been sufficiently scrutinized before.

GitHub also highlights the importance of Copilot Autofix, which suggests solutions for the problems detected through GitHub Code Security.

Stats from 2025 comprising over 460,000 security alerts handled by Autofix show that resolution was reached in 0.66 hours on average, compared to 1.29 hours when Autofix wasn’t used.

GitHub’s adoption of AI-powered vulnerability detection marks a broader shift where security is becoming AI-augmented and also natively embedded within the development workflow itself.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Download The Report

Photo credit: WSJ
Few pieces of furniture have earned a place in both design history and everyday luxury quite like the Eames Lounge Chair. The Wall Street Journal recently got a rare look inside the MillerKnoll factory in Zeeland, Michigan, where every authentic example is still assembled by hand, walking the production floor from raw wood all the way through to finished chair and making it very clear why each one carries a price tag somewhere between five and ten thousand dollars.

It starts with thin sheets of veneer cut from sustainably grown walnut or cherry. Workers layer seven of them together with glue, alternating the grain direction with each sheet before a hydraulic press applies heat and pressure until the wood begins to take on the chair’s distinctive curves, forming the seat, back, and headrest that make the design instantly recognizable. Once cooled, the molded pieces move to a computer guided cutter that trims everything to the correct dimensions. Because the wood itself dictates the final appearance, no two chairs ever come out looking exactly the same.

Sale

CHITA Genuine Leather Reclining Swivel Chair with Adjustable Headrest and Ottoman for Living Room, Black

• Reclining Swivel Chair and Ottoman: This chair and ottoman set is just right for a modern office, den, or living room. A recline feature makes this…
• Memory Swivel Base & Adjustable Headrest: Stable 4-prong metal base features memory return that spins back to your original position after you get up…
• 100% Top Grain Leather: The finest hide portion, extremely durable for high-use chairs, adding sophistication to any room. Over time, it molds to your…

Every edge is then hand sanded, with workers running their fingertips along each surface to catch anything the machines might have missed. A coat of linseed oil goes on next, brushed in and left to soak, protecting the wood and deepening its color gradually over time. While that is happening, the metal components are being prepared, polished aluminum spines and bases that are as refined as anything else on the chair. The hardwood shells are then fastened to the frames with small spacers that keep everything locked in place and silent. It is a lengthy process by design, because a single misaligned hole or loose screw is enough to throw the whole thing off balance.

Upholstery takes place in a different area of the plant, where leather hides are pre-selected for uniform thickness and color before being dispatched to the cutting stations. Workers lay out patterns on each hide and cut them by hand using sharp knives, after which stitchers wrap and sew the covers around cushions filled with down and foam. The leather is pushed taut to flow smoothly over the chair’s curves with no creases. Each final cushion hooks onto its plywood shell using hidden fasteners, allowing owners to replace the covers decades later if necessary.

Quality control is strict, with each chair passing through a separate testing lab where Kyle Wright spends his days attempting to break them. In just a few hours, one machine rotates the base a hundred thousand times, replicating a decade of daily use. Another device presses down on the seat and back with weights that simulate the load of a big person shifting about after years of frequent use. If anything creaks, loosens, or gives way, the entire batch is returned to the factory floor for repairs. Only the chairs that pass all tests receive the little Herman Miller emblem sewn discreetly inside.
[Source]

Reports suggest Disney’s $1bn equity investment into OpenAI will not progress.

OpenAI is shutting down its controversial AI video generator Sora just months after announcing a multi-year licensing deal with Disney. The company told the BBC that the discontinuation will enable it to focus on other developments, such as robotics “that will help people solve real-world, physical tasks”.

Details on the timeline of the app’s shutdown, API and data preservation will be shared soon, OpenAI’s Sora team said in a post on X. “To everyone who created with Sora, shared it, and built community around it – thank you. What you made with Sora mattered, and we know this news is disappointing,” the post read.

The BBC further reported that following Sora’s closure, OpenAI will no longer focus on video-generation tools.

Video models such as Sora, its later iteration Sora 2 – which came with a social media app to share the AI content – as well as more recent ones such as ByteDance’s Seedance 2.0 have garnered strong criticism from artists and publishers who oppose to their copyrighted material being used to generate AI videos.

Prior to Sora’s launch in late 2024, protesting artists reportedly leaked the model on Hugging Face, claiming they were “lured” by OpenAI into “’art washing’ to tell the world that Sora is a useful tool for artists”.

