The latest wire

EFF, Access Now and Data Privacy Brasil have issued recommendations linking privacy safeguards to the integrity of Brazil's elections. They argue that political profiling and AI-generated material can amplify manipulative targeting. The proposals call for coordination among regulators, civil society and platforms, along with stronger oversight of personal-data use and limits on political microtargeting during defined periods.

Durable Objects can have up to ten distinct Dynamic Workers with in-flight requests, increased from four. This limit applies across all concurrent requests to the same Durable Object because they share an input/output (I/O) context. Other Workers can have up to four distinct Dynamic Workers with in-flight requests per request. Multiple in-flight requests to the same Dynamic Worker count as one toward this limit. For more information, refer to Dynamic Workers limits.

@cf/zai-org/glm-5.3 is now available on Workers AI. It is Z.ai's flagship agentic coding model, built for long-running, tool-driven development workflows rather than single-turn chat. GLM-5.3 uses the same base model as GLM-5.2, with every gain coming from post-training. The results are substantial on coding and agentic benchmarks: Z.ai reports ↗︎ a 50% improvement over GLM-5.2 on its in-house Z.ai Code Bench, and calls GLM-5.3 the most capable open-weights model for coding. On public benchmarks, it scores 88.2 on Terminal Bench 2.1 (up from 81.0), 28.3 on Terminal Bench 3.0 — open-source state of the art, up from 4.6 — 66.9 on DeepSWE (up from 46.2), 78.1 on FrontierSWE (up from 67.5), and 42.5 on SWE-Marathon (up from 19.4).

Aug 27, 19:44 UTC Resolved - On August 26, 2026, between 20:40 UTC and 00:51 UTC on August 27, GitHub Billing experienced degraded performance affecting billing budget pages and GitHub Copilot CLI sessions.

Kubernetes v1.37 promotes the metrics.k8s.io API to stable (v1). This API provides CPU and memory usage for nodes and Pods, and is the API behind commands such as kubectl top and resource-metrics-based autoscaling. For cluster operators and application developers, this graduation means that the API now has the stability guarantees associated with a Kubernetes stable API. The v1 API has the same resource types and fields as v1beta1; this is an API-version graduation, not a change to the metrics that are collected or returned. A long-lived API reaches stable The resource Metrics API was introduced as alpha in Kubernetes v1.6 and became beta in v1.8. It has remained unchanged and has been used in production for years by clients including the HorizontalPodAutoscaler (HPA) and kubectl top. Kubernetes v1.37 formally graduates that proven API to metrics.k8s.io/v1.

Aug 27, 12:12 UTC Resolved - On August 27th, 2026, between approximately 09:20 and 12:14 UTC, the Copilot service experienced a degradation of the Kimi K3 model due to an issue with our upstream provider.

Giving AI agents a person's credentials can recreate familiar identity-management problems at machine speed. NIST's analysis highlights shared credentials, long-lived tokens and excessive permissions, and points to existing authorization standards as a starting point. It also warns that repeated human approval requests can create consent fatigue rather than dependable oversight.

The UK's National Cyber Security Centre reports increased targeting of operational technology across sectors worldwide, including the UK, with some limited real-world disruption. It urges organizations to verify internet exposure, protect access to industrial systems, maintain supported boundary devices and test recovery arrangements. The alert also stresses that ordinary businesses face related risks from exposed systems and edge equipment.

Aug 27, 00:26 UTC Resolved - On August 26, 2026, from 21:55 UTC to 23:58 UTC, 2.6% of workflow runs triggered by pull request events were delayed, with the impact rising as high as 25% at its peak.

EFF has assembled a list of immigration-enforcement requests for user information from technology companies, drawing on public reporting, court cases and transparency disclosures. It records differing outcomes, including withdrawals, objections and data disclosures. The organization stresses that the list is incomplete because many requests become visible only when companies report them or affected users challenge them.

EFF's statement on Meta's settlement argues that expanding age assurance would require more information from users while limiting younger people's access to online expression and communities. The organization also warns that retained data could face security risks or government requests. These are EFF's objections to the agreement, rather than an independent determination of its eventual effects.

@cf/zai-org/glm-5.3-flash is now available on Workers AI. It is the first natively multimodal model in the GLM-5 series, built on a Mixture-of-Experts architecture with 320B total parameters and 18B active per token. GLM-5.3 Flash is the first GLM-family model on Workers AI to support multimodal inputs. It outperforms GLM-5.2 across benchmarks and real-world workloads at a lower price, while approaching Claude Opus 4.8 on coding and agentic benchmarks. GLM-5.3 Flash requires the Workers Paid plan or prepaid AI Gateway credits. Use GLM-5.3 Flash through the Workers AI binding (env.AI.run()), the REST API, the OpenAI-compatible endpoint, or AI Gateway. For more information, refer to the GLM-5.3 Flash model page and pricing.

