Industry shifts, security alerts, hardware, and AI/ML Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 7-2026bolt1 CRITICAL
article
Automate repository tasks with GitHub Agentic Workflows
TAG: ANNOUNCEMENT
GitHub Agentic Workflows, now in technical preview, brings AI-driven repository automation into GitHub Actions using Markdown-authored workflow files rather than YAML. Workflows run with read-only permissions by default, require explicit "safe outputs" approval for write operations like creating pull requests or commenting on issues, and support pluggable coding agent engines including GitHub Copilot CLI, Claude Code, and OpenAI Codex. The architecture implements defense-in-depth via sandboxed execution, tool allowlisting, and network isolation to guard against prompt-injection attacks. Use cases include continuous triage, documentation sync, CI failure investigation, test coverage improvement, and daily repo health reports. The project is a collaboration between GitHub, Microsoft Research, and Azure Core Upstream, and can be bootstrapped via the gh-aw CLI extension.
BeyondTrust CVE-2026-1731 (9.9) - критична вразливість уже експлуатується, CISA додає нові баги до KEV - HackYourMom
TAG: SECURITY
CVE-2026-1731, a CVSS 9.9 critical unauthenticated remote code execution flaw in BeyondTrust Remote Support and Privileged Remote Access, is being actively exploited in the wild. Attackers, tracked by watchTowr, abuse the get_portal_info function to retrieve an x-ns-company value, establish a WebSocket connection, and execute arbitrary OS commands without authentication. BeyondTrust has released patches: Patch BT26-02-RS for Remote Support (v25.3.2+) and Patch BT26-02-PRA for Privileged Remote Access (v25.1.1+). Simultaneously, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog — CVE-2026-20700 (Apple), CVE-2025-15556 (Notepad++ supply-chain trojanized installers attributed to Chinese group Lotus Blossom, active ~5 months), CVE-2025-40536 (SolarWinds Web Help Desk), and CVE-2024-43468 (Microsoft Configuration Manager SQL injection). Organizations must patch immediately and audit access logs for indicators of compromise.
VS Code becomes multi-agent command center for developers
TAG: RELEASE
VS Code v1.109 (January 2026 release, shipped February 4) transforms the editor into a multi-agent hub by adding public preview support for Anthropic Claude agents via the Claude Agent SDK alongside existing GitHub Copilot and OpenAI Codex. GitHub Copilot Pro+ and Enterprise subscribers can now run Claude and Codex as cloud agents directly within VS Code, while local agent support for Codex requires the Codex extension. A unified Agent Sessions view tracks all local, background, and cloud agent activity from a single dashboard, and parallel subagent execution lets context-isolated subagents run simultaneously without polluting the main session context. VS Code also becomes the first major AI code editor with full MCP Apps support, allowing agents to render interactive UI components — dashboards, forms, and multi-step workflows — inside chat. Agent Skills, Anthropic's open standard for extending AI agents, reaches general availability in this release.
GitHub's former CEO launches a developer platform for the age of agentic coding
TAG: FUNDING
Thomas Dohmke, who left GitHub as CEO in August 2025, has launched Entire — a new open-source developer platform backed by a $60 million seed round (the largest in developer tools history), led by Felicis with participation from Madrona, Basis Set, and Microsoft's venture arm M12. Entire is built as a three-layer stack: a new Git-compatible distributed database at the foundation, a semantic reasoning layer in the middle, and a UI on top. Its first shipping product, Checkpoints, integrates today with Claude Code and Google's Gemini CLI to automatically capture and log agents' reasoning, intent, and outcomes alongside code. Dohmke argues that the critical bottleneck in agentic development is no longer writing code but reviewing it — and that solving this requires preserving the full reasoning chain so humans and future agents can trace why decisions were made. The team plans to expand from 15 to 30 human employees while also scaling to "hundreds of agents," with a permissive open-source license and a hosted service for monetization.
OpenAI has released GPT-5.3-Codex-Spark, a speed-optimized sibling to GPT-5.3-Codex, delivering over 1,000 tokens per second by running on Cerebras' 125-petaflop Wafer Scale Engine 3 — whose chip packs 4 trillion transistors across ~900,000 cores and 27 petabytes per second of on-chip memory bandwidth. Codex Spark targets rapid prototyping and real-time interactive edits; it trades benchmark performance (58.4% on Terminal-Bench 2.0 versus 77.3% for GPT-5.3-Codex) for far lower latency and the ability to interrupt and redirect in mid-generation. At launch it offers a 128,000-token context window and is text-only, with larger model sizes, longer contexts, and multimodal inputs planned. The model is available as a research preview for ChatGPT Pro users in the Codex CLI, VS Code, and the Codex app (now surpassing 1 million downloads); API access is limited to select OpenAI partners, with no public pricing yet. This debut is tied to a multi-year OpenAI–Cerebras partnership reportedly valued at up to $10 billion.
