A flaw in code for handling Parquet, Apache’s open-source columnar data file format, allows attackers to run arbitrary code on vulnerable instances. The vulnerability, tracked as CVE-2025-30065, is a deserialization issue (CWE-502) in Parquet’s Java library that allows execution of maliciously crafted Parquet files. Continue reading on CSOonline.com.

Google Cloud Next ’25, which runs from April 9-11 in Las Vegas ,will showcase the latest advancements and future directions of Google Cloud Platform and cloud computing in general. Naturally, you can expect a strong emphasis on artificial intelligence and machine learning and announcements around new AI-powered tools and services designed to enhance productivity, automate tasks, and drive innovation across various industries.

A surge in internet probes targeting devices from Juniper Networks, Cisco Systems, and Palo Alto Networks should put their admins on alert, say security experts. A threat actor is probing the internet using default credentials for a Juniper Networks router, prompting a cybersecurity expert to warn network admins to change the login combo from the factory setting if they haven’t already done so. Continue reading on CSOonline.com

Ivanti is warning customers that a critical vulnerability that impacts its VPN appliances and other products has already been exploited in the wild by a Chinese APT group. The flaw was originally flagged by Ivanti as a denial-of-service issue, but attackers figured out how to exploit it for remote code execution. The vulnerability, now tracked as CVE-2025-22457 with a severity score of 9.0 (Critical) on the CVSS scale, was exploited to deploy two new malware programs on Ivanti Connect Secure appliances versions 22.7R2.5 and earlier and Pulse Connect Secure 9.1x appliances that had reached end-of-support in December. Continue reading on CSO.

He’s only been on the job for two weeks, but newly appointed Intel CEO Lip-Bu Tan gave a major speech at a partner conference this week where he said the ailing company needs to get its act together, and he doesn’t want customers to hold back on their criticism. Intel’s Vision conference in Las Vegas included several hundred partners and customers, as well as top analysts.

On April 4, 2000, to celebrate Microsoft’s 25th anniversary, Network World’s Paul McNamara put together the post you’ll see below. The story hasn’t changed. — It’s Thursday, March 13, 1986: Microsoft, founded more than a decade earlier and already a powerhouse in the world of personal computer software, executes an initial public stock offering that will raise $61 million for the company and leave 30-year-old co-founder Bill Gates unfathomably wealthy.

In the initial years of multicloud adoption, enterprises took cautious, calculated steps to build and manage infrastructures that spanned multiple cloud providers. The objective was flexibility, performance optimization, and risk mitigation. Yet, in 2025, enterprises are struggling more than ever to operate effective multicloud environments. Why? The rapid movement toward AI systems, combined with a lack of thoughtful planning, has overwhelmed management strategies and pushed many organizations to the brink of multicloud madness.

Software supply chain security company Sonatype uncovered 17,954 open-source malware packages during Q1 2025, the company revealed in its Open Source Malware Index. Sonatype’s Open Source Malware Index for Q1 2025 was introduced April 2. A proliferation of open source malware, or malicious open source packages, poses unprecedented risk in the form of software supply chain attacks, the company said. Open source malware is intentionally crafted to target developers, in order to infiltrate and exploit software chains, according to Sonatype.

Enterprise IT leaders are facing a double-whammy of uncertainties complicating their data center building decisions: The ever-changing realities of genAI strategies, and the back-and-forth nature of the current tariff wars pushed by the United States. “This is obviously a fluid situation. The stated goal of the administration is to bring more development into the US,” said Forrester Senior Analyst Alvin Nguyen.

The Rust team has announced Rust 1.86, an update of the language that now features trait upcasting, or the ability to upcast trait objects. Rust 1.86 was announced April 3. For users with a previous version of Rust, the update can be accessed via the rustup tool by running the command rustup update stable. With trait upcasting, if a trait has a supertrait, then developers can coerce a reference to a trait object to a reference to a trait object of the supertrait.

ServiceNow is acquiring Logik.ai and its configure, price, quote (CPQ) solution to expand its customer relationship management (CRM) product portfolio and accelerate its momentum in sales and order management. Logik.ai, founded in 2021, provides a product that integrates artificial intelligence and an advanced rules engine to streamline the transaction management cycle. The acquisition will expand ServiceNow’s salesforce automation capabilities and provide self-service options for customers who are looking to configure the right product and services themselves, according to industry analysts.

IBM is expected to drive AI deep into its next mainframe refresh, due this spring, in a move aimed at keeping and attracting Big Iron customers. Meanwhile, there’s no shortage of vendors vying for enterprise customers that are interested in moving off the mainframe and into the cloud. Among them is startup Mechanical Orchard, which is unveiling its generative AI-based Imogen service.

