The latest wire

Vercel announced on September 3 that Cursor Cloud Agents can use Vercel Sandbox as their execution environment. Cursor still operates the agent and inference loop, while each request gets an isolated Firecracker microVM for repository work and tests. The reference architecture adds session monitoring, retries and cleanup through Vercel services. Access to Cursor's Self-Hosted Machines APIs requires a Cursor Enterprise plan.

CERT-EU's August review connects reporting on phishing, supply-chain compromise and attacks on trusted infrastructure. Examples include Microsoft 365 finance lures and remote-access footholds used to reach valuable systems. It is a retrospective synthesis of attributed open-source reporting, with links to the underlying accounts and their qualifications, rather than a new incident alert.

Vercel opened Basic build machines to Pro and Enterprise teams on September 3. Each provides two virtual CPUs and 8 GB of memory, aimed at smaller applications or agents with lighter build requirements. Vercel lists a price of $0.007 per build minute. New paid projects still default to Elastic machines; Basic can be selected in settings or with CLI 59.6.0 and later.

Kubernetes v1.37 includes API support for horizontal autoscaling of workloads down to zero replicas. This feature is now Beta and enabled by default. A HorizontalPodAutoscaler (HPA) that uses a suitable object metric or external metric can now scale a workload to zero replicas, then bring it back when the metric changes. Before v1.37, you needed an add-on or external component, or you had to enable the Alpha feature gate, to scale from zero. It is now part of core Kubernetes. Scaling to zero removes the last idle Pod from workloads such as queue consumers and batch processors. The savings are largest when each Pod reserves expensive resources, including dedicated CPUs or GPUs. The trade-off is cold-start time: the HPA must observe the metric, schedule a Pod, and start the application. This works well when work can wait in a durable queue.

Google announced Fairwind, a restricted program giving selected government agencies, Google Cloud customers and cybersecurity partners access to Gemini 3.8 Flash Cyber paired with CodeMender. Google says the combination can identify vulnerabilities and generate validated fixes inside customers' cloud environments. Initial access prioritizes critical infrastructure and major software platforms, with participation subject to operational security requirements; the capability claims come from Google.

Google introduced Gemini 3.8 Flash for coding and agent workflows alongside Flash Cyber, a security-focused variant restricted to trusted defenders through Fairwind. Google reports improved vulnerability detection and patching performance for Cyber. The general Flash model is available through developer and enterprise products, but Google notes complex tasks can consume more tokens. The announcement's benchmark and capability results are vendor claims.

Google introduced Fairwind on September 2 as a restricted program for government agencies, selected Cloud customers and cybersecurity partners. It combines Gemini 3.8 Flash Cyber with CodeMender to identify vulnerabilities and produce validated fixes, according to Google. Initial access prioritizes public-sector systems, critical infrastructure and core technology platforms. Participants must restrict tool access to internal security teams and apply safeguards including multi-factor authentication.

Vercel added .app and .dev to its Pro domain promotion on September 2. The offer covers one eligible, non-premium domain per team for the first year, alongside six previously supported extensions. The benefit ends after that year: Vercel says the domain renews automatically at the regular price displayed when it is claimed, so the offer does not remove future renewal costs.

Le 01 septembre 2026, SonicWall a publié un avis de sécurité concernant deux vulnérabilités affectant les Secure Mobile Access (SMA) 1000. La vulnérabilité critique CVE-2026-83548 permet une falsification de requêtes côté serveur (SSRF) de la part d'un attaquant non authentifié.

Python web frameworks following the Web Server Gateway Interface (WSGI) ↗︎ or Asynchronous Server Gateway Interface (ASGI) ↗︎ specification can now be used in Python Workers. Using web frameworks with Python Workers Based on the web framework you are using, you can use either wsgi or asgi from the workers module. WSGI frameworks For WSGI frameworks like Django or Flask: from workers import wsgi from django.core.wsgi import get_wsgi_application app = get_wsgi_application() Default = wsgi.entrypoint(app) The wsgi.entrypoint is equivalent to creating a WorkerEntrypoint class and using the wsgi.fetch method.

Vercel added Google's Gemini 3.8 Flash to AI Gateway in its September 2 changelog. The listed configuration accepts text, images, PDFs and video, produces text, and supports tool use and web search. Vercel specifies a one-million-token context window and up to 65,536 output tokens, with thinking enabled by default. Developers select google/gemini-3.8-flash through the AI SDK or supported coding-agent integrations.

EFF criticizes Meta's settlement with state attorneys general, arguing that its age-assurance requirements and restrictions on younger users could create new privacy and expression problems. The organization also questions the agreement's approach to retaining information and parental oversight. Its analysis contends that protecting teenagers should reduce unnecessary data collection rather than expand it across the platform.

Google's September 1 roundup covers August launches including Gemini 3.7 Flash for coding and agents, Gemini 3.5 Transcribe for speech-to-text, and Pixel 11 devices. It also describes added task features in Gemini Live and Omni 1.1 Flash tools for extending clips, interpolating frames and 4K upscaling. These are Google's own product announcements, with some device features limited by country, language, age or subscription.

