The latest wire

Vercel's Marketplace database browser now supports both Redis and Upstash for Redis integrations. Team owners can execute commands, inspect values and browse keys from the dashboard, including filtering by type or pattern and checking expiration metadata. The command tab also supports transactions. Access to these new browser and CLI tabs is currently restricted to members with the Owner role.

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Workers Metrics charts now show every release in the selected time range, including the full progression of gradual deployments. This makes it easier to correlate changes in memory, CPU time, errors, or latency with the code that was serving traffic. A gradual deployment appears as a single rollout across the chart, with shading that increases as more traffic moves to the new version. Hover over a rollout to see the previous and new versions, the rollout duration, and the traffic percentage configured at each step. Use these annotations to: Find when a regression started — See which traffic percentage was configured when errors, latency, CPU time, or wall time changed. Compare rollout stages — Check whether a metric changed as more traffic moved to the new version.

Supabase's rollout of PostgreSQL 15.19 and 17.11 brings security fixes alongside compatibility changes that may require database maintenance. The notice identifies affected ltree and btree_gist indexes, legacy pgcrypto PGP ciphers, and custom operators using nonstandard selectivity estimators. It provides detection queries and migration steps; impact depends on those features being used. Dashboard upgrades and new-project versions became available September 28, according to the rollout schedule.

Supabase is introducing usage-based log pricing, with ingestion measured by data volume and query allowances linked to ingestion. The soft launch includes a grace period through early 2027 before limits are enforced, giving teams time to inspect and reduce logging. Supabase describes quieter platform defaults and configurable Postgres logging as ways to manage volume; upcoming Studio warnings are informational during that period.

Cloudflare Browser Isolation users could encounter a browser-storage error and need to sign back into web applications during a September 24 session-sync incident. The company said browsing remained available despite the synchronization problem. It began monitoring a fix at 17:28 UTC and marked the incident resolved at 22:37 UTC.

Sep 24, 22:34 UTC Resolved - The impacted backend has been redeployed, and all related services should now be back up and running. There may be some increased latency as they continue to come online.

Sep 24, 20:52 UTC Resolved - This incident has been resolved. Sep 24, 19:54 UTC Monitoring - Queue levels & latency are returning to normal Sep 24, 17:33 UTC Monitoring - Customers may experience delays starting Cloudflare Workers builds.

GitHub says about 1,700 users encountered errors or delays while adding or changing billing addresses during a resolved September 22-24, 2026 incident. An operating system upgrade exposed an HTTP client adapter incompatibility that stalled address-validation requests. Switching the HTTP client mitigated the problem at 20:24 UTC on September 24. GitHub also reported new alerts and plans to extend the fix to other integrations.

EFF argues that restricting the sale of personal data would leave important advertising harms unresolved. Citing reporting about DraftKings, it describes how betting histories can inform AI-driven promotions without relying on outside data brokers. The organization uses the example to advocate stronger limits on behavioral advertising, including uses of information collected directly from customers.

Updates to Cloudflare Access applications and policies were delayed during a September 24 incident, but the company said authentication and enforcement of policies continued normally. Engineering reported the configuration problem at 15:20 UTC and began monitoring a fix at 15:31 UTC. Cloudflare closed the incident at 18:25 UTC; the reported effect concerned changes taking effect rather than a failure of existing access controls.

Google has added Live Avatar to Gemini 3.8 Live in Gemini Enterprise, pairing conversational audio with generated video. The feature can continue dialogue while tools run in the background and, according to Google, supports synchronized speech and expressions across 97 languages. Preset avatars are available, while custom avatar creation requires enterprise allowlisting; generated audio and video carry SynthID watermarks.

Mandiant’s new software supply-chain guidance covers developer workstations, repositories and build infrastructure as connected security boundaries. It describes attacks involving trusted tools, stolen development credentials and manipulated CI/CD workflows. Recommended controls include approved IDE extensions, short-lived credentials, protected branches, pinned dependencies and isolated development environments, with human review of AI-generated code and continuous verification across the delivery process.

Cloudflare said customers bringing their own IP addresses temporarily could not change BGP prefixes, including starting or withdrawing advertisements. Its September 24 resolution notice also acknowledged possible delays to address-map changes. The company opened the investigation at 10:22 UTC and marked it resolved at 10:25 UTC, without giving a separate start time for customer impact.

Vercel has combined its private and open-source bug bounty programs into one public program on HackerOne. The company says the unified route covers its platform and open-source projects, with exact testing scope and rules listed on HackerOne. Existing submissions to the former open-source program remain under review and do not need to be filed again.

GitHub's resolved September 23-24, 2026 incident disrupted app installation, organization creation and membership changes, while Projects showed delayed labels and stale search results. GitHub traced the failures to database maintenance and replica recovery problems in Azure Central US. API errors were mitigated at 10:58 UTC on September 23; clearing the Projects backlog took until 04:55 UTC the next day. GitHub says it is strengthening maintenance and recovery safeguards.

A Vercel customer case study says Klaviyo employees deployed 356 internal apps during a two-week citizen-developer program. Its K:Forge pipeline creates repositories, deploys applications and applies shared access controls, including Okta sign-in and private connections to company databases. The account describes platform engineers completing and reviewing more complex builds, so the reported adoption figures do not imply every application was delivered without engineering involvement.

De multiples vulnérabilités ont été découvertes dans LibreNMS. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Vercel Connect now supports TanStack AI agents calling OAuth-protected MCP servers. A new transport adapter obtains authentication through Connect before each request, handling token freshness without applications storing or rotating those credentials. If a user has not granted access, client creation raises a consent challenge before the model runs, allowing the application to redirect the user to the authorization flow.

CERT-FR warns that CVE-2026-70125 can allow remote code execution in Microsoft Office. Its affected-product list includes Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, in both 32-bit and 64-bit editions. The September 24 notice directs administrators to Microsoft's security update guide for the vulnerability's product-specific fixes.

De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

You can now declare the Workflows a Worker defines in the exports field of your Wrangler configuration file. Previously, a Worker could only define a Workflow through a workflows binding, even when the Worker never called the Workflow itself. Key each entry by the name of the class that extends WorkflowEntrypoint: { "exports": { "MyWorkflow": { "type": "workflow", "name": "my-workflow", "limits": { "steps": 25000, }, "schedules": ["0 * * * *"], }, }, } [exports.MyWorkflow] type = "workflow" name = "my-workflow" schedules = [ "0 * * * *" ] [exports.MyWorkflow.limits] steps = 25_000 A workflow export accepts the same settings as a workflows binding: limits, schedules, and default_retention. When you run wrangler deploy, Wrangler creates or updates the Workflow with these settings. You can declare a Workflow as both a binding and an export.

CERT-FR has flagged multiple security issues affecting Zabbix Agent2 releases earlier than 7.0.31. Its September 24 notice references the vendor's ZBX-28059 bulletin for fixes but does not describe the vulnerabilities' impact. The affected-product scope is specifically Agent2; the advisory does not identify a separate Zabbix Server version range.