Featured Issues

A look at the week gone byJoin Packt’s Accelerated Agentic AI Bootcamp this June and learn to design, build, and deploy autonomous AI Agents using LangChain, AutoGen, and CrewAI. Hands-on training, expert guidance, and a portfolio-worthy project—delivered live, fast, and with purpose.Spots are limited - book now to save 50%! Don’t miss your chance to join at the lowest price.Use Code CYBER50 at checkoutOffer Valid until 18th May MidnightDon't miss out!#198: Armed with Deepfakes, Script Interpreters, and CybergeopoliticsA look at the weekWelcome to another_secpro!For all of you who attended the RSA Conference, we hope you had a great time getting up to scratch with the goings on in this industry. Got something to share? Reply to this email and tell us about your thoughts. This week's issue contains:- AI-Generated Law-Google’s Advanced Protection Now on Android-Another Move in the Deepfake Creation/Detection Arms Race-Japan Enacts Active Cyberdefence Law to Counter Foreign Threats-Dior Suffers Data Breach Exposing Customer Information-U.S. House GOP Proposal to Block State AI Laws Raises Cybersecurity Concerns-Navvis and SSM Health Agree to $6.5M Settlement Over Data Breach-Indian Government Warns of Cyber Threats Post Ceasefire with Pakistan-Maharashtra Appoints First Female Cyber CommandoCheck out _secpro premiumCheers!Austin MillerEditor-in-ChiefMITRE ATT&CK #2: T1059Understanding "Command andScripting Interpreter" exploitationRead the rest here!RSA Conference 2025 – Navigating the New Cyber FrontierA reflection on this year's eventsRead the rest here!Aembit Workload IAM PlatformSecure AI agents and app workloads without secrets.Identity-based, just-in-time access across AWS, Azure, GCPNo custom auth code required" MFA for machines" with Zero Trust built in.Backed by Snowflake, Aembit makes identity-first security practical for today’s multi-cloud, AI-powered environments.Learn more about AembitNews BytesAI-Generated Law: On April 14, Dubai’s ruler, Sheikh Mohammed bin Rashid Al Maktoum,announcedthat the United Arab Emirates would begin usingartificial intelligence to help write its laws. A new Regulatory Intelligence Office would use the technology to “regularly suggest updates” to the law and “accelerate the issuance of legislation by up to 70%.” AI would create a “comprehensive legislative plan” spanning local and federal law and would be connected to public administration, the courts, and global policy trends. From Bruce Schneier.Google’s Advanced Protection Now on Android: Google hasextended its Advanced Protection features to Android devices. It’s not for everybody, but something to be considered by high-risk users. From Bruce Schneier.Another Move in the Deepfake Creation/Detection Arms Race:Deepfakes are nowmimicking heartbeats. In a nutshell: Recent research reveals that high-quality deepfakes unintentionally retain the heartbeat patterns from their source videos, undermining traditional detection methods that relied on detecting subtle skin color changes linked to heartbeats; the assumption that deepfakes lack physiological signals, such as heart rate, is no longer valid. This challenges many existing detection tools, which may need significant redesigns to keep up with the evolving technology; to effectively identify high-quality deepfakes, researchers suggest shifting focus from just detecting heart rate signals to analyzing how blood flow is distributed across different facial regions, providing a more accurate detection strategy. From Bruce Schneier.Japan Enacts Active Cyberdefence Law to Counter Foreign Threats: Japan has passed the Active Cyberdefence Law, empowering its government to proactively monitor and counter cyber threats, including those from foreign actors. The legislation allows for the surveillance of foreign IP communications and authorizes offensive cyber actions by law enforcement and the Self-Defense Forces, marking a significant shift in Japan's cybersecurity posture. See DIESEC's analysis here.Dior Suffers Data Breach Exposing Customer Information: Luxury fashion brand Dior confirmed a cyberattack that compromised customer data, including names, contact details, and purchase histories. The breach, which did not affect financial information, was disclosed on Dior's South Korean website, with affected customers also reportedly contacted in China.U.S. House GOP Proposal to Block State AI Laws Raises Cybersecurity Concerns: A Republican-led initiative in the U.S. House aims to impose a 10-year moratorium on state-level AI regulations, intending to create a unified federal framework. However, cybersecurity experts warn that this could weaken consumer protections and data privacy safeguards, especially in the absence of comprehensive federal legislation.Navvis and SSM Health Agree to $6.5M Settlement Over Data Breach: Healthcare providers Navvis and SSM Health have agreed to a $6.5 million settlement following a 2023 data breach that exposed sensitive patient information. Affected individuals may receive up to $7,000 in compensation, depending on the extent of their losses, and are eligible for two years of free