The Engineer

Two Failures Converging This Week

The NVD announced it will only enrich CVEs for KEV vulnerabilities, government software, and software deemed 'critical' — driven by AI tools (specifically Claude Mythos) generating more vulnerability reports than humans can process. If your vulnerability management pipeline feeds from NVD's CVSS scores — through Snyk, Grype, Trivy, or Dependabot — you're about to lose scoring coverage for large swaths of your dependency tree.

Simultaneously, the Mini Shai-Hulud supply chain worm is actively propagating across ecosystem boundaries using stolen maintainer credentials. This is not the single-package PyTorch Lightning compromise from last week. This is a self-replicating worm that crossed npm→PyPI→npm using CI/CD tokens as its propagation mechanism.

The Worm Mechanism

Malicious preinstall scripts in npm (and setup.py hooks in PyPI) execute during npm install/pip install — before your application code runs. They harvest every secret in the environment: AWS keys, GitHub tokens, npm publish tokens, PyPI tokens. Those stolen credentials publish poisoned versions of packages the compromised developer maintains. 1,800+ repos with leaked credentials means every compromised CI pipeline becomes a launching pad for the next wave.

npm install is remote code execution. We've been treating it like a data operation.

Specific compromised versions confirmed: SAP mbt v1.2.48, @cap-js/db-service v2.10.1, @cap-js/postgres v2.2.2, @cap-js/sqlite v2.2.2 (April 29), then PyTorch Lightning and intercom-client (April 30). Total affected downloads: 8.3M.

The NVD Blindness Problem

Your scanners rely on NVD CVSS scores to prioritize. With enrichment gutted, a CVE exists but has no severity score — and your prioritization logic doesn't handle that case. The fix requires integrating EPSS scores, OSV data, and direct vendor advisories as parallel enrichment sources. Your triage process must handle the null-score case gracefully.

Additionally: AI-generated fake PoCs are flooding GitHub for CVE-2026-31431 (the actively-exploited kernel privesc). Three of four top-starred repos don't compile. Defenders writing YARA rules from these fakes are building detections against code no attacker will ever ship.

Also Active This Week

• CVE-2026-4670: MOVEit Automation unauth RCE, 1,400+ exposed instances, same attack pattern Clop exploited across 2,100 orgs in 2023
• CVE-2026-41940: cPanel auth bypass (CVSS 9.8), exploited since February, 44K+ IPs compromised with Go-based Linux ransomware
• Microsoft Defender falsely flagged DigiCert roots as trojans, breaking TLS across enterprises

The Tollgate Pattern Is Shipping Across Enterprise SaaS

ServiceNow, SAP, DataDog, Workday, and HubSpot shipped the same thing within a few months of each other: a metered gateway between external AI agents and platform data, priced per interaction. That is not five product teams arriving at the same idea by accident. Unmetered agent traffic breaks capacity planning and per-seat pricing at the same time. A tollgate fixes both in one control plane.

Unmetered agent traffic would wreck their capacity planning and their per-seat pricing model simultaneously. The tollgate is the rational response.

The Specific Numbers That Matter

DataDog's MCP budget is 5,000 requests per day. That buys roughly 5-10 serious SRE agent investigations before throttling. The reason is mechanical: a planner issues 3-5 discovery calls before it runs the real query, so a naive agent burns the daily cap before lunch. I have watched this happen in a staging account.

The Per-Action Cost Explosion

Trace one user prompt through the gateway. Planner call, three tool calls, a reflection step, a final synthesis. That is six metered events for one piece of work. The gateway counts every hop. Retries are a line item. Eval harnesses that replay production traces are a line item. The pricing page shows a low per-action number. The invoice does not match the pricing page.

CISA confirmed the three attack surfaces on agent systems independently: prompt injection, tool misuse, and privilege creep. Okta demonstrated credential bypass through AI agents. Security and billing converge on the same chokepoint, which is the API gateway, because that is the only place you can see every call a non-human identity makes. Cisco paid $400M for Astrix on that thesis. Non-human identities are multiplying faster than IAM teams can enumerate them. That price tag says infrastructure, not feature.

First-Party Agents Get Preferential Access

ServiceNow shipped a direct connector for Claude Cowork. SAP has signaled it may ban agents it has not explicitly endorsed. The result is a two-tier integration model: first-party agents (Claude, GPT) get native connectors and better pricing, custom agents get the standard API or nothing. The rational response for a team with custom agent logic is to wrap it inside a Claude Cowork session to inherit the preferred connector. That is an agent-platform tax paid to avoid the integration-layer tax. Pick which toll you prefer.