Editors: Arsh Sharma, Christopher Tineo, Kirti Goyal, Sophia Ugochukwu, Swathi Rao, Troy Connor Similar to previous releases, the release of Kubernetes v1.37 introduces new Stable, Beta, and Alpha features. The consistent delivery of high-quality releases underscores the strength of our development cycle and the vibrant support from our community. This release consists of 67 enhancements. Of those enhancements, 16 have graduated to Stable, 23 have graduated to Beta, 27 are entering Alpha, and 1 is a deprecation/removal. Release theme and logo The theme for Kubernetes v1.37 is Garhwal (गढ़वाल, pronounced gaṛhvāl), a Himalayan region of Uttarakhand, India. The snow-capped peaks of the Garhwal Himalaya, deodar forests, terraced fields, rivers and streams, and mountain paths shape both the region and the logo.

Aug 24, 14:34 UTC Resolved - On August 24, 2026, between 13:33 UTC and 14:04 UTC, 3.8% of Actions runs experienced start delays over 5 minutes with 1.25% of Actions runs failing outright.

Aug 24, 07:58 UTC Resolved - On August 24th, 2026, between approximately 06:35 and 07:25 UTC, the Copilot service experienced a degradation of the Claude Fable 5 model due to an issue with our upstream provider.

Console methods now preserve exception details in your Worker's logs. When your Worker logs an exception, the corresponding log entry includes the exception name, message, and stack. For example, your Worker can catch and log an exception: try { throw new Error("Deliberately created exception"); } catch (error) { console.error("caught exception:", error); } try { throw new Error("Deliberately created exception"); } catch (error) { console.error("caught exception:", error); } If you use Workers Observability, your log is automatically enriched with structured error information. The following example shows how the enriched log appears in the Cloudflare dashboard: The exception's stack trace appears directly in the log message.

Wrangler and the Cloudflare API MCP server now use optional OAuth scopes. During authorization, you can choose which optional scopes to grant instead of approving every scope requested by each client. The consent dialog now includes the option to edit the permissions you grant to Wrangler or the Cloudflare API MCP server: You can then choose which specific permissions to grant: Required scopes remain selected. Choosing fewer optional scopes limits each tool's access to the permissions needed for your workflow. If a command or tool call needs a scope that you declined, reauthorize the client and grant that scope. For more information, refer to wrangler login and Edit optional permissions.

EFF and several civil society groups have asked Nottinghamshire Police to stop a proposed expansion of live facial recognition. Their letter raises concerns about scanning people in public, possible use involving children and the effects on participation in everyday activities. The groups argue that the force has not adequately addressed proportionality, public support or safeguards.

EFF examines Brazil's changing rules for platforms' responsibility over user posts, including removal notices and duties concerning serious unlawful content. Its analysis welcomes requirements to explain decisions and provide appeals, while warning that broad obligations can encourage excessive removal or surveillance. The organization calls for transparency from both platforms and government agencies as the framework is implemented.

Google Threat Intelligence reports three suspected Russian espionage clusters targeting people in government, defense, academia and think tanks through deceptive use of legitimate sign-in features. Personal accounts are frequent targets, limiting employers' visibility. Google recommends verifying unexpected invitations independently and reviewing linked devices. It assesses a Russian connection with high confidence, while links between two clusters and ICE RELIC remain a moderate-confidence assessment.

Durable Object namespaces now have a Deployments tab in the Cloudflare dashboard, showing the versions of the backing Worker that are currently live and the traffic split between them. Go to Durable Objects ↗ A Durable Object namespace is backed by a Worker script, so its deployments are the same as that Worker's deployments. Previously, checking on a gradual deployment in progress for a Durable Object meant navigating to the backing Worker. The new tab surfaces that information directly on the namespace, alongside the metrics that matter for it: requests, error rate, and wall time per version. The tab is read-only — promoting, rolling back, or splitting traffic on a deployment is still managed from the backing Worker's Deployments tab.

EFF describes instances in which Meta and Reddit challenged immigration-enforcement demands for account information behind the scenes. It argues that private objections are useful but insufficient, especially when users must arrange their own legal challenges. The organization calls on technology companies to provide clearer public commitments and, where appropriate, contest improper demands in court themselves.

On 19 August 2026, Citrix published a security advisory addressing multiple critical vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). CERT-EU recommends updating affected devices as soon as possible.

NIST has released a quick-start security infographic for operators of building automation and control systems. These systems manage functions such as HVAC, lighting and access control, and their connections to corporate networks or cloud services increase exposure. The resource targets teams with limited capacity and links to broader operational-technology guidance.