credit monitoring.Indian Government Warns of Cyber Threats Post Ceasefire with Pakistan: Following a recent ceasefire between India and Pakistan, the Indian government has issued advisories highlighting potential cyber threats. Officials are urged to remain vigilant, as cyber operations and espionage activities may continue despite the cessation of active hostilities.Maharashtra Appoints First Female Cyber Commando: Assistant Inspector Rupali Bobade of the Sangli Cyber Cell has become Maharashtra’s first female "cyber commando" after completing a rigorous six-month national training program. This initiative aims to strengthen India's digital security infrastructure by training 5,000 officers over five years.This week's toolsATT&CK Splunk Add-on (as part of Attack Range): This Splunk-supported environment is designed for testing and training based on real-world attack scenarios. It leverages MITRE ATT&CK to simulate threats and includes preconfigured Splunk dashboards and detections for ATT&CK techniques, offering a lab-like setting for defenders to hone their response strategies.ATT&CK Navigator: ATT&CK Navigator is a web-based tool for visualizing and annotating MITRE ATT&CK matrices. It allows analysts to overlay data like detection coverage, threat actor usage, or red/blue team test results to better understand where gaps exist in detection or mitigation strategies.Caldera: Caldera is an automated adversary emulation system designed to evaluate the effectiveness of cyber defense tools and processes. It uses the MITRE ATT&CK framework to model adversary behavior and execute post-compromise techniques, allowing blue teams to validate detection and response capabilities.Detection Rules: Detection Rules is a collection of threat detection rules for use with Elastic Security. These rules are directly mapped to MITRE ATT&CK techniques and tactics, enabling high-fidelity detection of adversarial behavior in environments monitored by the Elastic Stack (Elasticsearch, Kibana, etc.).Upcoming events for _secpros this yearHere are the five conferences we're looking forward to the most this year (in no particular order...) and how you can get involved to boost your posture!DSEI (9th-12th September): DSEI stands out as a global platform that bridges defence, security, and cybersecurity. With its broad focus on cutting-edge technologies, this event is critical for those involved in national defence, law enforcement, and private security. Cybersecurity is a prominent theme, with sessions addressing both offensive and defensive cyber strategies.Defcon (7th-10th August): Defcon is a legendary event in the hacker and cybersecurity communities. Known for its hands-on approach, Defcon offers interactive workshops, capture-the-flag contests, and discussions on emerging threats. The conference is ideal for those looking to immerse themselves in technical aspects of cybersecurity.Black Hat (2nd-7th August): Black Hat USA is synonymous with advanced security training and research. This premier event features technical briefings, hands-on workshops, and sessions led by global security experts. Attendees can explore the latest trends in penetration testing, malware analysis, and defensive techniques, making it a must-attend for cybersecurity professionals.*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}

Bite-sized actionable content, practical tutorials, and resources for programmers#101:Python Tops Tiobe, AI Code Reviews in VS Code, C# 14 Extensions, and Grafana’s AI UpgradeLive Webinar | Scale AppSec with Security Champions – May 15Security Champions programs are a proven way to scale AppSec across dev teams. Join Snyk’s live webinar on May 15 @ 11AM ET to learn how to:✓ Define the role of security champions✓ Design a scalable, tailored program✓ Recognize, reward, and grow your champions🎓 BONUS: Earn CPE credits for attending!Save your spot now!Hi ,This is the last issue of ProgrammingPro as you know it.Starting next week, we’re relaunching under a new name: Deep Engineering. Why the change? Because the newsletter has evolved. Our audience—and our focus—now centres on developers and architects tackling complex challenges, designing better systems, and thinking beyond syntax.You’ll still hear from the same team. But the format will sharpen, the insights will go deeper, and the editorial focus will shift from general programming updates to thoughtful analysis, architecture, and advanced engineering practice.Thank you for being part of the journey so far—and see you next week in Deep Engineering.In today’sExpert Insight, we bring you Part 2 of our interview withFabrizio Romano, author of Learn Python Programming, Fourth Edition, where he shares what it takes to lead modern development teams—from fostering psychological safety and developer autonomy to navigating AI-assisted coding and tool debates with clarity and empathy.News Highlights: Python tops the May 2025 Tiobe Index, its highest since Java in 2001; CodeRabbit brings AI code reviews to VS Code and other IDEs; Grafana 12 adds observability-as-code and AI features; C# 14 enables extension members without altering original types.My top 5 picks from today’s learning resources:How to use template strings in Python 3.14🧵Interview: Bjarne Stroustrup on 21stcentury C++, AI risks, and why the language is hard to replace🧠Lock-Free Rust: How to Build a Rollercoaster While It’s on Fire🎢How We Built RisingWave on S3: A Deep Dive into S3-as-primary-storage Architecture🌊Democratizing AI: The Psyche Network Architecture🛰️But there’s more, so dive right in.Stay Awesome!Divya Anne SelvarajEditor-in-ChiefReplace Secrets with Scalable, Zero-Trust Access for AI Agents and Apps📢 Ditch secrets for good—Aembit’s new Identity Federation Hub replaces static credentials with short-lived, scoped tokens for NHIs across all clouds, no code needed.