I am excited to announce that etcd RangeStream is graduating to beta in Kubernetes v1.37. Paired with etcd v3.7, it reduces the memory the API server and etcd need to read a large collection, and makes peak usage more predictable. The cost of large reads The API server serves most list and watch requests from its in-memory watch cache. Populating that cache requires reading a resource's full state from etcd, at startup and on every re-initialization. For a resource with many objects, or large ones, such as Pods, that read is expensive. The API server already paginated these reads, asking etcd for a fixed number of keys at a time rather than the whole collection at once. But a page bounded by key count has no awareness of object size, so a page of large objects can still be very large.

Google DeepMind introduced a video-analysis mode that lets Gemini search and re-examine relevant moments instead of processing footage at a fixed frame rate. The September 1 announcement covers Gemini 3.7 Flash, 3.6 Flash and 3.5 Flash-Lite through the Gemini API. Google reports lower token use and costs in its benchmarks, with particular benefits for long recordings; these are vendor-reported results.

GitHub users saw stale pull-request diffs during a resolved September 1, 2026, processing slowdown. GitHub says a concentrated surge of pushes overwhelmed background workers while autoscaling failed to add capacity as intended. At the peak, median diff refresh time exceeded two minutes, versus roughly three seconds normally. Pushing commits and opening pull requests still worked. Manual capacity increases cleared the backlog by approximately 16:01 UTC.

Google announced Pics, a Nano Banana-based image creation and editing tool, with a rollout to AI Pro and Ultra subscribers and most Workspace business customers. Its September 1 post describes edits to individual objects, text changes and translation inside images, shared editing and multiple generated options. Docs and Slides integration began at launch, while Drive integration was planned for the following weeks.

Google Threat Intelligence and Mandiant describe BREEZE COMET, a financially motivated group targeting Brazilian payment infrastructure, retailers and financial services. Their investigations link compromised accounts and custom malware to fraudulent transfers. The report recommends stronger credential protection, network segmentation and controls on remote management tools. Infrastructure observed elsewhere in Latin America and Africa suggests possible expansion, rather than establishing successful thefts there.

AI Gateway monthly usage invoices, issued at the beginning of each month for the previous month's usage, now show a single total cost for each model. These invoices no longer break out input and output token quantities and unit prices into separate line items. This change does not apply to invoices for AI Gateway credit purchases. For example, an invoice that previously included these separate line items: anthropic claude-haiku-4-5-20251001 Input Tokens: 40,000 tokens at $0.000001 ($0.04) anthropic claude-haiku-4-5-20251001 Output Tokens: 24,000 tokens at $0.000005 ($0.12) The updated invoice includes one line item: anthropic/claude-haiku-4.5: $0.16. AI Gateway has also standardized model names across invoices and logs. Model variants that previously appeared with provider-specific version suffixes now use a consistent provider/model identifier.

EFF's incident-response guide outlines practical steps for people facing doxxing, including documenting events, tightening account access and organizing help from trusted contacts. It recommends assigning responsibilities so one person does not have to manage every alert and decision. The guide treats recovery as an ongoing process that includes personal well-being as well as technical security.

EFF's prevention guide encourages people to examine their public digital footprint before a doxxing incident occurs. It explains how public records, old accounts and breached information can combine to expose more than expected. The guidance focuses on reducing unnecessary disclosure, reviewing likely risks and involving trusted helpers without letting the assessment become overwhelming.

I am excited that storage version migration (SVM) has graduated to General Availability (GA) in Kubernetes v1.37! After a number of releases of work and testing, the built-in StorageVersionMigration API (storagemigration.k8s.io/v1) and control plane controller are now fully stable and enabled by default across all v1.37 Kubernetes clusters. The problem with stale storage versions In Kubernetes, stored API resources are written using a specific storage version (schema representation). The way Kubernetes interacts with object storage fundamentally requires mutation of a resource in order to ensure that the latest storage version is used for all resources. This creates problems when you want to change the storage version of a resource.

EFF reviews state efforts to protect location data and argues that gaps still leave people exposed to tracking and sensitive inferences. Its recommendations include broader limits on collection, enforceable privacy rights and safeguards against manipulative consent screens. The organization says protections should cover people's movements generally, rather than depend solely on whether they visit a designated sensitive place.

Kubernetes brings a wealth of features that make it easy to run your production workloads securely and reliably. While aspects like scheduling, health checks and resource limits are probably at the front of your mind, one other important feature of Kubernetes is production identity — how your workload can authenticate to other systems in order to do its job. Up until now, the primary production identity mechanism built into Kubernetes has been service account JWTs (JSON Web Tokens). These are cryptographically-signed tokens, issued by the control plane of your cluster, that let anyone in the world understand who is calling when your workload uses them. In Kubernetes 1.37, the foundations of a new built-in production identity technology have gone GA.