Back when I first wrote about Hyperlight, Microsoft’s minimal hypervisor, I speculated that it had a possible role as a WebAssembly-based alternative to serverless computing tools like Azure Functions, using Kubernetes as a host. So it wasn’t too surprising that Microsoft announced a new OS-free host for WebAssembly code based on Hyperlight. The new Hyperlight Wasm builds on two Hyperlight features that Microsoft has demonstrated in the past few months.

New Relic this week announced a new capability in its Intelligent Observability Platform that the company says will enable engineering teams to deploy an eBPF-powered agent to automatically discover and monitor all applications running on Kubernetes clusters. The New Relic extended Application Performance Monitoring (eAPM) agent is an integration of the extended Berkely Packet Filter (eBPF) technology into New Relic’s platform.

Over 39 million API keys, credentials, and other secrets leaked onto GitHub’s platform last year, but an update to its scanning tool could help stop that. The widely used cloud-based version-control platform automatically blocks ‘several secrets every minute’ from going into production, but secrets leaks remain a major challenge for users of the service. While secrets are often exposed accidentally, many breaches also come from well-meaning developers who intentionally share them without realizing the risks, GitHub said in a blog post.

Cloud and development operations (devops) teams are under constant pressure to do more, faster. They have outdated systems to update and manage, new systems to build, and requests from business units who need their support. It’s a velocity problem, and IT departments often struggle to keep pace. Lucid Software’s newly introduced Cloud Accelerator is built specifically to remove the barriers that slow down strategic work.

The evolution of artificial intelligence (AI) has reached a new frontier with Agentic AI, a paradigm that empowers AI systems to act autonomously, make decisions, and adapt based on real-time data. As smart cities expand and urban centers grow more complex, Agentic AI plays a pivotal role in enhancing sustainability, optimizing resource management, and improving the quality of life for urban populations.

Industry consortium MLCommons has released new versions of its MLPerf Inference benchmarks, offering a closer look at how current-generation data center and edge hardware performs under increasingly demanding AI workloads. The updated MLPerf Inference V5.0 comes as infrastructure teams grapple with surging demand from generative AI applications like chatbots and code assistants, which require rapid processing of large and complex queries.

We always strive to write source code that is clean, maintainable, and devoid of any errors. However, we may often find that our application’s code is cluttered because we’ve used too many nested constructs or branches to validate our business rules. Enter guard clauses. Guard clauses allow us to improve the readability of our code by eliminating the need of writing unnecessary conditional statements and nested code in our methods.

The AI chip shortage could become even more dire as Chinese customers are purportedly looking to hoard Nvidia chips ahead of a proposed US sales ban. According to inside sources, Chinese companies including ByteDance, Alibaba Group, and Tencent Holdings have ordered at least $16 billion worth of Nvidia’s H20 server chips for running AI workloads in just the first three months of this year, The Information reported Wednesday.

IBM Cloud is broadening its AI technology services with Intel Gaudi 3 AI accelerators now available to enterprise customers. With Gaudi 3 accelerators, customers can more cost-effectively test, deploy and scale enterprise AI models and applications, according to IBM, which is said to be the first cloud service provider to adopt Gaudi 3. Intel Gaudi 3 accelerators include AI-specific designs and features and are targeted at multi-model large language models (LLMs) and retrieval-augmented generation (RAG) development, IBM stated. 

The latest version of the Python web framework features an automatic model-importing capability in the shell.  This release also spells the end of support levels for previous version 5.x releases. Unveiled April 2 by the Django Software Foundation, the Django 5.2 release supports Python versions 3.10 to 3.13. This latest release features a shell management command that automatically imports models from all installed apps, with the behavior customizable to add or remove automatic imports.

Splunk this week announced a new Service Inventory product that uses OpenTelemetry to offer a comprehensive view into service instrumentation, which the observability company says will solve a critical pain point in modern infrastructure monitoring by providing visibility across cloud and Kubernetes environments. Splunk’s Service Inventory helps organizations identify gaps in their observability configuration, validate that all services are properly instrumented, and ensure they are collecting data from every critical component of their infrastructure.

Nvidia on Wednesday released a set of MLPerf Inference V5.0 benchmark results for its Blackwell GPU, the successor to Hopper, saying that its GB200 NVL72 system, a rack-scale offering designed for AI reasoning, set a series of performance records. The benchmarks included the latest updates to MLPerf Inference, including the addition of Llama 3.1 405B, which Dave Salvator, director of accelerated computing products at Nvidia, called “one of the largest and most challenging-to-run open-weight models”, and the new Llama 2 70B Interactive benchmark, which features much stricter latency requirements compared with the original Llama 2 70B benchmark, more closely modeling how chatbots work.