The Architecture That Worked

Instacart replaced Elasticsearch plus a standalone FAISS vector service with one Postgres cluster running pgvector. Writes dropped 10x. Latency improved 2x. Zero-result searches fell 6%. The win is not a cleverer ANN index. It is deleting network hops and eliminating write amplification from denormalization.

Why Writes Were the Binding Constraint

Instacart does billions of writes per day. Prices, inventory, availability, personalization signals. In Elasticsearch's denormalized document model, one price change rewrites and reindexes the full document. At billions of items with prices moving several times daily, fixing bad data took days to propagate. In Postgres a price update is a row update. One write, not a three-system fan-out. That is the 10x.

The data model matches the access pattern. That is the entire mechanism.

Why Co-location Delivers 2x Latency

The split architecture fanned each query to Postgres and FAISS, waited on both, merged in the application, then re-ranked. pgvector in the same instance collapses that into a single query plan: keyword match via GIN, vector similarity via HNSW, filter by in-stock, return ranked results. No network hops. No overfetching. No application-layer join.

Pre-filtering is the underrated win. A standalone FAISS service cannot cheaply filter for "in-stock at this store" before ANN search. The workaround is overfetch 10x and post-filter. When survivors are sparse you get zero-result searches for items that are semantically correct and out of stock. pgvector pushes WHERE in_stock = true AND retailer_id = X into the index scan.

The Conditions That Must Hold

1. Write volume high relative to read volume. Price and inventory mutations dominate the workload.
2. Vector count per partition under 50-100M. That is pgvector's practical ceiling. Shard by natural partition keys.
3. 2x read latency still fits inside SLO. pgvector HNSW will not beat purpose-built FAISS on raw query time.

One out of three is not enough. All three, and consolidation wins. This is the broader pattern from DDIA 2nd edition: cloud-native systems that write directly to purpose-built storage outperform multi-layer abstractions. Skip the impedance mismatch and the numbers move.

When NOT to Use This Pattern

Static corpus, reads dominate, per-partition vector count over 100M. Keep the specialized stack. pgvector will not beat a purpose-built vector store on a billion-vector benchmark. It does not have to for write-heavy, frequently-mutating workloads.

Remix 3: A Fork, Not a Successor

Remix 3 is no longer a React framework. Shopify acquired Remix in 2022, extracted the patterns into React Router v7, and left the Remix brand to evolve into a web-standards-first framework with its own UI model. If you ship on Remix today, the framework you actually depend on is React Router v7. That is where Shopify's engineers commit. Remix 3 is a new entrant.

Start migration planning by answering what percentage of the codebase imports React directly versus through Remix primitives, how many third-party components assume a React context, and whether the test suite depends on react-dom/test-utils. The first number is almost always higher than the team thinks.

Node.js 26: Temporal Ships Default-On

Temporal is enabled by default, riding on V8 14.6 and Undici 8. That removes the last clean excuse to keep moment.js in a codebase. You get timezone-aware arithmetic, unambiguous instant and zoned representations, and the elimination of the bug class where a local datetime gets compared against a UTC timestamp. The API surface is frozen. Use Temporal.Now.zonedDateTimeISO() in the next service.

Anthropic Acquired Bun — Governance Risk for Production Users

Bun got traction on cold-start performance and single-binary DX. Anthropic is not a developer tools company. It is an AI lab. The charitable read is that it wants a fast runtime for agent execution and code sandboxing. The less charitable read is that Bun gets optimized for Claude Code's workloads, not the rest of us.

A runtime owned by a model vendor is a different governance story than a runtime owned by a company whose only product is the runtime.

Combine that with Jarred Sumner floating a Zig to Rust port and the runtime has an identity problem. Node.js 26 shipping Temporal, V8 14.6, and Undici 8 starts to look like the boring, stable choice it has always been.

The Rust Tooling Tradeoff Nobody Is Costing

Astro v7 ships a Rust compiler. Bun is exploring Rust. SWC, Turbopack, and Biome are already Rust. The performance wins are real. The contributor accessibility cost is not being priced. When the hot path of the build tool is Rust and the app is TypeScript, the pool of engineers who can debug a build regression drops by 90%. Treat the build pipeline as infrastructure with a named owner.