Industry shifts, security alerts, hardware, and AI/ML Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 16-2026
article
Axios CVE-2026-40175: A Critical Bug That's Not Exploitable
TAG: SECURITY
CVE-2026-40175, rated 10/10 CVSS, describes a gadget-chain attack in Axios that theoretically chains prototype pollution through CRLF header injection into request smuggling, an AWS IMDSv2 bypass, and credential theft. In practice, however, Node.js has rejected CRLF characters in HTTP headers at the runtime level for years, throwing a TypeError before any malicious request is sent. Bun and Deno behave identically. Aikido confirmed this directly with the reporting researcher, Raul Vega Del Valle, who stated the chain is not realistically reachable in standard environments. The vulnerability is real at the Axios library level — it previously accepted unsafe header values — but exploitation requires a custom adapter that bypasses Node's built-in HTTP client entirely, a highly non-standard configuration. Developers should upgrade to Axios 1.15.0 or later and audit dependencies for prototype pollution, but this is not a drop-everything emergency.
Linux 7.0 has shipped, carrying two notable non-technical milestones: Rust support is no longer considered experimental in the kernel, and an official policy on AI-generated code contributions is now in place. Igalia, one of the most active external contributors to this release, landed 52 authored patches spanning AMD and Intel display driver fixes, DRM TTM memory safety improvements, and Raspberry Pi pmdomain and vc4 reliability fixes. Igalia also introduced new BPF helper APIs — bpf_in_nmi(), bpf_in_hardirq(), bpf_in_serving_softirq(), and bpf_in_task() — for the sched_ext scheduler framework, enabling BPF programs to detect their execution context and make more precise scheduling decisions for gaming workloads via scx_lavd. Additional contributions include resolving race conditions in the thermal subsystem, Bluetooth stack fixes, and documentation improvements for exportfs and the GPU subsystem.
The End of Seats: Pricing Netlify for 3 Billion Builders
TAG: INDUSTRY
Netlify has eliminated seat-based pricing from its Pro plan, moving from $20 per seat per month to a flat $20/month with unlimited seats and unlimited Git contributors. The company also rebalanced its credit-based usage meters: bandwidth doubles from 10 to 20 credits per GB, compute doubles from 5 to 10 credits per GB-Hour, web requests drop from 3 to 2 credits per 10k, and form submissions are now free. Extra credit packs are priced at $10 for 1,500 credits, making bandwidth $0.13/GB and compute $0.07/GB-Hour. Netlify projects 98% of existing customers will see their bills stay flat or decrease. The change is driven by the company's observation that 65% of the 40,000 people signing up daily are new to web development, and that AI code agents have fundamentally changed who builds software — requiring pricing that scales across entire teams rather than individual developer seats.
Windsurf 2.0: Agent Command Center and Devin Integration
TAG: AI
Windsurf 2.0 introduces the Agent Command Center, a Kanban-style interface inside the IDE that surfaces every running agent — local and cloud — organized by status. The update also introduces Windsurf Spaces, which group agent sessions, PRs, files, and project context into a single view that persists between sessions and transfers context to new agents automatically. Most significantly, Devin, the autonomous cloud software-engineering agent from Cognition, is now integrated directly into Windsurf and included with every plan. Engineers can draft a plan with a local agent, then delegate implementation to Devin with a single click; Devin spins up its own VM with a browser and desktop and continues working independently. The resulting pull request can be reviewed, tested, or handed off to a local agent for final edits without leaving the editor. Devin Cloud access is rolling out gradually.
GitHub's deployment infrastructure faces a classic circular dependency problem: deploying GitHub requires access to GitHub itself, so an outage can block its own remediation. To address this systematically, GitHub built a host-based deployment safety system using eBPF. Using the BPF_PROG_TYPE_CGROUP_SKB program type with the cilium/ebpf Go library, the team attaches network egress filtering to the cgroup of a deployment script rather than the entire host, allowing production traffic to continue unaffected. A companion BPF_PROG_TYPE_CGROUP_SOCK_ADDR program intercepts DNS queries and redirects them to a userspace DNS proxy that enforces a domain blocklist. A third eBPF map correlates DNS transaction IDs to process IDs via /proc, logging exactly which command triggered a blocked request. After a six-month rollout, the system is live and has improved mean time to recovery by eliminating circular dependency surprises during incidents.