🔍 See how Snowflake uses Aembit to secure non-human access → Read the blogLearn more and explore the platform →Sign Up |Advertise🗞️News and Analysis🔎Python popularity climbs to highest ever – Tiobe: Python reached an all-time high in the May 2025 Tiobe Index with a 25.35% share, the highest rating since Java in 2001, and now leads C++ by over 15 percentage points.CodeRabbit brings AI-powered code review into Visual Studio Code: CodeRabbit now integrates its AI-powered code review tool into Visual Studio Code, Cursor, and Windsurf, enabling contextual, real-time reviews directly in the IDE.Grafana 12 is now available with new observability as code features, Dynamic Dashboards, and more: New AI features in Grafana Assistant enable natural-language interactions, while Beyla is being donated to OpenTelemetry as an eBPF-based instrumentation tool.C# 14 introduces extension members: The feature allows you to add static and instance methods or properties to existing types using a new optional syntax, without modifying the original code..NET 10 Preview 4 enhances Zip processing, JIT compilation, Blazor WebAssembly:The version also brings performance gains to F#, Android, and WPF development.Scala stabilizes named tuples: Scala 3.7.0 stabilizes named tuples for more readable multi-value returns, fixes Android lambda type issues by boxing return types, and adds support for dependent fields in case classes.LaunchDarkly adds new features to help developers release faster while mitigating risk: Features include dynamic rollout controls, AI governance, real-time experimentation with Multi-Armed Bandits, and team-level analytics.🎓Tutorials and Learning Resources💡Python🎓How to use template strings in Python 3.14: Explains how Python 3.14’s new template strings (t-strings) work, how they differ from f-strings, and how to use them for advanced string processing tasks like custom formatting and HTML sanitization.For more Python resources go to PythonProC# and .NET🎓C# 14 – Exploring extension members: explains C# 14’s new feature, detailing how developers can use the extension block to define grouped extension methods and properties—both instance and static—for existing types.🎓A sub-millisecond GC for .NET?!: Introduces Satori, an experimental garbage collector for .NET that delivers dramatic improvements in pause times—up to 100x faster at the 99th percentile—and reduces heap size.💼How Workleap uses .NET Aspire to transform local development: Explains how Workleap built Leap, a powerful CLI tool based on .NET Aspire, to automate and standardize local development across teams using microservices.C++ and C💡Interview: Bjarne Stroustrup on 21stcentury C++, AI risks, and why the language is hard to replace: Discusses best practices like RAII and concepts, warns against raw pointers and casts, and critiques AI-generated code.🎓Rust Devs Think We’re Hopeless; Let’s Prove Them Wrong (with C++ Memory Leaks)!: Uses humour and hands-on C++ code examples to show how to detect memory leaks without external tools.🎓Let’s write a Real-Time Operating System(RTOS) (Part4: Concurrency and interrupt management): Explains how to manage concurrency and interrupts in an RTOS using atomic operations and critical sections.Java🗞️JDK 25: The new features in Java 25: The impending LTS release introduced nine major features, including finalized scoped values, an updated vector API, and a new key derivation function API.🎓How to Supercharge Your Java Project with Rust — A Practical Guide to JNI Integration with a Complete Example: Explains how to integrate Rust with Java using JNI, covering packaging native libraries in a JAR, unifying logs, and more.JavaScript and TypeScript💡JavaScript's New Superpower: Explicit Resource Management: Introduces JavaScript's new proposal, adding using and await using declarations, Symbol.dispose/Symbol.asyncDispose, DisposableStack/AsyncDisposableStack, and SuppressedError to support safe, deterministic cleanup of resources.🎓Cursor Rules for TypeScript Engineers: Shares a curated set of Cursor rules tailored for TypeScript engineers, covering strict type safety, ESLint enforcement, Zod-based runtime validation, and Bun-first tooling preferences.Go🎓Build your own ResponseWriter: safer HTTP in Go: Demonstrates how to wrap Go’s http.ResponseWriter to enforce safer HTTP handler behavior—like requiring explicit status codes and blocking writes after errors.