The latest wire

Vercel has renamed its Edge Requests usage metric to CDN Requests across dashboards, notifications and invoices. The company says pricing, limits and measurement are unchanged, and existing metric identifiers remain valid. Billing integrations that match on the ServiceName field need attention because that displayed name changes; Vercel recommends using the stable SkuId field to avoid depending on future naming changes.

Cloudflare marked its September 30 Los Angeles network incident resolved at 19:18 UTC. The investigation began at 13:49 UTC over possible congestion affecting Vectorize, Durable Objects, R2, Hyperdrive, Stream and Cloudchamber. The company described a regional performance issue and worked to reduce its effect on internet users; it did not establish congestion as the confirmed cause in the notice.

Red Hat has published a Moderate-rated update for FFmpeg RPM components in RHEL AI 3.0, covering eight listed CVEs across four processor architectures. The advisory says these RPMs are internal build artifacts supported only as part of the Red Hat AI application platform. It directs administrators to apply earlier relevant errata before installing the update and following the linked installation guidance.

An update for gvfs is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Changes to Cloudflare account roles and permissions were slow to reach some services on September 30. The company said recently edited permissions might not take effect immediately, then reported a fix at 18:04 UTC and closed the incident at 18:10 UTC. Recently submitted changes could therefore take longer to appear across affected services.

An update for expat is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for openssh is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GitHub Team organizations can now try GitHub Advanced Security through a self-service trial. The offer covers Code Security and Secret Protection, with entry points in the organization overview, licensing settings and completed risk assessment. GitHub's announcement describes the trial access but does not specify its duration or pricing after the trial.

Ubuntu has published an update for the Authen::SASL Perl authentication library. The detailed advisory says inadequate validation of login attempts could allow unauthorized access and lists fixed packages across several Ubuntu LTS releases. Some older-release fixes require Ubuntu Pro or Legacy Support; the release-specific package table identifies the applicable update.

Ubuntu's ImageMagick update addresses multiple image-processing flaws that could crash software or, for one issue, expose sensitive information. The affected releases differ by CVE, so the advisory's individual entries matter. Its package table also distinguishes fixes delivered through Ubuntu Pro's ESM Apps coverage from updates available through other channels.

An update for gvfs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

A crafted WAV file could trigger a crash or potentially execute code through GStreamer Bad Plugins, according to Ubuntu. The defect concerns validation of multi-channel audio block sizes. Fixed packages are listed by Ubuntu release, with some supplied through extended security coverage; the advisory does not report confirmed active exploitation.

Google Cloud introduced a preview remote MCP server that exposes gcloud and BigQuery command-line operations to AI agents. Commands run in an isolated cloud environment instead of requiring local CLI installation. Google says execution uses the authenticated caller’s permissions and organization policies, with optional audit logging and Model Armor integration. The preview is intended to simplify infrastructure and data workflows while retaining existing access controls.

Google Cloud’s September infrastructure roundup focuses on running larger fleets of AI agents. It introduces GKE Agent Substrate, adds scale-to-zero and custom-metric autoscaling capabilities, and describes pod snapshots that preserve workload state. Storage updates include preview Filestore agent volumes and new virtual-machine options. The pod-snapshot performance claim comes from Google’s internal testing, so results may differ across workloads.

Google Cloud has made Spanner Omni generally available for deployment on customer infrastructure or other clouds. It combines relational, graph and vector capabilities with production security, backup and support options. Unlike managed Spanner, customers operate the infrastructure themselves, and Google does not provide an availability SLA. A free development edition and paid commercial edition have different usage and feature conditions.

Google Cloud’s security advisers argue that cybersecurity startups should build around CISOs’ operational problems before pitching AI features. Their guidance emphasizes customer discovery, evidence for product claims, resistance to prompt injection and data poisoning, and awareness of sector-specific obligations such as data residency. The article offers practitioner advice from Google’s startup program, rather than announcing a new security product or reporting an incident.

Ubuntu has patched a Kdenlive project-file issue affecting 26.04 LTS. The advisory says dangerous proxy parameters could pass through to MLT consumer properties and allow attacker-controlled projects to execute commands. It lists updates for Kdenlive and the MLT packages, tying the risk to opening a malicious project rather than ordinary video playback.

Ubuntu's GVfs update addresses two different risks: malicious SFTP data could cause memory corruption, while a local file-ownership flaw could enable root privilege escalation on specified recent LTS releases. The affected versions differ between the issues. Ubuntu says users need to restart their session after applying the relevant package updates.

An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Google DeepMind introduced SynthID Bio, a research approach for marking AI-generated protein sequences and predicted structures so their provenance can be checked. The team reports laboratory tests in which watermarked protein designs retained biological function. It presents the work as an additional biosecurity and scientific-integrity measure, while acknowledging that stronger resistance to deliberate tampering remains an open research challenge.

An update for openssh is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for pcp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

An update for dogtag-pki is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.