For-Profit Companies Should Pay the People Who Build OSS
TAG: OPEN SOURCE
Ubugeeei, Chief Engineer at Mates Inc., argues that for-profit companies have a moral and practical obligation to financially compensate OSS authors, maintainers, and core contributors — not as charity, but as an ordinary cost of business comparable to SaaS subscriptions or hiring fees. The author observes that in the Japanese tech community, event sponsorships are common while direct maintainer support remains rare, despite the fact that the invisible labor of reading issues, managing breaking changes, and writing release notes underpins commercial products worldwide. Individual sponsorships via GitHub Sponsors provide emotional support but rarely sustain a living. The author proposes a model of distributed, one-time corporate contributions — amounts such as 50,000–150,000 JPY per company, arriving irregularly from many companies — which avoids creating dangerous single-sponsor dependencies while providing meaningful income. The author reports having successfully proposed this idea internally at Mates Inc.
Claude Opus 4.7: A New Frontier in Performance and Drama
AI Explained covers Claude Opus 4.7, which introduces adaptive thinking — the model decides autonomously how much inference compute to spend on a task, making extended thinking opt-in at high/max effort rather than always-on. On standard benchmarks Opus 4.7 beats Opus 4.6 on most tasks but trails the unreleased Mythos preview; on agentic web search (BrowseComp) and cybersecurity vulnerability reproduction it actually regresses, the latter intentionally per page 48 of the system card. On vibe coding Opus 4.7 leads all models including GPT-5.4. Anthropic has reportedly crossed a $1 trillion valuation milestone. OpenAI's leaked internal memo accuses Anthropic of a compute shortage that is causing throttling and rate limits, and Greg Brockman explains that OpenAI fell behind in coding because they trained on abstract competitions rather than messy real-world codebases — a gap he claims they have now closed. The video also details the 9-year personal rivalry between Dario Amodei and Greg Brockman dating back to 2017.
Axios CVE-2026-40175: A Critical Bug That's Not Exploitable
CVE-2026-40175, rated 10/10 CVSS, describes a gadget-chain attack in Axios that theoretically chains prototype pollution through CRLF header injection into request smuggling, an AWS IMDSv2 bypass, and credential theft. In practice, however, Node.js has rejected CRLF characters in HTTP headers at the runtime level for years, throwing a TypeError before any malicious request is sent. Bun and Deno behave identically. Aikido confirmed this directly with the reporting researcher, Raul Vega Del Valle, who stated the chain is not realistically reachable in standard environments. The vulnerability is real at the Axios library level — it previously accepted unsafe header values — but exploitation requires a custom adapter that bypasses Node's built-in HTTP client entirely, a highly non-standard configuration. Developers should upgrade to Axios 1.15.0 or later and audit dependencies for prototype pollution, but this is not a drop-everything emergency.
Claude Opus 4.7: A New Frontier in Performance and Drama
AI Explained covers Claude Opus 4.7, which introduces adaptive thinking — the model decides autonomously how much inference compute to spend on a task, making extended thinking opt-in at high/max effort rather than always-on. On standard benchmarks Opus 4.7 beats Opus 4.6 on most tasks but trails the unreleased Mythos preview; on agentic web search (BrowseComp) and cybersecurity vulnerability reproduction it actually regresses, the latter intentionally per page 48 of the system card. On vibe coding Opus 4.7 leads all models including GPT-5.4. Anthropic has reportedly crossed a $1 trillion valuation milestone. OpenAI's leaked internal memo accuses Anthropic of a compute shortage that is causing throttling and rate limits, and Greg Brockman explains that OpenAI fell behind in coding because they trained on abstract competitions rather than messy real-world codebases — a gap he claims they have now closed. The video also details the 9-year personal rivalry between Dario Amodei and Greg Brockman dating back to 2017.
Linux 7.0 has shipped, carrying two notable non-technical milestones: Rust support is no longer considered experimental in the kernel, and an official policy on AI-generated code contributions is now in place. Igalia, one of the most active external contributors to this release, landed 52 authored patches spanning AMD and Intel display driver fixes, DRM TTM memory safety improvements, and Raspberry Pi pmdomain and vc4 reliability fixes. Igalia also introduced new BPF helper APIs — bpf_in_nmi(), bpf_in_hardirq(), bpf_in_serving_softirq(), and bpf_in_task() — for the sched_ext scheduler framework, enabling BPF programs to detect their execution context and make more precise scheduling decisions for gaming workloads via scx_lavd. Additional contributions include resolving race conditions in the thermal subsystem, Bluetooth stack fixes, and documentation improvements for exportfs and the GPU subsystem.
The End of Seats: Pricing Netlify for 3 Billion Builders
Netlify has eliminated seat-based pricing from its Pro plan, moving from $20 per seat per month to a flat $20/month with unlimited seats and unlimited Git contributors. The company also rebalanced its credit-based usage meters: bandwidth doubles from 10 to 20 credits per GB, compute doubles from 5 to 10 credits per GB-Hour, web requests drop from 3 to 2 credits per 10k, and form submissions are now free. Extra credit packs are priced at $10 for 1,500 credits, making bandwidth $0.13/GB and compute $0.07/GB-Hour. Netlify projects 98% of existing customers will see their bills stay flat or decrease. The change is driven by the company's observation that 65% of the 40,000 people signing up daily are new to web development, and that AI code agents have fundamentally changed who builds software — requiring pricing that scales across entire teams rather than individual developer seats.
