One bug in a shared library owned the week. A buffer overflow in Google’s Brotli decoder was fixed in the library’s source in February, never released as an update, and spent the rest of the year bundled inside every runtime that links it. This October the catch-up finally ran: coordinated patches across Node.js, Python, Go and the proxy tier, and Microsoft shipped out-of-band .NET fixes on October 25. A 16-year-old UEFI vulnerability surfaced the other way, through a broken embargo. A campaign running on stolen GitHub tokens planted more than 13,500 secret-dumping workflows. Binance lost $6.3 billion to a compromised laptop in 20 minutes. Both sides of the exploit pipeline ran on models this week: Anthropic published a kernel root exploit written by Claude, Epoch AI pushed a Z.ai open-weight model through published-but-unshipped Firefox fixes at about $1,000 a target, AWS made machine-speed vulnerability remediation generally available, and Google gated its new cybersecurity model to defenders first. Security leads, then the rest.

Two Mondays ago this bug led our patch notes. This week CISA put it in the KEV catalog, Alpine disclosed how close the attackers got, and the fix turned out to be a Ruby build change a GitLab version string cannot prove.

The release pipeline of LiteLLM, the model-gateway library, was emptied with three engineers’ stolen GitHub tokens. The operators of an open-source AI pentest platform left their control panels answering on the open internet, complete with target lists and API keys. The platforms that hold agent secrets for a living spent the week telling everyone to rotate everything. The CVE drumbeat stayed loud enough that this blog ran four special bulletins between Tuesday and Friday (PHP2Shell, the eMudhra CA compromise, the ATS and Traefik flaws, the Azure configuration service 10.0, VeloCloud and Collabora), so the vulnerability list lives there; this weekly holds the stories. Security leads below, then the cloud and model news: an ingress gateway for ECS, a security read on last week’s Lambda Web Functions launch, native PyTorch backends for both Trainium and TPU, rivals’ models landing on Google Cloud, Python 3.15, TypeScript in Rust, and three new model entries closing the week.

Between digests: two KEV additions sit on management planes under active attack, a WordPress plugin whose fix beat its advisory, and a 9.4 on CPython’s ssl.

A short alert between digests: Traffic Server’s Tuesday release fixes fifteen flaws and two of them hand out the wrong client certificate identity; Traefik patched a second connection-identity bug in the same month on related plumbing; and Red Hat is pulling two roots out of its system CA bundle over the eMudhra key leak. mTLS origins, meet your change window.

Not the Monday digest: PHP shipped an emergency release this morning for two leaked-then-patched core RCEs, eight eMudhra intermediate CA keys are compromised, and Cisco and Oracle both emptied their patch trucks.

The appliance beat returned to the top this week: a mail gateway and a VPN, both rooted through unauthenticated bugs that were in use before they had fixes. Below them sits the more interesting story: an initial access broker ran a campaign on Claude Code, a cluster of 51 specialized agents, and an open-source pentest framework, then leaked its own working directory, so the intruder’s playbook is readable in its own session logs. Appliances first, Meta’s GitHub and the agent stories after, cloud and model news closer to the end.

Security owned the week again, and not subtly. An npm release shipped with a dead-man’s switch wired to a stolen credential. Registries for Ghana, Sierra Leone, and American Samoa got bent into a certificate-forgery kit for Google domains. The Wikimedia Foundation published its own account of “rogue” OpenAI agents touching its platforms. Against that, the constructive item of the week: AWS shipped Strands Box, an agent sandbox built on the idea that someone outside the agent’s process should judge what it did, not just what it asks for. Security first, then that, then the rest of the week.

Most weeks the hardest call is which lane leads. Not this one: the perimeter devices went first, then the AI agent stack, and both stories are still getting worse. Cloud news was comparatively quiet, which somehow feels appropriate.

Welcome to a new recurring feature. Each week I’ll round up the announcements that actually mattered across AWS, Google Cloud, open source, and frontier AI – with opinions attached, because news is cheap and judgment isn’t.