🎓Using type assertions in Go with concrete types: Explains how to safely call the String() method on a concrete type in Go (like [16]byte) by type asserting through interface{} rather than directly asserting on the concrete type.Rust💡Flattening Rust's Learning Curve: Outlines practical strategies, mindset shifts, and coding habits to help programmers—especially those from other language backgrounds—overcome common pitfalls and learn Rust more effectively.🎓Lock-Free Rust: How to Build a Rollercoaster While It’s on Fire: How to implement a lock-free, fixed-size array in Rust using atomics and a freelist, exploring advanced memory ordering semantics and concurrency safety.Swift💡What's new in Swift 6.2?: Provides an overview of enhancements in language capabilities, performance optimizations, and tooling updates.🎓Universal Links implementation on iOS: Explains how to configure, implement, and test Universal Links on iOS using Xcode and tools like RocketSim.PHP🗞️FrankenPHP Is Now Officially Supported by The PHP Foundation: The high-performance PHP server built with Go and Caddy, is now officially backed by the PHP Foundation to support ongoing development and ecosystem modernization.🎓Stop using preg_* on HTML and start using \Dom\HTMLDocument instead: Explains how PHP 8.4’s new \Dom\HTMLDocument HTML5 parser offers a safer, more robust alternative to preg_* functions for handling HTML.SQL💡A Visual Explanation of SQL Joins: Compares various joins—inner, left outer, full outer, anti-joins, and cross joins—highlighting how each operation behaves when combining two tables by a shared column.Ruby🗞️ZJIT has been merged into Ruby: Unlike YJIT, ZJIT uses a high-level SSA-based IR, compiles entire methods at once, and employs a modular optimiser.🎓Coding agent in 94 lines of Ruby: Walks you through building a functional coding agent using RubyLLM, showing how simple tool integrations—like file reading, editing, and shell execution—enable LLM-powered automation.🌟Advanced Concepts🚀How We Built RisingWave on S3: A Deep Dive into S3-as-primary-storage Architecture: Explains how RisingWave was engineered to use Amazon S3 as its only storage layer—handling internal state, views, and logs.Democratizing AI: The Psyche Network Architecture: Presents Psyche, a decentralized AI training architecture that enables LLM development across globally distributed, underutilized hardware using the Solana blockchain and DisTrO optimization.From Code to Charisma: Emotional Mastery for Tech Leaders: Explores how tech leaders can develop influence by mastering emotional regulation, recognising brain states (rational, emotional, survival), and fostering trust and psychological safety.Designing an architecture using dark matter and dark energy: Uses “dark matter” and “dark energy” as metaphors to explain how to balance cohesion and decoupling when designing monolithic or microservice architectures.🧠Expert Insight: Leading with Empathy 📚Part 2 of our interview with Fabrizio Romano, author of Learn Python Programming, Fourth EditionIn Part 1, Fabrizio Romano shared his journey with Python, talking about the language’s strengths, its limitations, and how it continues to evolve across tools, ecosystems, and developer mindsets. In this second part of our interview, we turn to his experiences as a software development leader—from his transition into management to his team culture, decision-making, and coaching philosophy.Development Manager at Sohonet and long-time Python programmer, Fabrizio brings more than two decades of experience to software engineering leadership. While many know him as the author of Learn Python Programming, Fabrizio's approach to management is rooted in empathy, communication, and personal growth.Q: What led to your transition into a leadership role?Fabrizio: I had been working as a developer for a long time, and after a point, writing code didn’t give me the same satisfaction it once did. I found myself more drawn to helping people grow. Even before I formally became a development manager, I was leading teams and mentoring developers.The experience that really shaped me happened years ago when I was teaching mathematics. A young student struggled with adding fractions. Everyone had given up, assuming she just couldn’t get it. But when I explained it using apples and bananas, she finally understood. That experience taught me that people learn differently, and you have to find the right explanation for each person. I try to lead with that same mindset today.Q: What are the biggest non-technical challenges you’ve encountered in software teams?Fabrizio: The real challenges in software development aren’t technical. At Sohonet, we work on cutting-edge tech for the media industry, and yes, some parts are complex. But most of the work—APIs, platforms, saving data—is not the issue. It’s the people side: miscommunication, mismatched expectations, and lack of shared process.If 11 people on a team all have different understandings of how our process works, then we waste time. I might move a task in a certain way that interrupts someone else’s workflow. These things accumulate. So I work hard to make sure