Featured Issues

Real-world insights for sharper web dev decisionsAdvertise with Us|Sign Up to the Newsletter @media only screen and (max-width: 100%;} #pad-desktop {display: none !important;} } @media only screen and (max-width: 100%;} #pad-desktop {display: none !important;} }WebDevPro #111Cursor: The Iron Man Suit for DevelopersReal-world insights for sharper web dev decisionsHi ,Every developer remembers their early battles with code. Translating an idea into logic, chasing down an elusive bug, or spending hours in documentation until something finally worked. For decades, this was the rhythm of our craft. It was demanding, often frustrating, but also deeply rewarding. This was the world of Software 1.0, where programming meant writing every line by hand.Then came Software 2.0, where machine learning shifted the focus from rules to data. Today, we’ve entered Software 3.0, and the change is more radical.As Andrej Karpathy has observed, the hottest new programming language is no longer Python or JavaScript but English itself.That’s the backdrop for this week’s WebDevPro. Welcome to #111, where we dive deep into what Software 3.0 means for developers and teams. This feature is co-authored with Eden Marco, whose perspective adds sharp insight into how this shift is playing out in real workflows. Together, we’ll look at why the old rules of coding no longer apply and how AI-native tools like Cursor are rewriting the developer’s craft.This shift is not a distant future. It is here, and it is changing what it means to be a developer. In the rest of this issue, we’ll unpack how this transformation shows up in workflows, tools, and the developer’s day-to-day reality.All these shifts are exciting in theory, but they’re even more powerful in practice.That’s why we’re hosting AI-Powered Development with Cursor Workshop, a hands-on event designed to bring Software 3.0 principles into real workflows.Use code EARLY50 to claim 50% off your spot.Reserve Your Spot at 50% OFFLet’s also take a quick look back at what sparked the most interest in last week’s issue:🌐 WebAssembly 3.0 lands: The spec is officially complete, bringing exception handling, richer memory, and 64-bit support, cementing Wasm’s role beyond the browser.⚖️ Ryan Dahl and Deno push to free JavaScript: A $200,000 campaign to challenge Oracle’s trademark on JavaScript™, aiming to remove legal barriers around the language name.💡 Why React’s dominance may be holding frontend innovation back: An argument that React’s default status slows innovation, while frameworks like Svelte, Solid, and Qwik show real-world performance gains.Have any ideas you want to see in the next article? Hit Reply!Advertise with usInterested in reaching our audience? Reply to this email or write to kinnaric@packt.com.Learn more about our sponsorship opportunities here.Understanding Software 3.0: A Shift in the Developer’s RoleWorking with large language models is often compared to collaborating with a quirky genius. They can recall vast amounts of knowledge, generate complex functions in seconds, and surprise you with brilliance. But they’re also forgetful, prone to hallucinations, inconsistent, and sometimes obedient to a fault.This duality defines Software 3.0. Developers are no longer simply writing code line by line, nor are they just consumers of pre-trained models. Instead, they’re partnering with AI systems whose power needs direction. The real challenge is not coding faster, but shaping interactions so they are productive, reliable, and safe.The defining principles of Software 3.0 are:Augmentation over Automation — AI isn’t here to replace the developer but to amplify them, like Tony Stark with the Iron Man suit.Beyond Prompt Engineering — clever prompts aren’t enough; real leverage comes from building structured environments that guide AI consistently.Developers as Context Engineers — the new craft is designing context, guardrails, and workflows so AI becomes a dependable collaborator.Augmentation Over AutomationWhen people imagine AI in development, the mind often leaps to full automation. A system that builds entire applications while the developer relaxes. This vision may someday be possible, but today it is neither practical nor safe.A better mental model is the Iron Man suit. Tony Stark does not disappear when the suit activates; his intelligence drives the machine. The suit amplifies what he can do, gives him new capabilities, and helps him act faster and more effectively.For developers, this model translates into a generation and verification cycle. The AI generates code, the human verifies it, and the loop repeats. The faster this loop becomes, the faster projects move forward. The quality of this partnership is measured not by how much the AI can do on its own, but by how seamless the collaboration feels.A crucial element is control. Developers need to adjust how much autonomy they grant the AI. Sometimes the task is small, and all that is required is a quick autocomplete. Other times, the developer may want the AI to take a larger role, such as refactoring a complex feature. An effective tool should make this adjustment feel natural, like sliding between levels of assistance without breaking flow.Moving Beyond Prompt EngineeringMany developers’ first interaction with AI comes through prompt engineering. They experiment with phrasing until the AI gives the desired response. While useful for simple queries, this method struggles with complex, multi-step work. Memory