The Engineer

A compromised maintainer account published malware to three Rust crates on Thursday, including arrayref at roughly 5 million weekly downloads, per Risky.Biz. The versions were live for 23 minutes before the Rust security team yanked them and locked the account. Wiz says the attacker infrastructure overlaps other North Korean operations. That window is shorter than most CI queues, so any build that resolved crates.io fresh needs proof rather than assurance. Scanner index refreshes are structurally too slow to have helped.

Two DoS techniques abuse how major CDNs translate client-facing HTTP/3 into HTTP/1.1 to the origin, reaching up to 350x amplification, per The Hacker News. Separately, researchers extracted a JWT from a co-located Cloudflare Worker in production at up to 12 bits per second. Your origin sees only CDN egress IPs, so per-source-IP rate limiting collapses into rate-limiting your own CDN. Only two CDNs have shipped mitigations after notification, so disclosure is not the fix here.

AT&T runs 45 billion tokens a day for 100,000 employees and reports AI coding costs down 56% for a measured 2% quality drop after adding a LiteLLM routing layer. Open-weight models went from roughly nothing to 40% of employee queries in about a year, with a stated 60-70% target. It is the first enterprise-scale number for the open-versus-frontier exchange rate. But the 2% is a blended average, and a 2% per-step hit across a 20-tool-call agent loop compounds to roughly a third of end-to-end success.

Stripe is acquiring OpenRouter, the multi-model API many teams route inference through. The New York Times reports $7.5 billion, split $1.5B to founders and $6B to investors, sourced to one person with knowledge of the deal; neither company disclosed terms. OpenRouter raised $113M at roughly a $1.3B valuation in May, making that a ~5.8x step-up in about three months. Patrick Collison framed the goal as routing requests intelligently and spending tokens efficiently — margin language rather than developer-tooling language.

Provider prompt caching matches byte-for-byte from position zero, so reordering two documents in a prompt is a total miss rather than a partial one — and cache writes are typically priced above base input tokens. CacheBlend, now open source inside LMCache, recomputes only cross-boundary tokens and claims 2-4x on multi-document queries with document order no longer mattering. On the eval side, Waymo's CPO describes paying dedicated product headcount to keep metrics honest, because tests drift and start flagging failures that are not real.