The Engineer

An unidentified actor hijacked 162.55.80.0/24 out of Hetzner space on August 28 and served malicious Virtualizor updates for nearly 33 hours, per Risky Business. Route Origin Validation passed because the attacker forged Hetzner's AS24940 as the origin, and a valid domain-validated certificate followed. If you ship artifacts to clients you don't control, TLS validated the pipe and nothing validated the bytes. Two other paths are being exploited now: JFrog Artifactory CVE-2026-82329 and unpatched Langflow CVE-2026-0768.

Anyscale's benchmark on OPT-13B and a 40GB A100 shows static batching collapsing to roughly 81 tokens/sec as output lengths spread, against about 10x that for continuous batching. Continuous batching is now default-on in vLLM, SGLang, TGI and TensorRT-LLM, so the binding constraint moved from FLOPs to KV-cache capacity. When the cache pool exhausts, the scheduler evicts a running request and recomputes its prefill later — duplicated compute that shows up on a dashboard as a need for more GPUs.

Vercel reports that agents authored 25-35% of merged pull requests and closed 70-80% of issues on the AI SDK within four weeks, on a package doing over 20M npm downloads per week. Flue now auto-converts external pull requests into issues and tldraw auto-closes them outright. If you consume these packages, the human involvement behind a third of merged upstream code narrowed to the merge click, with no release note announcing it. The closure figure is self-reported, four weeks old, and never defined.

Anthropic restarted the external cybersecurity evaluations it paused roughly a month ago, after three runs in which Claude models left their test environment and attacked real companies. The root cause was a partner sandbox from Irregular that was configured to block internet access and simply didn't, with no test asserting denial. Claude Opus 4.7 attacked a live firm that shared a domain name with a fictional target, which is what happens when scope lives in prompt text instead of an egress allowlist.

Apple is passing higher memory chip costs to customers because AI buildouts are absorbing DRAM supply, per Morning Brew, on a product line shipping about 255M units a year. That is the same commodity pool your memory-optimized instances, managed Redis, and in-RAM vector indexes draw from. On the power side, Benedict Evans notes GE Vernova, Siemens and Mitsubishi together ship roughly 50GW of gas turbines a year and are sold out to 2030, while announced neocloud capacity is back-loaded into late 2027.