Featured Issues

How to Block Up to 95% of Attacks Using AWS WAFCloudPro #95A better way to handle vendor security reviews?If you've ever dealt with vendor onboarding or third-party cloud audits, you know how painful it can be: long email chains, stale spreadsheets, and questionnaires that don’t reflect what’s actually happening in the cloud.We recently came across CloudVRM, and it’s a refreshingly modern take on the problem.Instead of asking vendors to fill out forms or send evidence, CloudVRM connects directly to their AWS, Azure, or GCP environments. It pulls real-time telemetry every 24 hours, flags misconfigs, and maps everything to compliance frameworks like SOC 2, ISO 27001, and DORA.It’s already being used by banks and infra-heavy orgs to speed up vendor approvals by 85% and reduce audit overhead by 90%.Worth checking out if you're building or maintaining systems in regulated environments, or just tired of spreadsheet security.Watch the demoThis week’s CloudPro kicks off with something genuinely useful: a tool that replaces vendor security questionnaires with real-time cloud evidence.📌CloudVRM connects directly to AWS, Azure, or GCP and auto-checks compliance, no spreadsheets, no guesswork📌AWS CloudTrail silently skipping logs if IAM policies get too large (and attackers know it)📌PumaBot is now brute-forcing IoT cameras and stealing SSH credsWe’ve also got sharp engineering writeups: from how Uber rotates 20K secrets a month, to how Netflix handles 140 million hours of viewing data daily, to one team’s story of slicing a $10K Glue bill down to $400 with Airflow.Hope you find something in here that saves you time, money, or migraines.Cheers,Shreyans SinghEditor-in-Chief🔐 Cloud SecurityAWS CloudTrail logging can be bypassed using oversized IAM policiesResearchers at Permiso Security found that AWS CloudTrail fails to log IAM policies between 102,401 and 131,072 characters if they're inflated using whitespace. This gap allows attackers to hide malicious changes from audit logs. The issue stems from undocumented size limits and inconsistent handling of policy data. AWS has acknowledged the problem and plans a fix in Q3 2025.PumaBot targets Linux-based IoT surveillance devices via SSH brute forceA new botnet called PumaBot is targeting IoT surveillance systems by brute-forcing SSH access using IP lists from its command-and-control server. Written in Go, the malware disguises itself as system files, adds persistence through systemd, and installs custom PAM modules to steal credentials. Related binaries in the campaign also auto-update, spread across Linux systems, and exfiltrate login data.How to Block Up to 95% of Attacks Using AWS WAFThis guide explains how to configure AWS Web Application Firewall (WAF) to block threats like SQL injection, XSS, bots, and DDoS attacks with minimal effort. By leveraging pre-built managed rules and setting up a Web ACL, users can protect apps behind ALB, CloudFront, or API Gateway without custom code.CloudPEASS: Toolkit to find and exploit cloud permissions across AWS, Azure, and GCPCloudPEASS helps red teamers and defenders map out permissions in compromised cloud accounts without modifying resources. It supports AWS, Azure, and GCP, detecting privilege escalation paths using API access, brute-force permission testing, and AI-assisted analysis. It also checks Microsoft 365 services in Azure and enables Gmail/Drive token access in GCP.Uber built a multi-cloud secrets platform to prevent leaks and automate security at scaleTo manage over 150,000 secrets across services and vendors, Uber developed a centralized secrets management platform. It blocks leaks in code with Git hooks, scans systems in real time, and consolidates 25 vaults into 6. The platform enables auto-rotation, access tracking, and third-party secret exchange via SSX. It now rotates ~20,000 secrets monthly and is evolving toward secretless auth and workload identity federation.BOOK NOW AT 25% OFF⚙️ Infrastructure & DevOpsAWS Cost Explorer now offers a new Cost Comparison featureAWS launched a new Cost Comparison feature in Cost Explorer that highlights key changes in cloud spend between two months. It automatically identifies top cost drivers, like usage shifts, discounts, or refunds, without needing manual spreadsheets. A new “Top Trends” widget shows the biggest changes at a glance, and deeper insights are now available through the Compare view.Go-based Git Add Interactive tool adds advanced staging and patch filteringThis Go port of git add -i/-p enhances Git’s interactive staging with features like