NetBox Labs this week made available a new product that will help network teams detect and remediate configuration drift across sophisticated network environments before costly service disruptions or unplanned downtime affect services or applications. NetBox Assurance addresses a critical pain point for IT teams: the growing gap between how networks are supposed to look and how they actually operate. By providing real-time monitoring and automated drift detection, NetBox Assurance aims to transform network management from a reactive to a proactive discipline.

Enterprise data management vendor Informatica is adding new capabilities to Claire Copilot, the generative AI assistant in its Intelligent Data Management Cloud (IDMC). IDMC sits on top of enterprise databases, ingesting and cataloguing from various sources and applying data governance rules as it goes. It includes tools for extract, transform, load (ETL), data observability for data quality, and master data management.

SolarWinds this week introduced a new incident response product and announced AI-based updates to its observability platform and service management product that are aimed at strengthening IT operational resilience. Squadcast Incident Response comes to SolarWinds from its recent acquisition of Squadcast, and it’s designed to provide a proactive and structured approach to incident response and resolution. Among the capabilities this product provides are AI-powered alert isolation, on-call management, multi-source alert correlation, standardized runbooks, status pages, and Microsoft Teams and Slack integrations, according to SolarWinds.

A critical privilege escalation vulnerability, ImageRunner, affecting Google Cloud was promptly fixed before it could allow attackers to access sensitive information from GCP deployments. The issue, as discovered by the cybersecurity company Tenable, could have enabled an attacker to bypass permissions and obtain unauthorized access to container images. Continue reading on CSO.

Kong AI Gateway 3.10 introduces new capabilities designed to help organizations govern their generative AI usage more effectively, reduce hallucinations from large language models (LLMs), and boost developer productivity. We achieve this while keeping sensitive data protected and safe. As enterprises rush to operationalize generative AI and LLMs across workflows, the challenge has shifted from access to orchestration. Platform teams are now tasked with making AI usage secure, scalable, and cost-effective, without sacrificing or slowing down developer velocity.

Government software development is a curious business. When I was a student at the Naval Postgraduate School, I wrote a paper called “There is a Lot of Money to be Made Writing Bad Software for the Federal Government.”  The general idea is that the incentives to write good software aren’t nearly as strong as those nudging you to write it poorly. 

Want to make a Python user grind their teeth? Just recite three words: Python is slow. In many of the ways that matter, it’s true. “Pure” Python, without external libraries written in C, is nowhere near as fast at computation or object manipulation as C or C++, or Java, or Rust, or Go, or … well, the list goes on.

HTMX and Alpine are two low-overhead ways to empower your front end. Neither requires a build step, and both let you add Ajax-style API calls and client-side UI updates with minimal fuss. While the two technologies differ in approach, neither gets in its own way (or yours), and you can use them together. What’s not to like? Overview of Alpine and HTMX…

A major European cloud provider organization has committed additional funding to drive a push towards what it calls “sovereign, Trump-proof cloud services.” “Many cloud customers, including European public administrations, are concerned that foreign governments have too much power to demand data, impose tariffs and restrict services on the cloud infrastructures they use,” said the statement from CISPE (Cloud Infrastructure Service Providers in Europe).

Red Hat has updated Red Hat Developer Hub, an enterprise internal developer portal based on Backstage. The new release offers a developer preview of Adoption Insights, an analytical dashboard that details how Developer Hub is being used by development teams. With Red Hat Developer Hub 1.5, introduced April 1 and available now, Red Hat said it seeks to offer a more customized experience to increase developer productivity.

There’s been a fair amount of activity on the AMD front that was drowned out by the hoopla from the recent Nvidia GTC news barrage. With that as a backdrop, here’s a look at some recent AMD news: AMD announced plans to acquire ZT for $4.9 billion in August of last year. ZT designs, manufactures, integrates, and deploys servers for hyperscalers such as Amazon Web Services and Microsoft, although the manufacturing business is expected to be sold off this year, with AMD saying that it is in talks with “multiple potential strategic partners” to sell the business.

Python Enhancement Proposal (PEP) 751 gives Python a new file format for specifying dependencies. This file, called a lock file, promises to allow developers to reproduce the installation of their Python projects, with the exact same sets of dependencies, from system to system. Although there are several community solutions, Python has historically lacked an official way to do file locking and conflict resolution for dependencies.

Download the April 2025 issue of the Enterprise Spotlight from the editors of CIO, Computerworld, CSO, InfoWorld, and Network World.

