Agent updates and security tool changes #93

July 30, 2026 — 3 min read

Today's Letter

GitHub released CodeQL 2.26.1 on July 29, 2026, with broader framework modeling and lower false positives across several languages.
Go coverage was extended for the log/slog package, including slog.Logger methods, With, WithGroup, Attr, and Value, affecting log-injection and clear-text-logging queries.
Java and Kotlin support added source, sink, and flow summary models for org.apache.poi, while the java/path-injection query now treats @javax.validation.constraints.Pattern validation as sanitized input.
The java/ssrf query now treats the first argument of Spring WebFlux WebClient.UriSpec.uri as a request forgery sink, which can surface additional valid alerts.
JavaScript and TypeScript analysis now recognizes Angular @HostListener('window:message', ...) and @HostListener('document:message', ...) handlers as client-side remote flow sources.
Rust analysis updated rust/hard-coded-cryptographic-value to treat arithmetic, bitwise, and string append operations as barriers, reducing false positives in mixed constant and nonconstant code paths.
For C and C++, models-as-data flow summaries now use fully qualified field names such as MyNamespace::MyStruct::myField, with unqualified names still supported for 12 months.
GitHub said the release is deployed automatically for GitHub code scanning on github.com and will be included in a future GitHub Enterprise Server release, while older GHES versions can upgrade CodeQL manually.

Source: github.blog

Google said Managed Agents in the Gemini API now default to Gemini 3.6 Flash as of the Jul. 28 update.
The release adds environment hooks that can block, lint, or audit tool calls inside the sandbox runtime.
Google also introduced budget controls for agent runs, intended to limit spend and execution scope.
Scheduled triggers were added, letting developers run agents on recurring events without building separate orchestration.
The update makes Managed Agents available on a free tier, lowering the barrier for API-side testing.
The announcement was published on the Google blog by Google DeepMind staff Philipp Schmid and Mariano Cocirio.
The package is positioned as a developer-tools update for teams building Gemini-based agent workflows with more control over runtime behavior.

Source: blog.google
More: cryptobriefing.com · almcorp.com

AWS published an official blog post on 2026-07-28 describing how AgentCore Gateway supports the MCP 2026-07-28 specification
The announcement centers on AgentCore Gateway, listed as part of the Amazon Bedrock AgentCore stack
MCP is the main interoperability layer referenced in the post, with the write-up focused on spec-level support rather than a broader product launch
The material is positioned as infrastructure for agent connectivity and gateway behavior inside the AWS agent platform
The source metadata also references OAuth 2.0, indicating authentication is part of the compatibility discussion in the AWS write-up

Source: aws.amazon.com

Cloudflare announced support for post-quantum authentication to origins.
The announcement was published on the official Cloudflare Blog on 2026-07-29.
Cloudflare categorized the post under its Security-related blog sections.
The post carries tags including Cryptography, Cybersecurity, Post-Quantum, SSL, TLS, and Research.
The update is presented as an origin authentication capability in Cloudflare's platform.

Source: blog.cloudflare.com

Jocoletter curates AI, software, and product trends for developers and builders.

#AWS #Cloudflare #GitHub #Google