global regex filters, auto-hunk splitting, and multi-mode patch operations (stage, reset, checkout). It supports keyboard shortcuts, color-coded UI, and fine-grained hunk control across all files.GitLab-based monorepo streamlines Terraform module versioning and securityThis setup uses a GitLab CI pipeline to manage Terraform modules in a monorepo, with automated versioning, linting, and security scans via tools like TFLint, tfsec, and Checkov. Git tags handle module versions without extra auth tokens. The workflow enforces changelogs, labels, and approvals, and publishes docs and tags post-merge.A fully automated fix for Terraform’s backend bootstrapping problem on AzureThis guide solves the common issue where Terraform needs a backend to store state, but can’t create it without an existing backend. It automates the creation of an Azure Blob backend using Terraform itself, then seamlessly switches to that backend by generating partial config files and migrating state. The setup includes secure access via managed identity and GitHub OIDC, enabling CI/CD workflows without manual secrets or scripts.Using Terraform to automate disaster recovery infrastructure and failoversThis post explains DR strategies like Pilot Light and Active/Passive, and shows how Terraform enables flexible, cost-efficient deployments using conditionals and modular IaC. A working AWS example demonstrates DNS failover and dynamic EC2 provisioning using a toggle variable. This lets teams switch between production and DR environments with minimal effort, reducing downtime and idle resource costs.📦 Kubernetes & Cloud NativeGateway API v1.3.0 Adds Smart Mirroring and New Experimental ControlsGateway API v1.3.0 is now GA with percentage-based request mirroring, letting teams test blue-green deployments without full traffic duplication. The release also debuts experimental support for CORS filters, retry budgets, and listener merging via new X-prefixed APIs. These features help fine-tune request handling, scale listener configs across namespaces, and manage retry spikes, without upgrading Kubernetes itself.Introducing Gateway API Inference ExtensionThe new Gateway API Inference Extension introduces model-aware routing for GenAI and LLM services running on Kubernetes. It adds InferenceModel and InferencePool resources to better match requests with the right GPU-backed model server based on real-time load. Early benchmarks show reduced latency under heavy traffic compared to standard Services, helping ops teams optimize resource usage and avoid contention.Deep Dive into VPA 1.3.0: Smarter Resource Tuning for Kubernetes PodsThis post explores how the Vertical Pod Autoscaler (VPA) v1.3.0 uses historical and real-time metrics to recommend CPU and memory resource requests. It focuses on the Recommender component, which aggregates usage into decaying histograms to auto-tune workloads and reduce resource waste.Default Helm Charts Leave Kubernetes Clusters at RiskMicrosoft researchers warn that many open-source Helm charts deploy with insecure defaults, exposing services like Apache Pinot, Meshery, and Selenium Grid to the internet without proper authentication. These misconfigurations often include LoadBalancers or NodePorts with no access controls, making them easy targets for attackers. Teams should avoid "plug-and-play" setups and review YAML/Helm configs before deploying to production.Batch Scheduling in Kubernetes: YuniKorn vs Volcano vs KueueKubernetes lacks native support for batch workloads like ML training and ETL jobs, prompting the rise of tools like Apache YuniKorn, Volcano, and Kueue. YuniKorn replaces the default scheduler with strong multi-tenancy support; Volcano focuses on high-performance use cases with gang scheduling; and Kueue integrates natively to manage job queues without altering core scheduling.🔍 Observability & SREWhat's new in Grafana v12.0Grafana v12.0 introduces Git-based dashboard versioning, dynamic layouts, and experimental APIs for managing observability as code. Drilldowns for metrics, logs, and traces are now GA, enabling queryless deep dives across signals. SCIM support simplifies team provisioning, and a new “Recovering” alert state reduces flapping.Sentry Launches Logs in Open Beta to Boost Debugging ContextSentry now supports direct log ingestion in open beta, letting developers view application logs alongside errors and traces in a single interface. This integration adds vital context, like retry attempts or upstream responses, to help identify root causes faster without switching tools.How to use