Issue 39

25 September 2026

Hi there,

Four coding agents could show a pinned Git hash while running code from a different commit. Air Security calls the bug Plugin4Shell. I would not have expected a plugin pin to fail in that particular way, and the fix is less exciting than the headline: verify what actually landed on disk. Cloudflare’s explanation of a 100TB RAM saving is the other piece I kept returning to. Fly.io’s price notice makes the infrastructure section below.

Industry

1. Crusoe sells capacity it still has to build

Crusoe announced the initial close of a $3.9 billion funding round at a $30.9 billion post-money valuation. It reports more than six gigawatts of gross contracted capacity, but says one gigawatt is operational. The distinction matters when someone repeats its $140 billion contracted-value figure: those are Crusoe’s figures for future infrastructure commitments, not revenue already earned.

Artificial Intelligence

2. OpenAI splits its new model family by price and pace

OpenAI introduced GPT-6 Sol and Luna on 22 September alongside its larger Astra model. Sol and Luna aim to trade some of the latter’s depth for lower API cost and higher throughput; OpenAI says they are available in ChatGPT Work and Codex before a gradual Chat rollout. Its benchmark and price comparisons are vendor measurements, not an independent purchasing recommendation.

Infrastructure

3. Nokia and Microsoft want the network data in one place

Nokia announced an integration with Microsoft Fabric for telecom operators. It proposes to bring data from multiple vendors and networks together, starting with voice-over-new-radio assurance and radio-network performance. This is an announced integration, not a measured performance improvement. The data plumbing is worth watching; the word "agentic" tells us much less.

Microsoft

4. EvilTokens read the stolen inbox

Microsoft and Health-ISAC used a court-authorized action against EvilTokens, a service that paired device-code phishing with software to inspect compromised mailboxes. Microsoft linked it to more than 12,000 inboxes across over 10,000 organizations. The mailbox analysis could surface payment threads and trusted contacts for impersonation. UK police arrested two suspects, who were later released on bail; that is not a conviction.

Development

5. A pinned plugin, but not the pinned code

Air Security tested Claude Code, Codex, GitHub Copilot and Gemini CLI. A plugin repository owner could exploit Git reference ambiguity so the agent displayed the expected commit hash but checked out different code. The attacker needs control of that plugin repository, either from the outset or after taking it over. At disclosure, Anthropic had fixed Claude Code in 2.1.179 and OpenAI had fixed Codex in 0.146.0; the other two had not been patched. That status is tied to the report’s publication date, not a claim about their state today.

6. A Worker can now keep its preview state

Worker Previews give a branch its own URL, configuration, Durable Object namespace and Container application. Agents can test a change with persistent preview state without touching production. It was announced on 22 September. The boundary is useful precisely because a preview is more than a static page: OAuth callbacks, state and approvals can run there too.

7. Python Workers moved out of preview

Cloudflare declared Python Workers generally available on 21 September. They run a Pyodide interpreter in WebAssembly; the release adds a route to PostgreSQL and MySQL through Hyperdrive, rather than giving arbitrary Python packages a full native POSIX environment. If your dependency needs a native extension, check that a compatible WebAssembly wheel exists.

8. Cache Rules can now honor selected Vary headers

Cloudflare added Vary support to Cache Rules on every plan. Operators can normalize known request headers, pass exact values to the origin or bypass cache if the variation would create too many one-off keys. A cache that ignores negotiation can give an API client HTML or a browser JSON. The choice of which headers to vary on still belongs to the site operator.

9. Docker moved agent sandboxes off the laptop

Docker Cloud Sandboxes were announced on 24 September for long-running agents on Docker-managed cloud infrastructure. Docker says local and cloud sandboxes share a CLI, policies and microVM isolation. The sales pitch is simple: close the laptop without killing the job. The isolation is Docker’s design claim; don’t mistake an announcement for an independent security assessment.

10. Copilot code-review effort gets an enterprise default

GitHub added personal settings for automatic code reviews and a default review effort for organization-owned repositories, controlled at enterprise level. Individuals can select Lite or Balanced; organizations and repositories may override the enterprise default. It is a configuration change, not proof the reviews are more accurate.

Information Security

11. The F5 access proxy flaw is being exploited

F5 patched CVE-2026-94127 in BIG-IP Access Policy Manager after learning of exploitation. The affected configuration uses the system as an OAuth Authorization Server with an access policy and OAuth profile on the same virtual server. CISA put the flaw in its Known Exploited Vulnerabilities catalog. Check for that configuration before assuming every BIG-IP installation is affected.

12. Canada investigates an ID-check provider

Canada’s privacy regulator opened an investigation of IDScan.net after reports of stolen identity documents. It is examining the company’s safeguards and notifications. Some coverage cites 153 million documents; the regulator has not confirmed that number or reached a conclusion. If a business keeps a copy of an ID after checking it, the data remains at risk long after the check is over.

13. Cloudflare found old tenants’ disk data in Containers

Cloudflare disclosed that a new Containers tenant could, under specific disk-allocation conditions, recover residual blocks from an earlier tenant on the same host. External researchers at Accomplish found it. Cloudflare describes its remediation and says the researchers did not send recovered third-party contents to it and later destroyed the data. This is a cross-tenant isolation failure, not a network break-in against an individual container.

Coming up

28–29 October: GitHub Universe runs in San Francisco and online.

Cheers,
Julian

How this is made

Throughout the week I stumble across a mildly unreasonable number of interesting things, and I forward them instantly to the friend or colleague I think might care – sometimes to their delight, sometimes to their annoyance, and often with no context at all. Heartbeat is the attempt to do that a little better.

Every Friday a small agent I built, Honoka, looks through the places where those links tend to leak out: my private email, work email, Matrix, Mastodon, WhatsApp, Apple Messages, Signal, and the faint imprints on the platen of my Olympia typewriter (still not an API, tragically). It sorts, filters, groups and summarises the week, then hands me a draft.

Honoka is guided by a private corpus of things I have written over the last fifteen years, so it can get closer to how I sound in more-or-less official emails and public notes. I still take a pass by hand: remove things, change sentences, check links, argue with the judgement. Whether that is enough is, frankly, the experiment. Every issue has one item written entirely by hand. If you can reliably spot it, hit reply and judge.