Arcjet reaches v1.0, promises stable security for JavaScript apps
TAG: RELEASE
Arcjet has released v1.0 of its JavaScript SDK, graduating from 2.5 years of alpha and beta to a stable, production-ready API — with only three breaking changes introduced over that entire period. The SDK embeds a WebAssembly (Wasm) module directly into the application, enabling near-native-speed analysis of incoming requests for bot detection, rate limiting, email validation, form spam prevention, and data redaction without routing traffic through a separate security service. Founder and CEO David Mytton emphasizes API stability as a deliberate first-class product requirement, citing "constant version churn" in the JS ecosystem as a key reason security libraries get abandoned. Upcoming features include public release of a local AI model for reducing false positives on sensitive routes, richer threat intelligence surfacing the reasoning behind decisions, and multi-language expansion (Python SDK already in beta; Java and Go planned). Thousands of developers are already running the SDK in production.
Theo reviews Salesforce's quiet killing of Heroku, which entered a "sustaining engineering" maintenance mode — ending enterprise contracts for new customers, cutting over half its team, and abandoning in-progress modernization efforts that were weeks from restarting a free tier. He traces the decline to Salesforce's 2022 acquisition, the consequent elimination of the generous free tier, and a fatal leadership vacuum caused by losing both the CPO and CEO within a four-month window in late 2024. The video also dissects why serverless-first platforms like Vercel and Cloudflare can sustain free tiers (zero cost when idle) while server-provisioning platforms like Heroku and PlanetScale cannot. For current Heroku users, Theo recommends migrating to Railway or Render for VPS workloads, and to Vercel, Netlify, or Cloudflare for serverless deployments.
Automate repository tasks with GitHub Agentic Workflows
GitHub Agentic Workflows, now in technical preview, brings AI-driven repository automation into GitHub Actions using Markdown-authored workflow files rather than YAML. Workflows run with read-only permissions by default, require explicit "safe outputs" approval for write operations like creating pull requests or commenting on issues, and support pluggable coding agent engines including GitHub Copilot CLI, Claude Code, and OpenAI Codex. The architecture implements defense-in-depth via sandboxed execution, tool allowlisting, and network isolation to guard against prompt-injection attacks. Use cases include continuous triage, documentation sync, CI failure investigation, test coverage improvement, and daily repo health reports. The project is a collaboration between GitHub, Microsoft Research, and Azure Core Upstream, and can be bootstrapped via the gh-aw CLI extension.
Theo reviews Salesforce's quiet killing of Heroku, which entered a "sustaining engineering" maintenance mode — ending enterprise contracts for new customers, cutting over half its team, and abandoning in-progress modernization efforts that were weeks from restarting a free tier. He traces the decline to Salesforce's 2022 acquisition, the consequent elimination of the generous free tier, and a fatal leadership vacuum caused by losing both the CPO and CEO within a four-month window in late 2024. The video also dissects why serverless-first platforms like Vercel and Cloudflare can sustain free tiers (zero cost when idle) while server-provisioning platforms like Heroku and PlanetScale cannot. For current Heroku users, Theo recommends migrating to Railway or Render for VPS workloads, and to Vercel, Netlify, or Cloudflare for serverless deployments.
BeyondTrust CVE-2026-1731 (9.9) - критична вразливість уже експлуатується, CISA додає нові баги до KEV - HackYourMom
CVE-2026-1731, a CVSS 9.9 critical unauthenticated remote code execution flaw in BeyondTrust Remote Support and Privileged Remote Access, is being actively exploited in the wild. Attackers, tracked by watchTowr, abuse the get_portal_info function to retrieve an x-ns-company value, establish a WebSocket connection, and execute arbitrary OS commands without authentication. BeyondTrust has released patches: Patch BT26-02-RS for Remote Support (v25.3.2+) and Patch BT26-02-PRA for Privileged Remote Access (v25.1.1+). Simultaneously, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog — CVE-2026-20700 (Apple), CVE-2025-15556 (Notepad++ supply-chain trojanized installers attributed to Chinese group Lotus Blossom, active ~5 months), CVE-2025-40536 (SolarWinds Web Help Desk), and CVE-2024-43468 (Microsoft Configuration Manager SQL injection). Organizations must patch immediately and audit access logs for indicators of compromise.
VS Code becomes multi-agent command center for developers
VS Code v1.109 (January 2026 release, shipped February 4) transforms the editor into a multi-agent hub by adding public preview support for Anthropic Claude agents via the Claude Agent SDK alongside existing GitHub Copilot and OpenAI Codex. GitHub Copilot Pro+ and Enterprise subscribers can now run Claude and Codex as cloud agents directly within VS Code, while local agent support for Codex requires the Codex extension. A unified Agent Sessions view tracks all local, background, and cloud agent activity from a single dashboard, and parallel subagent execution lets context-isolated subagents run simultaneously without polluting the main session context. VS Code also becomes the first major AI code editor with full MCP Apps support, allowing agents to render interactive UI components — dashboards, forms, and multi-step workflows — inside chat. Agent Skills, Anthropic's open standard for extending AI agents, reaches general availability in this release.
