Agent-written code is now outrunning the infrastructure and the budgets behind it.

GitHub reports 7.4 billion commits a month and 4 million more CPU cores to absorb them, Alphabet fell more than 10% on a free-cash-flow miss, and Microsoft trimmed its capex forecast while blaming GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ delivery delays. Security stays loud in the background: PHP2Shell is now rooting firewalls and a GitLab fix turns out to need a Ruby upgrade too.

TLDR

• Alphabet drops more than 10% after a free-cash-flow miss while Microsoft trims its capex forecast to $170 billion (Oct 28); both blame capacity timing, not demand. Business Infra
• GitHub says it now sees 7.4 billion commits a month and added 4 million CPU cores to keep up (Oct 28), with agents starting over 40% of pull requests. Production Agents
• PHP2Shell (CVE-2026-109618) is rooting firewalls: Palo Alto confirms attacks on exposed management interfaces (Oct 28-29). Security
• Google DeepMind ships Gemini 4 Carbon two weeks after Argon, gated to selected security experts at first (Oct 28). Agents Security
• GitHub makes Copilot Fusion generally available and bundles Copilot into GitHub Enterprise with pure metered billing (Oct 28). Pricing Agents

Upcoming Deadlines

Date	What	Who it hits	Do this	Source
Sat Oct 31	Mistral retires zai-glm-5-2 (changelog Oct 22)	Callers of that model	Move to zai-glm-5-3, same price	Mistral
Sat Oct 31	OpenAI Evals goes read-only (Evals platform, Agent Builder and v1/prompts shut down Nov 30)	Teams with saved evals	Export evals before Oct 31	OpenAI
Sat Oct 31	DeepSeek free Search/Fetch tool promotion ends 4:00 PM UTC	DeepSeek API users	Budget $0.75 per 1K calls after	DeepSeek · DeepSeek news
Sat Oct 31	Mistral promises Large 4 open weightsA model whose trained weights are published for anyone to download and run.NTIA ↗ by end of October (VentureBeat reported Oct 27)	Teams planning to self-host Large 4 (1.05T total, 52B active)	Plan hardware and license review; the API preview is live now	Mistral · VentureBeat
Wed Nov 4	Moonshot promises Kimi K3.1 Pro full open weights (The Decoder, Oct 23)	Self-hosters of open models	Line up an eval; read the license	The Decoder
Mon Nov 9	SEC roundtable on machine-understandable data and "Super Intelligence"	Public-company and data teams	Watch for stream	SEC
Tue Nov 10	CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗ KEVKnown Exploited VulnerabilitiesCISA's list of vulnerabilities with reliable evidence of active exploitation and a clear fix, used to set patching priority.CISA ↗ federal patch deadline for Brotli CVE-2026-111497 (Node2Shell)	Anyone running Node.js, .NET, Bun, Envoy or other servers with a vulnerable Brotli decoder	Patch Brotli-dependent runtimes and proxies; confirm transitive copies	BleepingComputer
Thu Nov 12	Rust 1.100 stabilizes Cargo minimum publish age (dependency cooldown, off by default; Socket, Oct 20)	Rust teams	Set a cooldown in Cargo config	Socket
~Thu Nov 12	OpenAI's proposed end of model access in Cursor (official date not confirmed; Cursor may end it sooner)	Cursor users on OpenAI models	Check Cursor terms	OpenAI

Action Items

1. Take firewall, VPN and gateway management interfaces off the public internet this week, and upgrade any PHP you run to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP2Shell is being exploited against exposed management interfaces and chained with Linux kernel bug CVE-2026-46300, which CISA has listed as exploited.
2. Upgrade Cisco ASA and FTD to a fixed release now (for example ASA 9.20.4.50 or FTD 7.4.9) if any tunnel group uses secondary authentication on SSL VPN. CVE-2026-76418 is exploited and crashes the device.
3. If you run GitLab on your own Ruby, upgrade Ruby to 3.3.13, 3.4.12 or 4.0.9 and GitLab to 19.3.6. GitLab alone does not close CVE-2026-97229. Rebuild images that use a standard Ruby.
4. Upgrade vLLM to 0.32.0 on any host started with --mm-processor-cache-type shm, and keep Ghostscript off vLLM image-serving hosts. Both advisories below are high severity.
5. Revoke, not delete, any Alibaba Cloud, DeepSeek, Zhipu or OpenAI key that was ever pushed to a public repository, Gitee included. Rewriting history does not invalidate a key.