Meanwhile, Disney’s three-year partnership and licensing deal with OpenAI came after the company reportedly opted out of allowing its copyrighted material from being used by Sora.

The deal, announced in December 2025, gave OpenAI access to more than 200 Disney characters to be used by Sora and ChatGPT Images. Alongside the licensing agreement, Disney also agreed to make a $1bn equity investment in OpenAI. The investment has reportedly been scrapped.

“We respect OpenAI’s decision to exit the video generation business and to shift its priorities elsewhere,” a Disney spokesperson told news outlets.

“We appreciate the constructive collaboration between our teams and what we learned from it, and we will continue to engage with AI platforms to find new ways to meet fans where they are while responsibly embracing new technologies that respect IP and the rights of creators.”

With Sora’s closure, OpenAI is seemingly shifting priorities towards AI tools suited for enterprise use, a sector where Anthropic is capturing a majority of newcomers. Meanwhile, Claude also overtook ChatGPT as the most downloaded app in the US last month.

To compete, OpenAI is building a new desktop ‘superapp’ by fusing together ChatGPT, Codex – the company’s coding tool – and Atlas, an AI-powered web browser launched last October.

“Sora was a resource black hole with strong compute costs and limited monetisation. The platform also struggled to prevent the creation of non-consensual imagery and realistic misinformation, not to mention major copyright infringement,” commented Forrester’s VP principal analyst Thomas Husson.

“In the context of its upcoming IPO, OpenAI likely decided to minimise the associated risks and prioritise profits and enterprise tools over experimental social apps, despite some consumer interest.

“Sora may be repurposed for some robotics and physical applications, but it is still very early days. At the end of the day, it highlights that OpenAI is still very far away from recouping its huge investments.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

In addition to screen time, the type of school to attend, the content children consume and the food they eat, a new concern cropped up for parents over the last few years: Whether to keep their children back a year from entering kindergarten.

“Redshirting,” a reference to collegiate sports in which the athlete sits out a year to boost their skills, has crept into the decision making process for parents with children on the cusp of the age cut-off in kindergarten, usually age 6 in most states. Parents can either have the student as one of the oldest in their grade or among the youngest, with some believing holding their child back can help academic achievement.

But according to a new report, the practice is not becoming more widespread. It has hovered steady at around 5 percent, since the the 1990s and 2010s, The number reached 6.4 percent during the pandemic.

“One of the reasons we wanted to look into it is because we felt like everyone talks about it, but only 1 in 20 students actually do it,” says Megan Kuhfeld, director of modeling and data analytics at NWEA, an education research firm. “So why does it feel like everyone was considering it for their children?”

Kuhfeld hypothesizes the smaller, more vocal group of parents considering redshirting was amplified on social media, but when it came time to make the decision, outside factors – like paying for an extra year of child care, which is becoming more costly than ever — played a large role.

“It might seem that this is a good idea but it’s, ‘We’re on the hook for an extra $15,000 in child-care costs,’ which may not be practical for a lot of families,” Kuhfeld says, adding she expects redshirting to stay steady. “The types to consider it will likely continue to, but a lot of people consider it then decide it’s not practical for a lot of reasons.”

The NWEA study did find more young boys were likely to be kept back than girls, with white students more often than nonwhite students. In the 2021 year, there were also upticks in rural areas, jumping from 6.2 percent to 9 percent, and high poverty areas, jumping from 2.2 to 4.7 percent. That could be because child care is more affordable in smaller towns, or easier to find with a friend, family or neighbor.

Proponents of redshirting say it gives the child an academic and social advantage being an older kindergartner. However, the benefits generally are short-lived, according to the NWEA report. While children initially saw higher reading and math scores, equating to about 20 percent to 30 percent of a year of learning, those results evened out by third grade, when the children who entered kindergarten early catch up to the redshirters.

There is at least one strong reason not to redshirt, according to the American Economic Association: Children who started kindergarten after 5 years old are more likely to drop out later on.

“People often focus on the short-term gains, but it’s important to keep in mind the perspective of what it means to be the older kid in class, where you turn 18 your junior year of high school,” Kuhfeld says. “It’s just keeping in mind these longer term outcomes and making the best decision for your child.”

Some states have begun pushing toward a forced redshirting of sorts. North Carolina public schools shifted its age cut off in 2007, requiring students to be 5 years old or older on Aug. 31, upping the date from a previous mid-October cut off.

