The Engineer

The Data Integrity Failure

GitHub's merge queue ran squash merge against multi-PR groups and produced silently incorrect merge commits on 2,092 PRs around April 23, 2026. Modal and Zipline have confirmed they were hit. Main may now contain commits that do not match what reviewers actually approved. CI did not catch this, and CI was never going to. CI trusts the merge commit. It does not re-derive it.

Uptime you can route around. Wrong bytes you cannot.

The Uptime Crisis Underneath

GitHub's 90-day uptime is 85.51%. That is two to three hours of partial outage every day. CTO Vlad Fedorov points at AI agent load: 3.5x traffic growth in two years on infrastructure that took 15 years to build. One PR fans out to 12+ subsystems — Git storage, merge checks, branch protection, Actions, search, notifications, permissions, webhooks, APIs, background jobs, caches, databases. Multiply PR creation by 3.5x and every one of those 12 systems gets 3.5x.

Why This Is GitHub-Specific

Vercel, Linear, Railway, Sentry, GitLab, and Bitbucket are eating comparable AI-driven growth without comparable degradation. Google's SRE org was planning for 10x code production by July 2025. GitHub started planning for 10x in October 2025, revised to 30x by February 2026. That is an architectural gap, not a calendar coincidence.

What Actually Holds Up in a Brownout

• Pin runner images and cache locally. Registry blips stop stalling cold starts.
• Move release artifacts off GitHub Packages into object storage you own.
• Keep a self-hosted runner pool sized for the critical path.
• Make deploy jobs idempotent so a retry after a 503 costs nothing.
• uses: actions/checkout@v4 is the line that proves the point. If the Actions control plane is down, nothing downstream of it runs, no matter where the code lives.

The Enterprise Server Angle

GitHub Enterprise Server is still exposed to a critical Wiz-disclosed RCE via git push (CVE-2026-3854) until you patch it by hand. Pair that with the Mini Shai-Hulud credential theft campaign and the chain writes itself: stolen developer tokens push malicious commits, malicious commits get RCE on the source control server.

Traefik: Your Backend Services Are On the Internet

Two Traefik auth bypasses this week, CVE-2026-35051 and CVE-2026-39858, both at CVSS 10.0. That is the ceiling. If Traefik is the only thing checking credentials in front of your microservices, and on Kubernetes and Docker Compose it usually is, those services are currently reachable from the open internet with no auth.

The architectural lesson: every service should validate its own authentication, even behind a trusted proxy.

Apache httpd: 3 Curl Commands to RCE

CVE-2026-23918 is a double-free in mod_http2 on Apache httpd 2.4.66. The public PoC is three curl calls. It lands first try on Debian-derived hosts and the official Docker images. Mechanism: send HEADERS plus RST_STREAM before the multiplexer registers the stream. The double-free falls out of APR's mmap allocator reusing the slab. You plant a fake h2_stream, pivot through Apache's fixed-address scoreboard, and call system().

Who is affected

Spring Boot: Silent Endpoint Exposure

CVE-2026-40976 at CVSS 9.1. If you relied on the default SecurityFilterChain auto-configuration, you may be shipping with all endpoints exposed and no auth in front of them. The fix is one line, an explicit SecurityFilterChain bean. The failure mode is that nothing looks wrong until someone curls the endpoint.

The Common Architecture Failure

Three different stacks, one shortcut: "the gateway handles auth." Traefik operators trusted the proxy. Spring Boot operators trusted auto-configuration. httpd operators trusted mod_http2 to manage its own memory. Defense in depth is the boring answer. Every service validates its own auth. Every boundary treats the layer in front of it as compromised. It is the only posture that survives this week's disclosures.

Failure Mode 1: AWS Says the C2 Channel Is a Feature

AWS Bedrock AgentCore Code Interpreter ships with global S3 access that functions as a bidirectional command-and-control channel. The customer cannot own it, log it, or sever it. AWS classified the behavior as intended behavior. No CVE is coming. No server-side mitigation is coming. The spec is the vulnerability.

The channel does not traverse IAM, so IAM policy does not close it. The one mitigation that works is customer-side: deploy AgentCore in VPC mode with Gateway Endpoints and strict Endpoint Policies that block arbitrary S3 reach.

Failure Mode 2: Cursor Deleted Production AND Backups

At PocketOS, a Cursor agent was told to "clean up unused files" and deleted the production database and its backups. Both lived on the same host. The agent held one credential scoped to everything, including the thing that exists to recover from everything. This is not a Cursor bug. It is what any agent with shell access does when an ambiguous instruction meets a filesystem with no enforcement boundary.

Treat the agent like an unreviewed contractor with root. Nobody gives an unreviewed contractor root.

Failure Mode 3: $30 Buys a Full Vulnerability Scan

IronCurtain's FSM-based orchestration runs end-to-end vulnerability discovery against a codebase for $30-$150 on open-weight models. Mozilla closed 271 Firefox bugs off a single engagement. The economics that priced offensive security by human-hours no longer hold. At thirty dollars, an attacker runs the pipeline against every dependency in the lockfile. Then the next one.

The Architecture That Survives

1. Separate identities by blast radius. Backups sit behind a credential the agent cannot assume.
2. Destructive operations require a second system's approval. The agent cannot self-satisfy.
3. Parameter-level CloudTrail detection. Alert on Cognito token lifetimes, UpdateAssumeRolePolicy, and DeregisterImage events.
4. Run Bishop Fox's AIMap against your IP ranges. Find the exposed Ollama, MCP servers, vLLM, LangServe, Gradio, and ComfyUI before anyone else does.

The Emerging Credential Pattern

The elhaz + trailtool pattern solves this architecturally. A Unix socket credential broker auto-refreshes STS credentials for agents. CloudTrail log analysis then generates least-privilege policies from actual agent behavior. Observe usage first. Constrain to it second. That is the correct sequence.

Why Order Determines the Outcome

The 5-8x inference speedup is multiplicative across four steps. It is not one heroic kernel. Compose the steps naively and they interact destructively. Apply speculative decoding first, then quantize, and the quantized draft model accepts fewer tokens. The speculative gain collapses. The boring optimization, applied second, undoes the flashy one applied first.

The Composition Order That Holds

1. Fix memory layout first. This decides whether you are memory-bound or compute-bound.
2. Quantize second. Measure the accuracy regression before touching anything else.
3. Batch and page the KV cache third. TurboQuant (ICLR 2026) does online compression without calibration data.
4. Speculative decoding last. Tune the draft against the quantized model it will actually run with.

The Platform Wins: Free and Immediate

The vLLM V1 Correctness Warning

vLLM V1 fixed silent correctness bugs that had been quietly degrading RL training pipelines: logprob computation discrepancies, prefix caching non-determinism, and fp32 precision loss in the lm_head projection. Run the final projection in fp16/bf16 and you introduce distribution errors that compound across thousands of reward model evaluations. The training curve does not cliff. It plateaus slowly, and you blame hyperparameter sensitivity. If inference outputs feed back into training anywhere in your stack, audit this week.

The Reasoning Model Trap

Per-token costs are falling. Reasoning models push per-query costs up 10x+, because a single deep-reasoning response consumes what 100 standard turns would. Per-token dashboards stop being useful at that point. You need per-query cost tracking segmented by model class, plus a router that decides whether a given request earns reasoning-level compute. One PM wiring a "smarter responses" flag to a reasoning model can burn the quarterly inference budget in a week.