Lightmatter has announced new silicon photonics products that could dramatically speed up AI systems by solving a critical problem: the sluggish connections between AI chips in data centers. The company’s newly unveiled Passage L200 and M1000 platforms use light instead of electricity to move data, potentially unlocking major performance gains for companies running large AI models, the company said in a statement.

The best defense is a good offense, right? When it comes to AI governance, organizations need both. The reason is that genAI capabilities evolve quickly, hype accelerates investments, and data risks are amplified through AI applications. This article looks at how to shore up your defense while planning and implementing a strong AI governance offense. Developing your AI governance strategy…

A JDK Enhancement Proposal (JEP) to prepare to make final mean final in Java would issue warnings about uses of deep reflection to mutate final fields. The warnings would prepare Java developers for a future release that ensures integrity by default by restricting final field mutation, making Java safer and potentially faster. The proposal was created in early-February and updated on March 31.

The banking industry faces challenges: higher customer demands, complex fraud tactics, and large amounts of regulatory paperwork. Yet, a powerful solution is emerging. Recent studies show that 78% of financial institutions already use generative AI in some shape or form to overcome these challenges. Analysts predict it may add $200–$340 billion in value annually to the sector. This major shift highlights how artificial intelligence is a necessary foundation in modern financial services.

In today’s fast-paced digital world, businesses handle vast amounts of data. Much of this data is locked within documents, which can be PDFs, scanned images, or even handwritten notes. These documents often include invoices, bills, reports, medical records, purchase orders, and business contracts. Extracting, managing, and processing this information manually can be time-consuming, costly, and prone to errors. This is where Intelligent Document Processing (IDP) comes in.

Python’s builders have accepted a proposal to create a universal lock file format for Python projects that would specify dependencies, enabling installation reproducibility in a Python environment. Python Enhancement Proposal (PEP) 751, accepted March 31, aims to create a new file format for specifying dependencies that is machine-generated and human-readable. Installers consuming the file should be able to calculate what to install without needing dependency resolution at install-time, according to the proposal.

What is 6G? Well, it’s not clear yet. It may end up being a major technological leap, but it may also end up being more like 5G. This is the conclusion of Björn Fägersten, CEO of the analysis company Politea and senior researcher at the Swedish Institute of International Affairs, who has just written a report on behalf of the Ministry of Foreign Affairs on the geopolitics of 6G and Europe’s role.

Apple has introduced swiftly 1.0, a version manager for the Swift programming language that is intended to ease the process of installing, managing, and updating the user’s Swift tool chain. Swiftly 1.0 was announced March 28. While swiftly has been available for some years as a community-supported tool for Swift developers using Linux, the swiftly 1.0 release makes it an officially supported part of the core Swift tool chain.

Three years after announcing its plans, merchant supplier Silicon Motion has begun shipping its 128TB Solid State Disks (SSD) Reference Design Kit (RDK) aimed at maximizing the performance and efficiency in AI tool workloads. Silicon Motion is best known as a designer of NAND flash drive controllers and the RDK is built on the MonTitan PCIe Gen 5 platform that utilizes the latest 2TB QLC NAND die.

Last week I talked up OpenTofu—and for good reason. The Terraform fork has moved beyond being the darling of the infrastructure-as-code (IaC) community to becoming a real, if early, enterprise contender. However, in so doing, I inadvertently threw shade at the market leader, Terraform from HashiCorp. It’s worth remembering that while individual products or projects can move fast, industries tend to move slowly.

Google has introduced version 2.5 of its Gemini AI model, which the company said offers a new level of performance by combining an enhanced base model with improved post-training. The Gemini 2.5 models are thinking models, capable of reasoning through their thoughts before responding, thus resulting in better performance and improved accuracy, said Koray Kavukcuoglu, CTO of Google DeepMind, in a March 25 blog post.

ECMAScript 2025, the next version of an ECMA International standard for JavaScript, will standardize new JavaScript capabilities ranging from JSON modules to import attributes, new Set methods, sync iterator helpers, and regular expression modifiers. The ECMAScript 2025 specification most likely be finalized in June. All told, nine finished proposals on the ECMAScript development committee’s GitHub page are designated as expected to be published this year.

Linux admins who have enabled the unprivileged user namespace restriction in their recent Ubuntu environments should take action to close three new vulnerabilities that allow a threat actor to bypass the supposed protection. This warning comes after researchers at Qualys found three different ways this hardening feature can, under certain circumstances, be bypassed.  “It needs to be addressed quickly,” said Robert Beggs, CEO of Canadian incident response firm DigitalDefence, which has several Ubuntu-based applications in its portfolio, “because it facilitates other exploits.