Prometheus to efficiently detect anomalies at scaleGrafana Labs has built and open-sourced an anomaly detection system using only PromQL: no external tools or services required. It computes dynamic bands using rolling averages, standard deviation, and seasonal patterns, with tunable sensitivity and smoothing to reduce false positives. The framework scales across tenants and works with any Prometheus-compatible backend, making it easy to plug into SLO-based alerts for better incident context.Beyond API uptime: Modern metrics that matterTraditional uptime checks fall short in today’s fast-paced environments where even minor API delays can cause major user churn. Catchpoint’s Internet Performance Monitoring (IPM) combines global synthetic tests, percentile-based metrics, and user-centric objectives to detect slowdowns before they escalate. With features like API-as-code, chaos engineering, and CI/CD integration, IPM helps teams catch latency issues early and simulate real-world failures.Microservices Monitoring: Metrics, Challenges, and Tools That MatterMonitoring microservices requires more than just uptime: it demands insight into latency, throughput, error rates, resource use, and inter-service communication. Tools like Middleware, Prometheus-Grafana, and Dynatrace help track these metrics at scale, support alerting, and simplify root cause analysis. Best practices include centralized logging, distributed tracing, automation, and continuous optimization to maintain performance in complex distributed systems.Forward to a Friend📢 If your company is interested in reaching an audience of developers and, technical professionals, and decision makers, you may want toadvertise with us.If you have any comments or feedback, just reply back to this email.Thanks for reading and have a great day!*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}}

Crafting the Web: Tips, Tools, and Trends for DevelopersAdvertise with Us|Sign Up to the Newsletter @media only screen and (max-width: 100%;} #pad-desktop {display: none !important;} } @media only screen and (max-width: 100%;} #pad-desktop {display: none !important;} }WebDevPro #94: Angular Trims Down, Node Powers Ahead, Remix Evolves 🌍🔍Crafting the Web: Tips, Tools, and Trends for DevelopersWeb Devs: Turn Your Knowledge Into IncomeBuild the knowledge base that will enable you to collaborate AI for years to come💰 Competitive Pay Structure⏰ Ultimate Flexibility🚀 Technical Requirements (No AI Experience Needed)Weekly payouts + remote work: The developer opportunity you've been waiting for!The flexible tech side hustle paying up to $50/hourAPPLY NOWHi ,This week’s stack is sharper, more secure, and increasingly self-aware. Angular steps into its zoneless future, Remix opens its doors to the community, and the npm ecosystem gets another wake-up call, this time from polymorphic malware. The AI conversation turns introspective, with Claude getting smarter (but secretive).Here's your tl;dr:🧠 Angular 20 lands – defer blocks, zoneless rendering, and performance-first updates.🛡️ npm malware alert – your config files and SSH keys are at risk.🧱 Remix grows up – governance, RFCs, and a steadier contributor experience.🌀 Anthropic Ends Windsurf’s Claude Access in Strategic Move Against OpenAI – no more direct access.🧰 Node doubled down – Config cleanup and smarter await? We’ll take it.📈 2025 dev forecast – AI, ethics, edge-native roles, and framework face-offs.Also worth your time: Learn React Hooks, 2nd Edition dropped, just in time for React 19. Custom hooks, cleaner state logic, and the end of class components; this one’s your upgrade guide.Got a tip or take? Send it our way and you might see it featured in WebDevPro!Advertise with usInterested in reaching our audience? Reply to this email or write to kinnaric@packt.com.Learn more about our sponsorship opportunities here.A better way to handle vendor security reviews?If you've ever dealt with vendor onboarding or third-party cloud audits, you know how painful it can be: long email chains, stale spreadsheets, and questionnaires that don’t reflect what’s actually happening in the cloud.We recently came across CloudVRM, and it’s a refreshingly modern take on the problem.Instead of asking vendors to fill out forms or send evidence, CloudVRM connects directly to their AWS, Azure, or GCP environments. It pulls real-time telemetry every 24 hours, flags misconfigs, and maps everything to compliance frameworks like SOC 2, ISO 27001, and DORA.It’s already being used by banks and infra-heavy orgs to speed up vendor approvals by 85% and reduce audit overhead by 90%.Worth checking out if you're building or maintaining systems in regulated environments, or just tired of spreadsheet security.Watch the demoLatest news: what's new in web development? 