resets force repetition, minor wording changes lead to inconsistent results, and hallucinations introduce errors.Another early approach is vibe coding, where the developer describes what they want and the AI generates full solutions. This works well for prototypes but often leads to technical debt, weak architecture, and hidden vulnerabilities. The convenience of fast results hides long-term costs.The more sustainable path is context engineering. Rather than relying on prompts or blind generation, developers create structured environments that provide the AI with rules, data, memory, and tools. Cursor leads in this approach, offering features like codebase indexing, granular @file references, ignore rules, and documentation integration.Context engineering ensures the AI operates within a controlled environment, producing consistent results while avoiding security pitfalls and maintenance issues. It is the difference between asking an AI to guess and guiding it with a complete framework.Cursor as a CockpitCursor was built with this philosophy at its core. Instead of adding AI as a plugin or extension, it creates an AI-first development environment. Cursor is not an accessory. It is the cockpit where the human developer and the AI collaborate.Several design choices make Cursor stand out:It indexes your codebase, solving the memory problem by giving the AI project-wide context.It integrates AI directly into the editor workflow, avoiding the need to copy and paste between chatbots and IDEs.It provides an autonomy slider through three distinct features that work together.This combination allows developers to remain in control while still taking advantage of the AI’s speed and knowledge.The Core Feature TrinityAt the heart of Cursor are three features that support different kinds of interactions:Tab Autocomplete: More than a syntax helper, this autocomplete is context-aware. It predicts not just tokens but meaningful blocks of code, tailored to the project and frameworks you use.The Chat Panel: Built directly into the editor, the Chat Panel functions as an advanced assistant. It understands your entire codebase, can be directed with file and folder references, and even integrates with external resources like web searches or documentation.Cmd/Ctrl + K Inline Editor: This feature allows you to highlight code and ask for precise edits without leaving your editor. It doubles as an AI-powered terminal, turning natural language into executable shell commands.Together, these features create a fluid cycle. The AI can assist in lightweight or heavyweight ways, and the developer can shift between them depending on what is needed.Agent Mode: Partnership at a Higher LevelThe most ambitious feature in Cursor is Agent Mode. Instead of working only on small suggestions, Agent Mode can operate at the level of multi-file changes and project planning.With Agent Mode, the AI can:Explore your codebase semantically.Execute commands in your terminal.Edit multiple files with consistency.Plan tasks through structured to-do lists.Maintain checkpoints to revert changes.Different modes provide flexibility. Ask Mode keeps the AI read-only for exploration. Manual Mode limits changes to precise edits. Custom Modes allow developers to create specialized workflows.To see what this looks like in practice, here’s the Agent Mode panel inside Cursor’s cockpit:Screenshot via Cursor docs, showing autonomy controls like Auto-run and Auto-fix errors.Agent Mode is not about replacing the developer. It is about expanding what one person can achieve. A task that once took hours of repetitive work can be completed in minutes when the AI handles the implementation details and the human provides direction.Why This Shift Matters for Teams and OrganizationsThis is not just about convenience. The evolution toward AI-powered development changes the fundamentals of the profession.Productivity: Repetitive coding tasks can be offloaded, allowing developers to focus on design and architecture.Security: With structured context and human oversight, AI-assisted workflows can be made safer than blind code generation.Collaboration: Teams can work with a shared AI assistant that understands the project history and rules.Creativity: Developers can move faster from idea to prototype, experimenting more freely without the same costs.These shifts will shape how teams deliver software in the coming decade. The organizations that learn to build effective human–AI partnerships will set the pace.Theory Meets Practice: The Cursor WorkshopThis workshop provides an opportunity for you to experiment, build, and bring ideas to life in code. Here’s what you’ll gain from AI-Powered Development with Cursor Workshop:Professional Vibe Coding Techniques: Turn vague specs into production-grade solutions.Quality Assurance for AI-Generated Code: Build review pipelines, automated tests, and secure practices for dependable results.Building Across Unknown Tech Stacks: Confidently scaffold, debug, and optimize in unfamiliar frameworks with Cursor’s support.You’ll walk through a complete AI-powered development cycle: setting up Cursor, migrating from VS Code, testing workflows with MCP servers, adding security guardrails, and experiencing Agent Mode in live multi-file edits. Use code EARLY50 to claim 50% off your spot.Reserve Your Spot at 50% OFFClosing ThoughtsThe journey from Software 1.0 to Software 3.0 has been rapid, and the pace is only increasing. English has become the new interface for machines, but raw interaction is not enough. Developers need environments that make collaboration practical, safe, and scalable.Cursor is one of the first tools to take this seriously. By combining context engineering, intuitive features, and a philosophy of augmentation, it creates a cockpit for the age of AI-first development.The Iron Man suit is here. The only question is how quickly developers will learn to fly in it.Got 60 seconds? Tell us what clicked (or didn’t)Cheers!Editor-in-chief,Kinnari ChohanSUBSCRIBE FOR MORE AND SHARE IT WITH A FRIEND!