Models & Tools

• Google DeepMind releases Gemini 4 Carbon, two weeks after Argon (Oct 28) Agents Security Carbon scores 59 on Artificial Analysis Intelligence Index v5 (Argon: 50) and 59 on its Coding Agent Index, still behind Claude Opus 5.5 at 62. Google says internal teams ran it for days on engineering tasks. Because of its cyber capability it goes through voluntary US government pre-testing and starts with selected security experts. Pricing matches Argon. (The Decoder)
• GitHub Copilot Fusion is generally available: one picker entry that routes and orchestrates models per task (Oct 28) Agents Pricing GitHub reports Fusion Max scored 60 on the Artificial Analysis Coding Agent Index, within two points of Claude Code with Opus 5.5 Max, at about half the average API cost and 40% less time per task. Those are GitHub's figures. It also picks models mid-task, so per-model cost tracking gets harder. (GitHub | The New Stack)
• Android Studio Rabbit 2 lets 40+ outside coding agents run in the IDE through the Agent Client Protocol (Oct 28) Agents Open Source "Bring Your Own Agent" runs Claude Agent, Codex and Google Antigravity side by side with access to project structure, the emulator and Logcat. Google also opened a Connected Apps Platform that registers MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ servers with Search and Gemini, in US beta. (The Decoder | The New Stack)
• Nvidia releases Nemotron 3.5 Transcribe, an open promptable speech model with 4 billion active parameters (Oct 28) Open Source The 30-billion-parameter model transcribes 40 languages, translates 31 to or from English, labels speakers in 13 and runs on a single GPU. Nvidia also published Granary v2, 844,000 hours of audio. Benchmark rankings are Nvidia's own. (The Decoder | Hugging Face)
• Cloudflare opens a beta Web Search API in AI Gateway with Ceramic.ai, Exa and Linkup as providers (Oct 29) Agents Infra Search calls get the same logging, access controls and billing as model calls, with bring-your-own provider keys. Cloudflare's argument is that agents guess URLs and hit 404s. The practical gain is one audit trail for model and search spend. (InfoQ)

APIs & Pricing

• GitHub Enterprise now includes Copilot for every licensed user, with no included AI credits (Oct 28) Pricing Available through a GitHub or Microsoft account team, with self-serve rolling out in stages. Usage is metered from the first request against your enterprise budget. Users without an Enterprise license get Copilot Standalone at $10 per user per month. Completions keep working at zero budget; chat, code review and cloud agents need budget. Set enterprise budget alerts before turning it on. (GitHub)

Security

• PHP2Shell (CVE-2026-109618) is rooting firewalls: Palo Alto confirms attacks on exposed management interfaces (Oct 28-29) Security Critical · CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.2 · Exploited in the wild · Patched in PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 Update to the Oct 26 coverage. Dream says a China-nexus actor found 19,000 firewalls via FOFA, chained PHP2Shell with Linux bug CVE-2026-46300 and rooted 25 servers, including a US government-affiliated network. (The Hacker News | SecurityWeek)
• Cisco ASA and FTD flaw CVE-2026-76418 is exploited to crash SSL VPN devices (Oct 28) Security High · CVSS 8.6 · Exploited in the wild · Fixed in ASA 9.16.4.104 through 9.24.1.27 and FTD 7.0.11 through 10.1.1 An unauthenticated request triggers a reload when secondary authentication is configured on a tunnel group. Cisco gave no timing or actor. It is the second exploited Cisco firewall VPN zero-dayAn attack using a flaw that was unknown before it was exploited.NIST ↗ since August. (The Hacker News | SecurityWeek)
• Alpine Linux's GitLab was probed with CVE-2026-97229; upgrading GitLab alone did not fix it (Oct 28) Security Critical · CVSS 10.0 · Exploited in the wild: Attempted, success not ruled out · Patched in GitLab 19.3.6 plus Ruby 3.3.13 / 3.4.12 / 4.0.9 The fix ships inside GitLab's own packaged Ruby. Alpine ran standard Ruby, so its 22 October upgrade left it exposed, and it rebuilt the server. (The Hacker News)
• CISA lists VMware ESXi CVE-2026-41709, a "low severity" logging bug used as a zero-day (Oct 28) Security Low (vendor rating) · CVSS: not stated in coverage · Exploited in the wild · Fixed in ESXi 9.1.0.0-25370933, 9.0.2.0100-25595025, 80U3j-25429389 and newer CrowdStrike says China-nexus actor Warp Panda used it at US organizations, including law firms: an admin could act without leaving log entries. Scanners that rank by severity will bury it; patch on exploitation status. (SecurityWeek | NVD)
• vLLM advisories: forged shared-memory handles reach pickle.loads(), and EPS uploads can reach Ghostscript (Oct 28) Security Infra High · CVSS: not yet assigned (scanners may stay silent) · Exploitation unknown · Fixed in vLLM 0.32.0 (shared-memory flaw); fix version for the EPS flaw not stated GHSA-6757-hggm-hp2w needs --mm-processor-cache-type shm and an authenticated caller. GHSA-h3rc-j82p-2c3h was reproduced at the loader level in 0.30.0 and needs a vulnerable Ghostscript. (GitHub Advisory | GitHub Advisory)
• 26,400 working cloud and AI credentials found in public Gitee repositories (Oct 28) Security Data High · CVSS: not applicable (no CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗) · Exploitation unknown · Fix: revoke and rotate keys A researcher scanned 7.25 million repositories with TruffleHog and Kingfisher and kept only keys that authenticated: 9,473 Alibaba Cloud AccessKey pairs, 3,170 DeepSeek and 1,348 OpenAI keys among them. He had not confirmed revocations when he published. (The Hacker News)