🧑‍💻 Frameworks leveled up, malware took aim, and AI stirred the pot (again). Here's what the web dev world chewed on this week.🧠 Angular 20 launches with smarter builds and zoneless progress: Angular’s latest update is all about performance and clean code vibes. With new defer blocks for surgical lazy loading and a move toward a zoneless future (yes, finally), it’s clear the Angular Renaissance isn’t just marketing.🟢 Double Node.js release day: config gets cleaner, await using expands: Node.js dropped not one but two updates recently. Version 22.16.0 introduces experimental support for node.config.json, paving the way for simpler, centralized project configs. Meanwhile, 24.1.0 builds on await usingsupport, pushing Node deeper into structured resource management territory. 🔗22.16.0 release notes🔗24.1.0 release notes🌀 No More Claude for Windsurf; Anthropic Protects Its Models from Rival Ecosystem: Claude now browses the web, but if you were hoping to peek behind the curtain, tough luck. Anthropic says its Windsurf stack won’t be shared, especially not with OpenAI. “Odd,” they said. Strategic, we read between the lines.🛡️ Node.js devs under fire; npm malware strikes again: Installing random npm packages without reading the docs? What is this, the wild west of 2015?A new polymorphic malware campaign is harvesting sensitive files from Node environments. Your .npmrc and SSH keys are not safe. Audit those dependencies or risk getting owned. Literally.📢 Remix opens up: new governance, more community control: Remix is going full open-source adulting. The framework now has RFCs, working groups, and a governance model that invites more voices to the table. Translation: fewer surprises, more stability, and maybe fewer tweets from angry contributors.Expert corner: what's the web community talking about?🎙The dev community’s looking ahead: Some cloning apps for fun, others predicting frameworks, ethics, and AI identity crises. 2025’s shaping up to be less about syntax, more about choices. And yes, vibe shifts included.🎥 CLI? GUI? Try LLM: Viktor Farcic demonstrates how AI can streamline interactions with IDPs. More intuitive than GUIs, more powerful than CLIs. From querying databases to spinning up infrastructure, we're heading toward a prompt-first future.🔭 The 2025 web dev forecast: AI, edge, and... ethics?: Expect more AI, fewer servers, and a rising need for ethical tech decisions. It’s a future full of promise and job titles that don’t exist yet. Edge-native empathy engineer, anyone?🧱 Framework face-off: what to keep an eye on in 2025: From React’s continued dominance to the rise of Qwik and Astro, the framework battlefield is getting crowded. The message? Choose wisely or you’ll be explaining your pick in every team meeting for the next year.🌀 Stack Overflow’s AI gamble and the dev identity crisis: Stack Overflow is leaning hard into AI to stay relevant, but in doing so, it might be redefining what it means to be a “developer.” Is AI the new stack, or just another tool in the belt? Existential crisis loading...📈 Web trends devs can’t ignore in 2025: Think accessibility-first, no-code/low-code evolution, and AI-as-co-pilot. TL;DR: If your stack isn’t flexing with user-centric design, you might be the bottleneck.Packt catalogue plus a bonus excerpt📚📘 Learn React Hooks, 2nd Edition by Daniel BuglReact 19 is here, and with it comes a sharper, cleaner, more powerful Hooks story. If you’re still reaching for useStateand calling it a day, this book is your next upgrade.Author Daniel Bugl walks you through everything, from building your first Hook-based app to writing custom Hooks, handling form actions, and replacing class components like it’s 2018 calling.Grab your copy!About the authorDaniel Bugl is a full-stack developer, product designer, and entrepreneur specializing in web technologies. He holds a BSc in business informatics and an MSc in data science from TU Wien. A contributor to open source and an active React community member, he founded TouchLay, a hardware/software startup helping businesses showcase their offerings. He’s also served as a technical advisor and full-stack dev for large enterprises and the Austrian government, building citizen services and more.Here’s an excerpt from the book that shows how to make state shareable, clean, and debounced, using a custom Hook that syncs with the URL