The Engineer

Truffle Security re-tested 10,616 AWS access keys that leaked publicly between August 2022 and August 2026, and 9,342 of them still authenticate, per DevOps'ish. 768 of those keys hand over full administrative control of a company account. The median leaked key had gone roughly five years without rotation, which makes key age the fastest ownership audit you can run. 90% of the exposed accounts had no budget alert configured, so abuse surfaces at billing time or not at all.

OpenAI will terminate Cursor's access to its models on November 12, per Techpresso. The stated reason is trust, not payment or performance: SpaceX acquired Cursor's parent company Anysphere about three months ago, and OpenAI cited past terms-of-service violations by Musk-owned entities. Cursor's fallback is Anthropic's Claude plus its in-house Composer model. If your team standardized on Cursor with GPT-family completions, you have roughly eleven weeks and no vendor migration path.

Open-weight models hit a single-day record of 62% of tokens served on Vercel's platform, up from 28% two months earlier, per Exponential View. Bridgewater, working with Thinking Machines, fine-tuned an open Qwen model on expert-labeled data and reported roughly 30% fewer errors than every frontier model it tested on internal information filtering, at one-fourteenth the inference cost. Ramp's spend panel of about 70,000 companies shows flagship Opus 4.8 taking only 28% of Anthropic spend in July 2026. Every one of these figures is self-reported.

Kubernetes v1.37 "Garhwal" landed 67 enhancements — 16 stable, 23 beta, 27 alpha — led by pod certificates and cluster trust bundles, per DevOps'ish. That makes short-lived, cluster-issued workload identity a native primitive instead of an assembly of SPIFFE/SPIRE, cert-manager, and Vault sidecars. The Metrics API also went stable, so HPA, VPA, and dashboard consumers can delete their version-tolerant shims. With 27 alpha and 23 beta gates in one release, the upgrade plan has to be written from the release notes first.

Researchers published InjecMEM, an attack in which one input plants hidden instructions in an AI agent's long-term memory that keep steering responses after the session ends, per CSO's reporting. A separate finding hits the same seam from the other side: invisible HTML, including zero-width characters and display:none nodes, made an email summarizer follow instructions the human reviewer never saw. If you run mem0, Zep, LangGraph checkpointers, or Assistants threads, the write path is now the privileged surface. No CVE, driver name, or proof-of-concept has been published yet.