*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0}#converted-body .list_block ol,#converted-body .list_block ul,.body [class~=x_list_block] ol,.body [class~=x_list_block] ul,u+.body .list_block ol,u+.body .list_block ul{padding-left:20px} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}} @media only screen and (max-width: 100%;} #pad-desktop {display: none !important;} } @media only screen and (max-width: 100%;} #pad-desktop {display: none !important;} }

A last look at Hemang Doshi's advice for AI, auditing, and privacyYou may have outsourced CIAM to the engineering team, but security still gets the call when there’s a breach. It’s time for you to take control, not the blame.Frontegg gives security teams direct control over the policies that safeguard your customer-facing application. No more waiting for developers to implement step-up MFA or manage compliance updates.Start Your Free TrialTake a look at the Security Suite directly#217: Privacy and YouAnother look at CISA and a survey of the landscapeWelcome to another_secpro!In cybersecurity, there's no such thing as standing still. While standing still might mean "going with the flow" in ordinary life, it means the very opposite when it comes to jousting with the adversary - indeed, standing still means "letting the flow go past you"! That's why we in the _secpro team are always pushing ourselves and pushing our readers to pick up ideas, develop skills, and stay above water in the rushing waves of "the flow"!That's why this week we are beginning a four-part series that looks into the deeds and needs of a CISA-trained professional - and, more importantly, how you can get to that plateau too. With the help of Hemang Doshi's fantastic book, we're taking the necessary steps to move from IT generalist or junior secpro into the higher echelons of auditing. Sound good? Check out this week's excerpt: Data Privacy Program and Principles.Check out _secpro premiumIf you want more, you know what you need to do: sign up to the premium and get access to everything we have on offer. Click the link above to visit our Substack and sign up there!Cheers!Austin MillerEditor-in-ChiefAdvance your technical career with actionable, practical solutionsAWS re:Invent 2025 Las VegasTransform your skills at AWS re:Invent 2025. Master new AWS services, join immersive workshops, and network with top cloud innovators at AWS re:Invent 2025. As a re:Invent attendee,you'll receive 50% discount code towards any AWS Certification exam.Our 2025 event catalog is now available!Explore the EventHere's a little meme to keep you going...Source: RedditThis week's articleData Privacy Program and PrinciplesAI is revolutionizing various industries, including auditing. Traditionally, auditing has been a manual and time-consuming process, requiring auditors to sift through large volumes of data to identify discrepancies and ensure compliance. However, with the advent of AI, the audit process is becoming more efficient, accurate, and insightful. AI can analyze vast amounts of data quickly, identify patterns, and even predict potential risks, making it an invaluable tool in modern auditing.Read the rest here!News BytesCisco ASA / FTD Zero-Days Under Active Exploitation: On 25 September, Cisco and CISA published security advisories confirming that multiple zero-day vulnerabilities affecting Cisco ASA / FTD (Firewall, VPN) products are being actively exploited. Two of these (CVE-2025-20333, CVE-2025-20362) were confirmed to have been exploited in the wild.Threat actors have leveraged advanced evasion techniques (disabling logs, intercepting CLI commands, modifying boot processes) and deployed bootkits such as RayInitiator combined with malware (e.g., LINE VIPER) to persist across reboots and firmware upgrades. The urgency prompted CISA to issue an Emergency Directive 25-03, mandating U.S. federal agencies to inventory, assess, and mitigate vulnerable Cisco devices.Continued Attack Campaign on Cisco Firewalls (Rommon / Bootkit-level Persistence) (PDF): Following the zero-day disclosures, deeper forensics revealed that the adversaries are not merely exploiting web/VPN logic flaws, but targeting the ROM Monitor (ROMMON) / boot environment of ASA devices. The RayInitiator bootkit persists in the boot chain, and it loads LINE VIPER, a malware module that can intercept commands, bypass VPN AAA, suppress logs, and embed itself into core ASA processes (e.g. lina). Some devices lack Secure Boot / Trust Anchor support, making them more vulnerable. These mechanisms impede forensic detection and complicate patching strategies — for example, even after reboots or upgrades, malicious modules can survive.Scattered Spider: Retail Service Desk Exploits Renewed Focus: Throughout the week, multiple analyses surfaced reaffirming that the hacking collective Scattered Spider (aka UNC3944 / Octo Tempest) is continuing to rely heavily on social engineering of