Mozilla

2026 Cloud-Native Security Practices for Developers

This technical guide describes cloud-native security as of mid-2026, reframing the attack surface from the application alone to the combined platform, pipeline, runtime, and application. It defines eight layered risk areas—source/build dependencies, container image, registry, Kubernetes API, pod runtime, service mesh, CI/CD pipeline, and runtime behavior—and maps defensive practices for each. The article recommends concrete tooling and patterns: SBOM-backed image scanning at build and registry time, image signing (Sigstore/Cosign) with admission-time verification, SLSA-aligned CI provenance and in-toto attestations, Pod Security Standards and deny-by-default NetworkPolicies, service-mesh mTLS and workload identity (SPIFFE), eBPF-based runtime detection (Falco, Tetragon), and external secrets/workload identity for credentials. It also covers compliance implications and how cloud-native controls integrate with OWASP ASVS and secure SDLC processes.

Meta launches Pocket — AI 'vibe‑coding' app

Meta has quietly launched Pocket, a new social app listed in the Google Play Store that lets users create, share and play lightweight, AI-generated interactive experiences called "Gizmos." Gizmos can be produced from simple AI prompts, react to touch and device motion, and incorporate user images and music; users can curate profiles, playlists and community feeds. The app’s Play Store entry was updated July 2, 2026, but availability remains limited and Meta has not officially announced it, suggesting an experimental rollout after acquiring the team behind Gizmo. Pocket’s functionality and data flows (app activity, personal data, location, device identifiers) raise potential implications for Meta’s advertising business and may be integrated into Meta’s wider app ecosystem in future.

Frontier Model Access Becomes an Access‑Control Problem

This weekly roundup (25 June–3 July 2026) highlights five industry moves that reframed AI engineering priorities: OpenAI launched GPT-5.6 as a restricted preview (Sol, Terra, Luna) with pricing and government‑restricted access; Anthropic regained partial access for Mythos 5 and Fable 5 after targeted safety controls; studies show agentic coding has scaled inside large organizations and measurably changed engineering throughput; Mozilla’s 0din team demonstrated a repo-based attack that can trick coding agents into installing a reverse shell; NVIDIA struck revenue‑share/credit partnerships with neoclouds (Sharon AI, Firmus) to deliver tens of thousands of GPUs regionally; and Z.ai’s open-weight GLM-5.2 raised cybersecurity concerns after benchmark wins. The thread tying these stories together is that model choice is now inseparable from access policy, security boundaries, compute procurement, and governance — operational factors teams must architect for production.