GitHub's former CEO launches a developer platform for the age of agentic coding
Thomas Dohmke, who left GitHub as CEO in August 2025, has launched Entire — a new open-source developer platform backed by a $60 million seed round (the largest in developer tools history), led by Felicis with participation from Madrona, Basis Set, and Microsoft's venture arm M12. Entire is built as a three-layer stack: a new Git-compatible distributed database at the foundation, a semantic reasoning layer in the middle, and a UI on top. Its first shipping product, Checkpoints, integrates today with Claude Code and Google's Gemini CLI to automatically capture and log agents' reasoning, intent, and outcomes alongside code. Dohmke argues that the critical bottleneck in agentic development is no longer writing code but reviewing it — and that solving this requires preserving the full reasoning chain so humans and future agents can trace why decisions were made. The team plans to expand from 15 to 30 human employees while also scaling to "hundreds of agents," with a permissive open-source license and a hosted service for monetization.
OpenAI has released GPT-5.3-Codex-Spark, a speed-optimized sibling to GPT-5.3-Codex, delivering over 1,000 tokens per second by running on Cerebras' 125-petaflop Wafer Scale Engine 3 — whose chip packs 4 trillion transistors across ~900,000 cores and 27 petabytes per second of on-chip memory bandwidth. Codex Spark targets rapid prototyping and real-time interactive edits; it trades benchmark performance (58.4% on Terminal-Bench 2.0 versus 77.3% for GPT-5.3-Codex) for far lower latency and the ability to interrupt and redirect in mid-generation. At launch it offers a 128,000-token context window and is text-only, with larger model sizes, longer contexts, and multimodal inputs planned. The model is available as a research preview for ChatGPT Pro users in the Codex CLI, VS Code, and the Codex app (now surpassing 1 million downloads); API access is limited to select OpenAI partners, with no public pricing yet. This debut is tied to a multi-year OpenAI–Cerebras partnership reportedly valued at up to $10 billion.
Arcjet reaches v1.0, promises stable security for JavaScript apps
Arcjet has released v1.0 of its JavaScript SDK, graduating from 2.5 years of alpha and beta to a stable, production-ready API — with only three breaking changes introduced over that entire period. The SDK embeds a WebAssembly (Wasm) module directly into the application, enabling near-native-speed analysis of incoming requests for bot detection, rate limiting, email validation, form spam prevention, and data redaction without routing traffic through a separate security service. Founder and CEO David Mytton emphasizes API stability as a deliberate first-class product requirement, citing "constant version churn" in the JS ecosystem as a key reason security libraries get abandoned. Upcoming features include public release of a local AI model for reducing false positives on sensitive routes, richer threat intelligence surfacing the reasoning behind decisions, and multi-language expansion (Python SDK already in beta; Java and Go planned). Thousands of developers are already running the SDK in production.
Week 7 was one of the most consequential news weeks for the developer tools industry in recent memory. The critical security item demands immediate attention: CVE-2026-1731, a CVSS 9.9 unauthenticated RCE in BeyondTrust Remote Support and Privileged Remote Access, is being actively exploited in the wild, with CISA simultaneously adding four more vulnerabilities — including a Notepad++ supply-chain attack running for five months undetected — to its Known Exploited Vulnerabilities catalog.
The agentic coding wave accelerated on multiple fronts. GitHub Agentic Workflows entered technical preview, offering Markdown-authored CI automation with defense-in-depth against prompt injection. VS Code v1.109 added Claude and Codex as first-class cloud agents with a unified Agent Sessions view and full MCP Apps support. OpenAI shipped Codex Spark, a speed-optimized model exceeding 1,000 tokens per second on Cerebras silicon, targeting rapid interactive edits over raw benchmark scores.
Two strategic business stories bookend the week: Thomas Dohmke's Entire platform — a $60 million seed-funded Git-compatible developer stack with built-in agent reasoning logs — represents the boldest bet on agentic-first tooling yet, while Theo's dissection of Heroku's end-of-life is a cautionary tale about what happens when a platform loses both its free tier and its leadership within months of each other.
Key Takeaways
CVE-2026-1731 (CVSS 9.9) in BeyondTrust is actively exploited — patch to Remote Support v25.3.2+ or PRA v25.1.1+ immediately and audit access logs for the x-ns-company WebSocket indicator.
VS Code v1.109 and GitHub Agentic Workflows both shipped this week, making February 2026 the month the multi-agent IDE stack became a reality rather than a roadmap item.
Heroku's collapse into maintenance mode illustrates a structural truth: server-provisioning platforms cannot subsidize free tiers the way serverless-idle-cost-zero platforms like Vercel can.