service desks / help desks to gain initial footholds in enterprise networks. A new PDF—Cross-Sector Mitigations: Scattered Spider—jointly produced by sector cyber-information shares, outlines updated TTPs (tactics, techniques, procedures) and countermeasures for financial services, IT/retail, health, etc. In one prominent case, attackers impersonated internal staff, tricked the helpdesk into resetting MFA / disabling controls, and escalated privileges inside M&S / Co-op systems. Forensic Visualization Toolkit: Enhancing Threat Hunting: In a freshly published academic work (11 September 2025), researchers present “Enhancing Cyber Threat Hunting – A Visual Approach with the Forensic Visualization Toolkit”. The toolkit offers interactive visualizations of forensic and telemetry data (network, file access, process graphs) to assist threat hunters in spotting anomalies that may evade automated detection systems. The authors argue that combining human analytical insight with visualization accelerates detection of stealthy threats, especially those embedded in normal-looking activity windows.The paper includes realistic case studies and performance comparisons, making it a timely reference for SOC / IR teams aiming to ramp threat‐hunting maturity.Burnout in Cybersecurity: A Strategic Risk Report: While not a direct breach event, a notable paper published earlier in 2025 — “A Roadmap to Address Burnout in the Cybersecurity Profession” — has gained renewed attention this week in security circles. The work synthesizes findings from a multi-disciplinary workshop involving practitioners, academics, and ex-NSA cyber operators. It outlines the human, organizational, and workflow stresses contributing to attrition and mental fatigue, and presents a roadmap of interventions (training, rotation, psychological support, team-based structures) to mitigate erosion of security capacity. Given current pressure on SOC/IR teams (e.g. responding to high-tempo incidents like the Cisco zero-days), this issue is increasingly treated as a strategic risk in cybersecurity planning.Digital Forensics & Risk Mitigation Strategy for Modern Enterprises: Another academic contribution gaining traction is “Comprehensive Digital Forensics and Risk Mitigation Strategy for Modern Enterprises”, published February 2025. The paper walks through a simulated case of a large identity/data-analytics firm under attack and develops an integrated strategy covering pre-incident readiness (forensic architecture design, monitoring), live response, post-incident lessons, and regulatory compliance.It emphasizes adaptive AI/ML techniques, integration of threat intelligence into forensics workflows, and continuous “forensic readiness” as a discipline. In the context of emerging threats (e.g. boot-level persistence, identity-based service desk attacks), the paper serves as a robust blueprint for mature enterprise response programs.This week's academiaAdversarial Machine Learning: A Taxonomy and Terminology: A comprehensive NIST report that builds a clear taxonomy and standardized terminology for adversarial machine learning (AML). It describes attacker goals and capabilities across ML life-cycles, categorizes AML attack and defense types, and outlines current technical and measurement challenges for trustworthy AI in security-sensitive systems. Highly cited and used as a baseline by both researchers and practitioners.(A. Vassilev et al. NIST Trustworthy & Responsible AI group).On Adversarial Attack Detection in the Artificial Intelligence Era: Survey/analysis of detection techniques for adversarial attacks on ML models, contrasting classic concealment/malware tactics with modern adversarial-example threats. The paper evaluates state-of-the-art detection approaches and points to gaps where attackers are leveraging large models and automation to evade defenses. Useful for defenders designing layered ML security. (N. Al Roken and collaborators).A Defense-Oriented Model for Software Supply Chain Security: Introduces the AStRA graph-based model (Artifacts, Steps, Resources, Principals) to represent software supply chains and reason about security objectives and defenses bottom-up. Applies the model to case studies and maps past supply-chain attacks to show where defenses succeed or fail — a practical roadmap for research and industry focusing on supply-chain mitigations (SBOMs, build integrity, provenance, etc.). (E. A. Ishgair and coauthors).Securing Automotive Software Supply Chains: NDSS paper that examines unique risks in automotive software supply chains (ECUs, OTA updates, third-party components). It evaluates real automotive update pipelines, shows practical attack scenarios, and recommends defenses tailored to the automotive context (signing, reproducible builds, hardened update channels). Very relevant given recent high-profile industrial supply-chain incidents. (Marina Moore, Aditya Sirish A. Yelgundhalli, Justin Cappos).Managing Deepfakes with Artificial Intelligence: Introducing a Business/Privacy Calculus: Academic analysis of deepfake threats and defenses from both technical and socio-economic angles. Proposes an AI-assisted detection/mitigation framework and a privacy/business calculus for organizations to evaluate risks vs. countermeasure costs (useful for enterprises facing deepfake-enabled fraud or reputational attacks). Timely as synthetic media use explodes. (G. Vecchietti and collaborators).*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}