The latest wire

Vercel's September 17 update lets Harbor evaluation runs use Sandbox, placing each trial in its own Firecracker microVM. The integration supports Terminal-Bench and other benchmarks in Harbor's registry, with network rules enforced outside the VM. Optional firewall credential injection keeps secrets out of the sandbox. The integration requires Harbor 0.22.0 or later.

Vercel's September 17 skills CLI release adds Notion as an installation source for agent skills. Version 1.7.0 can install selected skill packs or a single Notion page, letting teams maintain skills in their existing workspace. Authentication uses the Notion CLI and requires workspace permission for personal access tokens. Notion page permissions determine which skills a user can see and install.

Sep 17, 14:00 UTC Resolved - Cloudflare is aware that there was an increased level of HTTP errors in the GIG (Rio de Janeiro) datacenter, between 14:00 and 14:30 UTC. This has since recovered and normal operations have resumed.

You can now delete one or up to 100 Workflow instances and their stored state via the Workflows API or Wrangler 4.125.0 and later. Deleting an instance frees its stored state and stops its current execution. Storage billing is based on the average daily peak. Delete one instance by calling delete() on its handle: const instance = await env.MY_WORKFLOW.get("instance-abc"); await instance.delete(); If a Workflow deletes its own instance, execution stops during await instance.delete(). Code after the call does not run. Delete multiple instances by calling deleteBatch() on the Workflow binding: const result = await env.MY_WORKFLOW.deleteBatch([ "instance-abc", "instance-def", ]); console.log(result.deleted); console.log(result.errors); The batch result contains { id } entries for successful deletions and per-instance errors. IDs that do not exist are returned as errors.

Vercel’s September Production Index reports that open-weight models processed 56% of AI Gateway tokens in August, while Anthropic accounted for 64% of estimated spending. A later update says GPT-6 Astra attracted more than twice Fable 5.1’s spending share over each model’s first twelve days. The figures describe gateway traffic, and spending uses published list prices rather than customers’ actual bills.

The rejectIfBusy option lets synchronous Workers AI inference requests fail when capacity is unavailable. Use it when your application should not wait in a capacity queue. Pass the option as the third argument to the Workers AI binding: const response = await env.AI.run( "@cf/google/gemma-4-26b-a4b-it", { messages: [{ role: "user", content: "Explain capacity queues." }], }, { rejectIfBusy: true }, ); const response = await env.AI.run( "@cf/google/gemma-4-26b-a4b-it", { messages: [{ role: "user", content: "Explain capacity queues."

Vercel's September 17 Marketplace update lets native integration resources connect to custom environments, beyond production, preview and development. Connections can be configured through the dashboard, CLI or API, and their environment variables are limited to the chosen environments. Existing deployments remain unchanged; a new deployment is required after connection changes. Custom environments require Pro or Enterprise.

Workers traces can now follow JavaScript RPC calls across Worker boundaries and into Durable Objects. Previously, a trace stopped at the caller's RPC boundary. The dashboard now shows the caller-side session and method calls alongside the callee invocation, nested calls, and callbacks into another Worker. A session span covers the lifetime of a caller-side session and groups calls that reuse it. Individual call spans show each method invocation. Execution colors distinguish the Workers or Durable Object entrypoints involved, while arrows mark outgoing and incoming calls. Together, these details show where time was spent, which calls reused a session, and how returned stubs and callbacks fit into the request.

Vercel added OpenAI’s GPT-Live 1 to AI Gateway for voice sessions that can listen and speak simultaneously. Applications can optionally delegate background work to a separately selected text model while conversation continues. The application remains responsible for permissions, confirmations and cancellation. Delegated requests are billed separately, and voice-session charges continue during that work; the integration requires AI SDK 7.

New Zealand's NCSC survey found rising concern about cyber exposure among smaller businesses, with medium-sized respondents reporting particularly high levels of threats or attacks. The findings also show gaps in staff training and incident reporting. These are survey results, not a measurement of every business; the agency urges firms to turn concern into routine protective action.

Customers using Cloudflare’s St. Louis facility may have encountered more HTTP 522 responses during a roughly 20-minute window on September 16, 2026. Cloudflare placed the affected period at approximately 16:35–16:55 UTC and marked the incident resolved in its 18:35 UTC update, after that reported window had ended.

Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention. Linux storage and permission fundamentals Before diving into the new Kubernetes features, let us briefly review the low-level Linux security mechanisms that make them possible. Bind mount flags When Linux mounts or remounts a directory, Virtual File System (VFS) flags control what actions are permitted on that filesystem: noexec: Do not permit direct execution of any binaries on the mounted filesystem. nosuid: Do not allow set-user-identifier or set-group-identifier bits to take effect.

Cloudflare investigated a problem potentially affecting .tn domain lookups through its 1.1.1.1 public DNS resolver on September 16, 2026. The company’s 15:08 UTC notice described the impact as potential, rather than confirming every lookup failed. It reported identifying the issue and implementing a fix at 15:23 UTC, then marked the incident resolved at 18:19 UTC.

Vercel's September 16 update reduces older deployment retention on Hobby projects, whose teams have 10 GB of deployment storage. Each project protects its three latest production deployments and three latest deployments overall; current production, aliases and active branches retain protections. If a team exceeds the limit, deployments outside those exceptions can be deleted immediately instead of waiting 30 days.

GitHub says an upstream capacity shortage disrupted Gemini 3.8 Flash in Copilot on September 16, 2026, from 04:40 to 11:45 UTC. Requests failed at an average rate of 6.4%, with the greatest impact during peak demand. Other models remained available. The historical incident was resolved after traffic eased and monitoring confirmed recovery; GitHub said it was working to improve resilience during demand peaks.

Vercel added Mem0 to its Marketplace in a September 16 update, offering persistent memory for agents and applications across sessions. Installation provisions a scoped project and API key, adds environment variables and consolidates billing on the Vercel invoice. The integration is available on every Vercel plan; Mem0 offers a limited free tier and a $20 monthly higher-volume plan.

Vercel reports that builds using Secure Compute or Static IPs begin 64% faster following its September 16 update. Its stated average wait fell from 6.7 to 2.4 seconds. Prewarmed containers now receive the required network configuration when the build starts, replacing a fresh container boot. Vercel says the change applies automatically without configuration changes.

Cloudflare investigated elevated HTTP 5XX errors in an incident labeled as network performance trouble in Los Angeles on September 16, 2026. Its first notice appeared at 02:03 UTC. The company said a fix had been implemented and moved to monitoring at 03:44 UTC, before marking the incident resolved at 16:23 UTC.

Cloudflare’s support portal and live chat became unavailable during a helpdesk provider outage on September 16, 2026. The company warned that customers could struggle to submit or view tickets and face delayed responses. Emergency phone support remained available for P1 and emergency cases, but could also be slow. Cloudflare reported a fix at 13:34 UTC and resolution at 14:58 UTC.

Mistral and Mozilla announced that Firefox Smart Window, currently in beta, uses Mistral models to assist browsing and interpret information from open tabs. Initial coverage includes France and North America, with the UK and Germany expected later in 2026. The companies say conversations are not stored on Mozilla’s servers by default and that Mistral agrees to zero data retention for this partnership.

Cloudflare reported delayed notification emails for some customers on September 16, 2026, while saying webhook and PagerDuty notifications were unaffected. Its status notice opened an investigation at 08:33 UTC and marked the incident resolved at 08:50 UTC. The reported issue concerned dispatching email alerts, rather than a failure across every notification channel.

Vercel's September 16 Is Agentic update lets readers view audit checks by site type: content, business, app or commerce. Each view emphasizes different requirements, such as checkout standards for commerce or authentication for apps. Switching views does not change the score or require a rescan. A page metadata setting selects the default view; otherwise, the service infers one.

TypeSafe AI’s Jev is available through Vercel AI Gateway for applications that need structured decisions rather than generated prose. It evaluates multiple questions in parallel and returns choices, scores or boolean probabilities. AI SDK 7 exposes it through an experimental evaluation API. The announcement recommends calibrating confidence against labeled workflow examples; callers can request Zero Data Retention and No Training options.

Cloudflare's September 16 update lets Python Workers connect to PostgreSQL and MySQL through Hyperdrive. Its linked setup guide requires a compatibility date of September 8, 2026 or later and recommends asyncpg for PostgreSQL and aiomysql for MySQL. The guide also identifies a limitation: synchronous SQLAlchemy ORMs are supported, but asynchronous SQLAlchemy ORMs are not yet supported.