Apache Software Foundation

Spark began as a research project at UC Berkeley in 2009 and was open sourced in early 2010.

It moved to the Apache Software Foundation in 2013, which is a nonprofit that hosts open source projects, and it has been maintained in public ever since.

The job Spark does is straightforward to describe.

When you have more data than one computer can handle, you split the work across many computers, then combine the results.

Sure.

Let's say our fully updated scanner finds a vulnerability in an Apache web server.

Walk us through how the SGP components containerize that data.

First up, how do the different tools even agree on what software is actually running?

CPE, got it.

Instead

of a human just randomly typing Apache Web Server or HTTPD into a box, CPE utilizes a really strict formatted naming structure.

It creates a machine-readable string.

Colibri released a new LLM two weeks ago.

Both are under the Apache Foundation.

So if you are tech-savvy enough, you could just run it locally.

It

It is designed to track the path a request takes through complex network architecture, telling the destination server exactly which intermediaries the traffic passed through.

The string traffic server refers to Apache Traffic Server, or ATS.

Okay.

ATS is a highly scalable open source proxy caching server primarily used by massive enterprise networks to manage internal and outbound routing.

We mapped out how a fleet of blind parallel agents bypassed CAPTCHAs by chaining proxy services.

Such a complex chain.

We traced Apache traffic server headers back to Tencent.

We explored how synthetic training data caused models to hallucinate their own identities.

Yeah.

Um, so for those of you who don't know what Community Over Code is, it is an open source conference formally or kind of informally known as Apache Con.

So the Apache Software Foundation, as many of you know, sponsors, uh, a lot of these really large projects as a nonprofit foundation, and they have an annual conference each year, uh, called Community Over Code.

Fun fact, it's one of my favorite names for a conference.

Like I just, I think it's just such a fantastic sentiment to, to have.

Uh, new releases in, you know, the AI world, so MLflow and Omnigent.

Uh, we'll be talking about Hudi, uh, very briefly as well.

Uh, and then also, uh, Apache Arrow 20, uh, 6.0, Delta Lake 4.4, and Unity Catalog, uh, 0.7.

You will now see an inline action button when you highlight text, allowing you to refactor queries, generate joins, or debug SQL logic on the fly.

If you are managing open data architectures, Apache Iceberg External Tables, Iceberg Managed Tables, and Iceberg Tables managed by the Lakehouse Runtime Catalog now support flexible column names by default in general availability.

Developers building applications on BigQuery will also appreciate that the native REST SDK is now GA, and the data engineering agent has added support for Gemini 3.7 Flash across global and multi-regional endpoints.

Turning over to Looker, the upcoming Looker 26.20 deployment schedule has been unveiled, rolling out across instances over the next few weeks.

Built on the open model context protocol, Federated Query lets Gemini Enterprise query operational and analytical data in place using each user's authenticated IAM identity, completely bypassing the need to copy or ingest data sets into separate storage.

When combined with the preview integration for Knowledge Catalog, the assistant gains read-only tools to automatically discover business and technical context securely.

Within the Gemini Enterprise Agent Platform workbench, the BigQuery JupyterLab plugin has been decoupled from the managed service for Apache Spark plugin.

It is enabled by default and can be disabled independently using the Disable BigQuery Instance Metadata key.

Now, let's get into our quick hits because we have a lot to talk about.

Apache fixed four strut flaws.

The serious one, CVE twenty twenty-six one oh four seven one one is an OGNL injection in the legacy RESTful action mapper that can lead to remote code execution affecting two point zero point zero through two point three point three seven, two point five point zero through two point five point dot thirty-three, and six dot zero dot zero through six dot eleven dot zero, and seven dot zero dot zero through seven dot three dot zero only when the OGNL allowlist is disabled.

The others are a denial of service, an unbounded REST plugin request body, and a cross-user data mixing.

All right.

We're gonna talk, uh, a few times about, uh, Libre here.

So this is the first, uh, cover here, which is the malicious spreadsheet can make LibreOffice and Apache OpenOffice run attacker code the moment it's opened with no micro warning by chaining an auto-refreshing database range to a remote file that loads a Java database driver.

It requires Java to be enabled on and, uh, is a proof of concept only.

All right, let's shift the gear here for a second.

And there's some advances, and we don't normally kind of talk about these folks all that much, but the Apache Software Foundation has a new project out.

And basically what they're trying to do is capture the semantic representations of data.

And this thing is called the Apache Aussie Project.