Windsurf 2.0: Agent Command Center and Devin Integration
Windsurf 2.0 introduces the Agent Command Center, a Kanban-style interface inside the IDE that surfaces every running agent — local and cloud — organized by status. The update also introduces Windsurf Spaces, which group agent sessions, PRs, files, and project context into a single view that persists between sessions and transfers context to new agents automatically. Most significantly, Devin, the autonomous cloud software-engineering agent from Cognition, is now integrated directly into Windsurf and included with every plan. Engineers can draft a plan with a local agent, then delegate implementation to Devin with a single click; Devin spins up its own VM with a browser and desktop and continues working independently. The resulting pull request can be reviewed, tested, or handed off to a local agent for final edits without leaving the editor. Devin Cloud access is rolling out gradually.
GitHub's deployment infrastructure faces a classic circular dependency problem: deploying GitHub requires access to GitHub itself, so an outage can block its own remediation. To address this systematically, GitHub built a host-based deployment safety system using eBPF. Using the BPF_PROG_TYPE_CGROUP_SKB program type with the cilium/ebpf Go library, the team attaches network egress filtering to the cgroup of a deployment script rather than the entire host, allowing production traffic to continue unaffected. A companion BPF_PROG_TYPE_CGROUP_SOCK_ADDR program intercepts DNS queries and redirects them to a userspace DNS proxy that enforces a domain blocklist. A third eBPF map correlates DNS transaction IDs to process IDs via /proc, logging exactly which command triggered a blocked request. After a six-month rollout, the system is live and has improved mean time to recovery by eliminating circular dependency surprises during incidents.
For-Profit Companies Should Pay the People Who Build OSS
Ubugeeei, Chief Engineer at Mates Inc., argues that for-profit companies have a moral and practical obligation to financially compensate OSS authors, maintainers, and core contributors — not as charity, but as an ordinary cost of business comparable to SaaS subscriptions or hiring fees. The author observes that in the Japanese tech community, event sponsorships are common while direct maintainer support remains rare, despite the fact that the invisible labor of reading issues, managing breaking changes, and writing release notes underpins commercial products worldwide. Individual sponsorships via GitHub Sponsors provide emotional support but rarely sustain a living. The author proposes a model of distributed, one-time corporate contributions — amounts such as 50,000–150,000 JPY per company, arriving irregularly from many companies — which avoids creating dangerous single-sponsor dependencies while providing meaningful income. The author reports having successfully proposed this idea internally at Mates Inc.
The week's most-discussed security story was CVE-2026-40175, a CVSS 10/10 rating for Axios describing a gadget-chain attack through CRLF header injection, request smuggling, and AWS IMDSv2 bypass. However, Aikido confirmed with the reporting researcher Raul Vega Del Valle that Node.js, Bun, and Deno all reject CRLF characters in HTTP headers at runtime, making the chain unreachable in standard environments. The practical advice is to upgrade to Axios 1.15.0+ and audit for prototype pollution, but this is not a drop-everything emergency.
Netlify eliminated seat-based pricing from its Pro plan, moving to a flat $20/month with unlimited seats and Git contributors. The company cites that 65% of the 40,000 daily sign-ups are new to web development and that AI code agents have fundamentally changed who builds software. Windsurf 2.0 launched with an Agent Command Center for managing local and cloud agents, Windsurf Spaces for persistent project context, and direct integration of Cognition's Devin into every plan.
Linux 7.0 shipped with Rust support graduating from experimental to stable in the kernel, plus an official policy on AI-generated code contributions. Igalia contributed 52 patches and introduced new BPF helper APIs for the sched_ext scheduler framework. Claude Opus 4.7 introduced adaptive thinking — autonomous compute allocation per task — leading all models on vibe coding benchmarks while Anthropic's valuation reportedly crossed $1 trillion.
Key Takeaways
CVE-2026-40175 in Axios carries a CVSS 10/10 score but is not practically exploitable in standard Node.js, Bun, or Deno environments — upgrade to Axios 1.15.0+ but do not treat it as a critical incident.
Netlify's switch from per-seat to flat $20/month pricing reflects the AI agent era: when agents are the builders, per-developer pricing no longer maps to actual product creation costs.
Linux 7.0 making Rust a non-experimental first-class kernel language is a landmark — the kernel's AI-generated code policy arriving in the same release signals how seriously the ecosystem is treating both shifts.
