The latest wire

YARA-X 1.21.0 can accept scan targets from standard input through the command-line --scan-list option, according to SANS handler Didier Stevens. His Windows example pipes a generated directory list into the scanner, allowing a rule set to run against selected folders. Stevens reports five improvements and four bug fixes in this release.

Oct 3, 08:54 UTC Monitoring - A fix has been implemented and we are monitoring the results. Oct 3, 05:54 UTC Investigating - Cloudflare is aware of and investigating an issue with Cloudflare Workers build failing to start.

GitHub says its stateless installation-token rollout is complete: newly issued GitHub App tokens now default to the longer format, roughly 520 characters rather than 40. Permissions, repository access scope and the one-hour lifetime are unchanged. Integrations must accommodate longer opaque tokens. GitHub will stop honoring the temporary X-GitHub-Stateless-S2S-Token header on November 30, 2026; existing tokens remain valid until expiration.

Cloudflare marked an incident affecting CDN configuration changes and dashboard-issued cache purges resolved at 21:57 UTC on October 2. The provider said configuration changes were affected across dashboard, API and other interfaces, while purge calls sent through the API were unaffected. Its notice lists a 21:46 UTC start and does not identify the underlying cause.

GitHub now lets users request Copilot code reviews through REST or GraphQL and choose an effort level per request. The features are generally available on Pro, Pro+, Max, Business and Enterprise plans. Balanced became the Default effort level on September 28, 2026, for both existing and new repositories and organizations; explicitly configured Lite settings remain unchanged. Administrators and individuals can still adjust their review settings.

AI21 says it reduced waiting time for high-priority training jobs from up to 72 hours to 12 by adopting Kueue scheduling on its shared GKE GPU fleet. The customer report describes fair admission ordering and topology-aware placement across A3 and A3 Ultra instances using NVIDIA H100 and H200 GPUs. AI21 reports fewer manual interventions and less fragmentation, while saying its total reserved-fleet cost stayed unchanged.

GitHub deprecated Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code and Claude Opus 4.7 across all Copilot experiences on October 2, 2026, including chat, edits, agent modes and completions. Its suggested replacements are Gemini 3.8 Flash for both Gemini models, Kimi K3 and Claude Opus 5.5, respectively. Copilot Enterprise administrators may need to enable replacement models through policy settings; removing the deprecated models requires no action.

An update for kernel is now available for NVIDIA for RHEL 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

In its September 28-October 2 roundup, Google Cloud highlights storage-management guidance, an Apigee X blueprint that routes AI requests by complexity, and a new agent-evaluation session. Google describes pairing standardized traces with model-based judges and deterministic checks to detect quality regressions. The roundup also points to storage operations using Storage Intelligence Advisor and Batch Operations, and advertises an Agentic Data Cloud event for November 4.

Google Cloud has made Spanner queues generally available, letting applications commit database changes and queued tasks together in one transaction. Messages support delayed delivery, SQL consumption and transactional acknowledgments for agent handoffs and other asynchronous workflows. Google specifies at-least-once delivery and at-most-once acknowledgment. External calls still need safeguards such as the idempotency key used in Google's example.

Cloudflare reports that network performance in Seoul, South Korea, degraded between 17:11 and 17:22 UTC and has returned to normal after mitigation. The notice labels the incident resolved but displays inconsistent start and resolution timestamps, so the exact chronology remains unclear. It provides no explanation of the cause or details of affected customers.

Google Cloud is previewing CPU startup boost for GKE, which temporarily increases container CPU requests and lowers them after readiness without restarting the container. It requires GKE 1.36.0-gke.4447000 or later; Standard clusters need Vertical Pod Autoscaling enabled, while Autopilot enables it by default. Boost policies support multipliers or fixed additions, and Autopilot workloads must still satisfy CPU-to-memory ratios.

Google's September AI roundup pairs new Gemini models with wider app integrations. The company says Gemini 4 Argon has a million-token context window and is rolling out first to trusted cyber defenders through Fairwind, with broader access planned after feedback on safeguards. Other announcements include Gemini on Windows, more Connected Apps, and WeatherNext 3 forecasts integrated into Search, Gemini, Maps and Cloud.

CERT-EU's September threat review highlights stolen AI-service access and hijacked cloud workloads. Its roundup cites Google's reporting on LLM-jacking and Microsoft's account of passkey-themed phishing against Microsoft 365 users. It also covers spyware targeting civil society and alleged unauthorized AI-agent activity. The monthly report separates law-enforcement, espionage, cybercrime and AI developments across Europe and globally, drawing on attributed public reporting.

An update for freerdp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

EFF reports that Ecuador ordered security researcher and free-software developer Ola Bini’s deportation and imposed a ten-year reentry ban. The advocacy group says officials relied on a secret security report that his defense could not inspect, and that his lawyers sought habeas corpus protection. EFF says Bini was held at Quito’s airport awaiting departure for Sweden and urges authorities to explain the accusations.

GitHub has expanded its advisory GraphQL interface with CVE identifiers, affected source-code links, GitHub review dates, NVD publication dates and links to associated repository advisories. New severity and withdrawal filters let integrations narrow results before downloading them. GitHub says the additions reduce the need to switch to REST for advisory data; they are read-only changes that preserve existing queries.

GitHub now lets repository teams discuss vulnerability reports inside security advisories using comments restricted to users who currently have write access. Reporters and invited collaborators lacking that permission cannot read them or receive notifications; losing write access also removes visibility. Comment visibility cannot be changed after posting. GitHub says the feature covers public repositories with private vulnerability reporting enabled across its Free, Pro, Team and Enterprise Cloud plans.

GitHub has introduced a public preview of REST endpoints for reading, adding and editing repository advisory comments on public repositories. Access requires advisory visibility and appropriate repository security advisory permissions or token scopes; non-collaborators cannot read internal comments, and confidential comments are excluded. Comment deletion remains unsupported. Repository advisory responses now report non-confidential comment counts, letting integrations check for discussion before retrieving it.

Web Search API is now available in beta. Web Search API lets your AI agents and applications search the Internet and ground their responses in live information, instead of guessing URLs or relying on a model's training cutoff. At launch, you can choose between three search providers: Ceramic.ai, Exa, and Linkup. All three support Zero Data Retention for requests made through Cloudflare, and all have committed to Cloudflare's verified bot crawling standards. Web Search API runs through AI Gateway, so search requests appear in your gateway logs and are billed to your AI Gateway credits at each provider's list API price, with no additional markup. You can also bring your own provider API key.

An update for ruby is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for gawk is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for multiple packages is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for ghostscript is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.