everyone shares the same mental model of how we operate.Q: You've said you prefer values over rigid processes. What does that look like in practice?Fabrizio: I’ve seen teams run with strict rules, lots of constraints, and it can work for some. But not mine. I set up a process that’s flexible and based on values—things like being open, respectful, committed, courageous. When you're unsure what to do, you can use those values like a litmus test.This is similar to how spiritual disciplines work. In Reiki, for example, there are five principles—don’t get angry, don’t worry, be grateful, work hard, be kind. If you ask yourself, “Will this action make me more angry or more grateful?”, it helps guide behaviour. In teams, the same logic applies: let values shape your actions instead of just checking boxes.Q: How do you help your team handle stress and emotional setbacks?Fabrizio: Stress is universal. Everyone’s always trying to deliver faster, and that pressure builds up. One of my jobs is to pay close attention—to what people say, how they act on Slack, their body language in meetings. If I notice something’s off, I check in.I’ve taught half my team meditation techniques and worked with many of them one-on-one. When people are upset or angry, they activate the sympathetic nervous system—the fight-or-flight response. That leads to tunnel vision, shallow breathing, and poor decision-making.Some think that accepting a frustrating situation means passivity. But acceptance isn’t surrender. It’s choosing to remain calm and then respond intelligently. A relaxed mind is a creative mind.Q: How do you see AI tools like GitHub Copilot affecting developer workflows?Fabrizio: They're very helpful. I got everyone on my team Copilot licenses. It’s especially good for repetitive tasks—like hardcoding test cases or writing boilerplate.But I always tell my team: don’t let it replace your thinking. Part of our job is smashing our heads against tough problems. That’s how you develop creativity, problem-solving, and memory. Copilot can assist, but you need to stay sharp. Use it, learn from it—but don’t let it think for you.Q: What’s your view on tooling and tech stacks? Are you opinionated about what teams should use?Fabrizio: No, and I think strong opinions can be dangerous. If you only know one tool, every problem starts to look like a nail. That’s not effective.I want my team to find the best idea, not my idea. We debate things—FastAPI, Django, Flask—and decide what’s right for the context. The diversity of viewpoints leads to better solutions. A developer should choose tools based on what the problem needs, not what they’re comfortable with.Q: What advice would you give to developers considering a leadership path?Fabrizio: Don’t do it just because it’s the next step. Leadership isn’t about being a senior developer—it’s about people. And people aren’t machines. If you’re not passionate about helping others grow, you’ll struggle.You can train as a mentor or coach, but you need that core desire to help. I always say, “People don’t leave companies—they leave managers.” So if you’re thinking of moving into leadership, ask yourself: do I want to support others first, before anything else?To hear the full conversation—including Fabrizio Romano’s reflections on Python’s evolution, its strengths and trade-offs, as well as his insights on leadership, mentorship, team dynamics, and the role of AI in modern development—you can watch the complete video interview here.For a deeper dive, check out Learn Python Programming, Fourth Edition, co-authored by Fabrizio, which offers practical guidance on writing clean, maintainable Python code while building real-world applications. The book mirrors the learner-focused approach Fabrizio champions in this interview—encouraging curiosity, self-sufficiency, and deeper understanding over rote memorisation.Get the eBook for $35.99$31.98Get the Paperback for $39.99🛠️Useful Tools⚒️clickhouse-etl: An open-source ETL tool for real-time streaming from Kafka to ClickHouse, offering deduplication, temporal joins, and a web UI for managing pipelines.quickjs: A pure Go JavaScript engine supporting ECMAScript 2023 features like modules, async generators, and BigInt for embedding JS in Go apps.Cogent Core: An open-source Go framework for building cross-platform 2D and 3D applications that run on desktop, mobile, and web using a single codebase.That’s all for today.We have an entire range of newsletters with focused content for tech pros. Subscribe to the ones you find the most usefulhere.If your company is interested in reaching an audience of developers, software engineers, and tech decision makers, you may want toadvertise with us.If you have any suggestions or feedback, or would like us to find you a learning resource on a particular subject, just respond to this email!*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0}#converted-body .list_block ol,#converted-body .list_block ul,.body [class~=x_list_block] ol,.body [class~=x_list_block] ul,u+.body .list_block ol,u+.body .list_block ul{padding-left:20px} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}