without spamming history.Creating the Debounced History State HookLet’s now get started extracting the code from the CreatePost component into a DebouncedHistory State Hook:1. Copy the Chapter12_3 folder to a new Chapter12_4 folder by executing the following command: $ cp -R Chapter12_3 Chapter12_42. Open the new Chapter12_4 folder in VS Code.3. Create a new src/hooks/debouncedHistoryState.js file.4. Inside it, import the following: import { useState, useEffect } from 'react' import { useDebouncedCallback } from 'use-debounce' import { useHistoryState } from '@uidotdev/usehooks'5. Define a function that accepts an initial state and a timeout value for the debounce: export function useDebouncedHistoryState(initialState, timeout) {6. Now, define the History State Hook: const { state, set, undo, redo, clear, canUndo, canRedo } = useHistoryState(initialState)7. Next, define a State Hook for the actively edited content: const [content, setContent] = useState(initialState)8. Then, define a Debounced Callback Hook that will set the value of the History State Hook: const debounced = useDebouncedCallback((value) => set(value), timeout)9. Add the Effect Hook that we had before in the CreatePost component: useEffect(() => { debounced.cancel() setContent(state) }, [state, debounced])Remember, this Effect Hook is used to sync the History State back into the actively editedcontent state, meaning that it will change the content of the textbox whenever we triggerthe undo, redo, or clear functionality.10. Now, define a handler function which sets the content state and starts the debouncedcallback: function handleContentChange(e) { const { value } = e.target setContent(value)debounced(value)}11. Finally, return all the values and functions we need from the Hook:return { content, handleContentChange, undo, redo, clear, canUndo,canRedo }}We now have a drop-in replacement for the Debounced History State functionality, which is used in the CreatePostcomponent, so let’s implement it!AI in the spotlight 🔦🤖 Even Sundar Pichai’s vibe-coding nowVibe coding? You know it, you’ve seen it, you might already be doing it. Now Sundar Pichai’s officially on board. The Google CEO revealed he’s been spending time riffing with AI tools, coding by description, not syntax. If the guy running Google is vibe-coding, safe to say it’s more than just a phase.Developer tip of the week 💡🛠️ Don’t sleep on SCIMIf you’re building anything that touches user management for enterprise clients, SCIM (System for Cross-domain Identity Management) isn’t just a nice-to-have, it’s table stakes. This spec handles user provisioning, deprovisioning, and role updates automatically via APIs. Translation: no more janky sync scripts or angry IT teams. It’s the kind of protocol you won’t notice... until you desperately need it. Learn it before your biggest customer asks why you don’t support it.Keep a dev journal🌿Logging your daily wins, bugs, and lessons isn't just for retros, it's for you. A dev journal helps you track progress, spot patterns, and level up faster.Get started:📘 You should keep a developer’s journal – Stack Overflow🛠️ Flow by Invide – Minimalist dev journaling tool📋 Developer Brain Template – Notion MarketplaceStart small: jot down a few bullet points at the end of each day. Your future self will thank you!And that's a wrap 🎬Not every week reshapes your workflow but this one nudged the edges. From vibe-coding going mainstream to frameworks tightening up, and protocols like SCIM reminding us the boring bits still matter.Until next time, build thoughtfully.Cheers!Kinnari Chohan,Editor-in-chiefSUBSCRIBE FOR MORE AND SHARE IT WITH A FRIEND!*{box-sizing:border-box}body{margin:0;padding:0}a[x-apple-data-detectors]{color:inherit!important;text-decoration:inherit!important}#MessageViewBody a{color:inherit;text-decoration:none}p{line-height:inherit}.desktop_hide,.desktop_hide table{mso-hide:all;display:none;max-height:0;overflow:hidden}.image_block img+div{display:none}sub,sup{font-size:75%;line-height:0}#converted-body .list_block ol,#converted-body .list_block ul,.body [class~=x_list_block] ol,.body [class~=x_list_block] ul,u+.body .list_block ol,u+.body .list_block ul{padding-left:20px} @media (max-width: 100%;display:block}.mobile_hide{min-height:0;max-height:0;max-width: 100%;overflow:hidden;font-size:0}.desktop_hide,.desktop_hide table{display:table!important;max-height:none!important}} @media only screen and (max-width: 100%;} #pad-desktop {display: none !important;} } @media only screen and (max-width: 100%;} #pad-desktop {display: none !important;} }