Jade Jenkins, an associate professor of education at University of California, Irvine, found in a report that forced redshirting brought pros and cons. It helped math and reading scores in third through fifth grades, and students with forced delays into kindergarten also had a 4 percent increase of being identified as academically gifted. However, the same report found students had a 6 percent drop in disability identification. According to Jenkins’ research, it benefitted lower-income, white students but brought no benefit to Hispanic students.

“Is the valuation of the academic benefits of delayed entry higher than the costs of the hold-out year and the public costs of increased racial-ethnic achievement gaps? Future research can provide a more precise estimate of this calculation, but we find this unlikely,” Jenkins says in the report.

The latest redshirt debate is one of several parents surrounding kindergarten. Some state legislators are pushing for it to become mandatory across the nation, with others concerned about the dipping levels for kindergarten readiness. It has also become more academic-focused than ever, which in part spurred the latest NWEA study.

“We wanted to get this information out in an accessible way to have both the advantages and disadvantages, and not get caught up in blanket guidance,” Kuhfeld says.

“Especially in high socio-economic status schools and districts, there’s already an arms race by preschool to get situated for college, which is where a lot of this comes from,” she adds. “There’s this attitude of, ‘We have to take every avenue to get ahead’ and I don’t think that is healthy.”

Android 17 is getting a new Contact Picker that changes how apps access your contacts list. Earlier reports hinted at this shift toward tighter privacy, and now Google is rolling it out.

Instead of giving apps full access to your address book, you will be able to choose exactly which contacts they can see. Previously, apps often relied on a broad permission that exposed your entire contact list.

That resulted in sharing data more than necessary without even realizing it. With this update, Android is trying to limit that exposure while keeping things simple for you.

How the new Contact Picker keeps your contacts private

The new Contact Picker in Android 17 offers a secure and searchable interface where you select specific contacts to share. Apps only receive the data you approve, not your full address book. This reduces unnecessary access and gives you more control over your information.

For apps built for Android 17 devices or newer, the system automatically routes existing contact pick requests through the new, more secure Contact Picker interface. That means even apps that have not been fully updated may still benefit from better privacy protections.

Developers are also being pushed to adopt the new picker directly. It supports features like selecting multiple contacts in one go, making it more flexible than older methods. Apps can also request only the exact details they need, like a phone number or email address.

Android 17 changes how apps interact with your contacts

With this update, Android is moving away from blanket permissions and toward more precise, user-driven access. For you, that means fewer apps quietly pulling your entire contact list in the background

This update does not just tighten privacy; it also sets a new standard for how apps should handle personal data going forward.

Recently, Android rolled out a new contact feature with customizable calling cards, which makes it easier to personalize how you appear on calls. Google is also working on a tap-to-share contact feature to quickly exchange contact details between devices, just like Apple’s NameDrop.

Enterprise data teams moving agentic AI into production are hitting a consistent failure point at the data tier. Agents built across a vector store, a relational database, a graph store and a lakehouse require sync pipelines to keep context current. Under production load, that context goes stale. 

Oracle, whose database infrastructure runs the transaction systems of 97% of Fortune Global 100 companies by the company’s own count, is now making a direct architectural argument that the database is the right place to fix that problem.

Oracle this week announced a set of agentic AI capabilities for Oracle AI Database, built around a direct architectural counter-argument to that pattern.

The core of the release is the Unified Memory Core, a single ACID (Atomicity, Consistency, Isolation, and Durability)-transactional engine that processes vector, JSON, graph, relational, spatial and columnar data without a sync layer. Alongside that, Oracle announced Vectors on Ice for native vector indexing on Apache Iceberg tables, a standalone Autonomous AI Vector Database service and an Autonomous AI Database MCP Server for direct agent access without custom integration code.

The news isn’t just that Oracle is adding new features, it’s about the world’s largest database vendor realizing that things have changed in the AI world that go beyond what its namesake database was providing.

“As much as I’d love to tell you that everybody stores all their data in an Oracle database today — you and I live in the real world,” Maria Colgan, Vice President, Product Management for Mission-Critical Data and AI Engines, at Oracle told VentureBeat. “We know that that’s not true.”

Four capabilities, one architectural bet against the fragmented agent stack

Oracle’s release spans four interconnected capabilities. Together they form the architectural argument that a converged database engine is a better foundation for production agentic AI than a stack of specialized tools.

Unified Memory Core. Agents reasoning across multiple data formats simultaneously — vector, JSON, graph, relational, spatial — require sync pipelines when those formats live in separate systems. The Unified Memory Core puts all of them in a single ACID-transactional engine. Under the hood it is an API layer over the Oracle database engine, meaning ACID consistency applies across every data type without a separate consistency mechanism.