Industry & Business

• Alphabet falls more than 10% on a free-cash-flow miss; Microsoft cuts its capex forecast to $170 billion (Oct 28) Business Infra Alphabet reported negative free cash flow of $9.07 billion, search growth of about 12% against 15% expected and $51.4 billion of quarterly capex, with 2027 spending to rise significantly. Microsoft trimmed its forecast from $175 billion and said third-party GPU delays push some capacity to the first half of 2027. Neocloud stocks fell. (CNBC | CNBC)
• Microsoft discloses Azure revenue of $33.2 billion and $10 billion from OpenAI in one quarter (Oct 28) Business Azure grew 48%; Google Cloud, at $30.7 billion, roughly doubled. Revenue from OpenAI arrangements, including revenue share, was nearly 11% of Microsoft's $92.3 billion quarter, with $7.2 billion in receivables. Budget for both vendors' prices to follow their capex posture. (TechCrunch | TechCrunch)
• Anthropic's S-1 shows under a third of its $8.9 billion first-half compute bill went to serving customers (Oct 29) Business Infra Update to the Oct 27 coverage. Serving cost was $2.4 billion against $16.3 billion of revenue; most compute went to training and internal use. Tom's Hardware estimates about $800 billion of further compute commitments. Anthropic also launched spend-reporting tools and pooled team budgets. (Tom's Hardware | TechCrunch)
• Oracle will offer Google TPUsTensor Processing UnitGoogle's custom chip built to speed up machine learning, especially large matrix operations.Google Cloud ↗, the first time customers can use them outside Google's infrastructure (Oct 28) Infra Business Announced a day before earnings. Google opened TPUs to outside data centers in the second quarter; TD Cowen models $62.5 billion in TPU sales for 2027. Those are analyst estimates. A second accelerator source is a negotiating lever for capacity buyers. (CNBC)

AI in Production

• GitHub says commits reached 7.4 billion in September and agents now start over 40% of pull requests (Oct 28) Production Agents Commits ran at 1.4 billion a month in April and 2.9 billion in August. GitHub added 4 million CPU cores, 160 PB of storage and 50 Tb/s of network capacity this year and is separating compute from storage. Expect heavier CI load and slower queues on shared runners. (The New Stack | Tom's Hardware)
• Anthropic's Claude Code team says nobody needs a full mental model of the codebase; practitioners push back (Oct 29) Production Agents The team says Claude writes about 90% of Claude Code and its monorepo went from roughly 2,500 merged changes a day in May to over 30,000 in September. It aims for most PRs to merge with one human. One CLI PR went through 50+ review rounds overnight, so it capped rounds. (InfoQ)
• Amazon tells engineers to stop "tokenmaxxing" and judge AI by long-term outcomes (Oct 27) Production Hiring Updated guidelines say adoption rates, tokenA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ counts and code-change counts become "deeply flawed" once they are targets. Amazon still says AI will be central to software engineering. It suggests comparing the teams using AI least and most. If your dashboards reward usage, expect the same gaming. (Tom's Hardware)

Benchmarks & Evals

• Artificial Analysis Index v5 widens the open-versus-closed gap from 3 points to 12 (Oct 28) Research Open Source 60% of the index now uses private test sets. Kimi K3.1 Pro falls from fourth to ninth and Grok 4.7 loses 12 points. Nathan Lambert argues RLReinforcement learningTraining by trial and error, where the model takes actions and adjusts based on the rewards it gets.Kaelbling et al. 1996 ↗ environments that resemble benchmarks also matter. Re-check any model choice made on v4 rankings. (The Decoder)