“By having the memory live in the same place that the data does, we can control what it has access to the same way we would control the data inside the database,” Colgan explained.

Vectors on Ice. For teams running data lakehouse architectures on the open-source Apache Iceberg table format, Oracle now creates a vector index inside the database that references the Iceberg table directly. The index updates automatically as the underlying data changes and works with Iceberg tables that are managed by Databricks and Snowflake. Teams can combine Iceberg vector search with relational, JSON, spatial or graph data stored inside Oracle in a single query.

Autonomous AI Vector Database. A fully managed, free-to-start vector database service built on the Oracle 26ai engine. The service is designed as a developer entry point with a one-click upgrade path to full Autonomous AI Database when workload requirements grow.

Autonomous AI Database MCP Server. Lets external agents and MCP clients connect to Autonomous AI Database without custom integration code. Oracle’s row-level and column-level access controls apply automatically when an agent connects, regardless of what the agent requests.

“Even though you are making the same standard API call you would make with other platforms, the privileges that user has continued to kick in when the LLM is asking those questions,” Colgan said.

Standalone vector databases are a starting point, not a destination

Oracle’s Autonomous AI Vector Database enters a market occupied by purpose-built vector services including Pinecone, Qdrant and Weaviate. The distinction Oracle is drawing is about what happens when vector alone is not enough.

“Once you are done with vectors, you do not really have an option,” Steve Zivanic, Global Vice President, Database and Autonomous Services, Product Marketing at Oracle, told VentureBeat. “With this, you can get graph, spatial, time series — whatever you may need. It is not a dead end.”

Holger Mueller, principal analyst at Constellation Research, said that the architectural argument is credible precisely because other vendors cannot make it without moving data first. Other database vendors require transactional data to move to a data lake before agents can reason across it. Oracle’s converged legacy, in his view, gives it a structural advantage that is difficult to replicate without a ground-up rebuild.

Not everyone sees the feature set as differentiated. Steven Dickens, CEO and principal analyst at HyperFRAME Research, told VentureBeat that vector search, RAG integration and Apache Iceberg support are now standard requirements across enterprise databases — Postgres, Snowflake and Databricks all offer comparable capabilities. 

“Oracle’s move to label the database itself as an AI Database is primarily a rebranding of its converged database strategy to match the current hype cycle,” Dickens said. In his view the real differentiation Oracle is claiming is not at the feature level but at the architectural level — and the Unified Memory Core is where that argument either holds or falls apart.

Where enterprise agent deployments actually break down

The four capabilities Oracle shipped this week are a response to a specific and well-documented production failure mode. Enterprise agent deployments are not breaking down at the model layer. They are breaking down at the data layer, where agents built across fragmented systems hit sync latency, stale context and inconsistent access controls the moment workloads scale.

Matt Kimball, vice president and principal analyst at Moor Insights and Strategy, told VentureBeat the data layer is where production constraints surface first.

 “The struggle is running them in production,” Kimball said. “The gap is seen almost immediately at the data layer — access, governance, latency and consistency. These all become constraints.”

Dickens frames the core mismatch as a stateless-versus-stateful problem. Most enterprise agent frameworks store memory as a flat list of past interactions, which means agents are effectively stateless while the databases they query are stateful. The lag between the two is where decisions go wrong.

“Data teams are exhausted by fragmentation fatigue,” Dickens said. “Managing a separate vector store, graph database and relational system just to power one agent is a DevOps nightmare.”

That fragmentation is precisely what Oracle’s Unified Memory Core is designed to eliminate. The control plane question follows directly.

“In a traditional application model, control lives in the app layer,” Kimball said. “With agentic systems, access control breaks down pretty quickly because agents generate actions dynamically and need consistent enforcement of policy. By pushing all that control into the database, it can all be applied in a more uniform way.”

What this means for enterprise data teams

The question of where control lives in an enterprise agentic AI stack is not settled.

Most organizations are still building across fragmented systems, and the architectural decisions being made now — which engine anchors agent memory, where access controls are enforced, how lakehouse data gets pulled into agent context — will be difficult to undo at scale.

The distributed data challenge is still the real test.

“Data is increasingly distributed across SaaS platforms, lakehouses and event-driven systems, each with its own control plane and governance model,” Kimball said. “The opportunity now is extending that model across the broader, more distributed data estates that define most enterprise environments today.”