Cafiyn Pulse
← All issues
Issue 8Week of 26 October 2026Archived

Disconnecting the site did not evict the attacker. GitHub spent Universe week hardening the supply chain.

TeamUpdraft said on 29 October that on some sites hit in the October break in, a plugin the attacker left behind was later used to create an administrator account, after the site had already been disconnected from UpdraftCentral.Revoking access closes the door, it does not evict anyone already inside.Google turned on request storage by default for new paid Gemini projects on 26 October, with the opt out per request.And GitHub shipped four supply chain defences in a fortnight, the strongest of them Enterprise Cloud only.This issue covers 20 to 30 October, the stretch last week's issue did not reach.

This issue is a snapshot of week of 26 october 2026 and is kept as published. Figures and links were accurate at the time and are not updated retroactively. Read the current issue →

Deadlines8

Deadline board

Dated, sourced, and with the first thing to do. Soonest first.

  1. Read onlyOpenAI

    Existing evals in the OpenAI Evals platform become read only

    Do this: Export your eval definitions and results now, because the dashboard and API shut down on 30 November.

    Read the analysisSource: OpenAI, API deprecations
  2. ShutdownGitHub

    GitHub Copilot removes Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra from every Copilot experience

    Do this: Move saved workflows and agent configs to Claude Opus 5.5, GPT-6.1 Sol or GPT-6 Luna. Annual individual plans keep Opus 4.8.

    Source: GitHub, upcoming Copilot model deprecations
  3. PriceOpenAIAt least through

    GPT-5.6 Sol promotional pricing of $4 input and $20 output per million tokens is guaranteed only through this date

    Do this: Model your bill at the earlier price the page implies, $5 and $30, until OpenAI says the promotion is permanent.

    Read the analysisSource: OpenAI, GPT-5.6 Sol model page
  4. ShutdownOpenAI

    Agent Builder, the Evals dashboard and API, and the v1/prompts reusable prompts API shut down

    Do this: Move prompt text into your own code and replace Agent Builder flows with the Agents SDK before the date.

    Read the analysisSource: OpenAI, API deprecations
  5. ShutdownAnthropic

    Claude Sonnet 4.5 (claude-sonnet-4-5-20250929) is retired on the Claude API

    Do this: Switch to claude-sonnet-5-5, which Anthropic names as the replacement, and check your token counts again because the tokenizer changed.

    Read the analysisSource: Anthropic, model deprecations
  6. PriceGoogle

    Gemini 4 Argon moves from $2 input and $10 output to $4 and $20 per million tokens

    Do this: Cost your product at the December price, not the launch price.

    Read the analysisSource: Google, Gemini API pricing
  7. ShutdownOpenAI

    gpt-image-1-mini, gpt-image-1.5 and chatgpt-image-latest are removed

    Do this: Move image calls to gpt-image-2.5-sunburst or gpt-image-2.5-flare, and compare output quality and cost on your own prompts.

    Read the analysisSource: OpenAI, API deprecations
  8. ShutdownOpenAI

    Older GPT-5 and o3 snapshots are removed: gpt-5, gpt-5-mini, gpt-5-nano, gpt-5-pro, o3 and o3-pro

    Do this: Pin the replacement OpenAI names for each snapshot and run your evals before the date.

    Read the analysisSource: OpenAI, API deprecations
Every deadline we trackAdd to your calendar

Hot takes

3

Our read on the week. Opinion, and labelled as such.

Disconnecting a compromised integration does not remove what it installed

Opinion
29 Oct

TeamUpdraft's incident page, updated 29 October, says a small number of sites were compromised in the original incident but showed no obvious sign at the time, and that a plugin the attacker left in place was later used to create a new administrator account, after the site had already been disconnected from UpdraftCentral. Disconnecting stops access through UpdraftCentral, it does not remove anything already installed. It asks anyone who has ever connected a site to run its checks, including sites where nothing looked wrong.

So what

Cleanup after a vendor breach has two halves, and people collapse them into one. Revoking the key closes the route in. Finding what came through it is manual work, and the thing you are looking for is built to sit quietly. List the users, plugins and scheduled jobs on every affected system, compare them with what you expect, and read the access logs. Do the systems that looked fine too.

Source: TeamUpdraft, security incident: what customers need to know

Google stores Gemini requests by default on new paid projects, and the opt out is per request

Opinion
26 Oct

The Gemini API release notes for 26 October say new paid tier projects using the Generate Content API now store requests by default, matching the Interactions API. Existing projects keep their current setting. There are two ways out: set store=false on individual requests, or turn off Generate Content API logging in the Logs and Datasets dashboard.

So what

The trap is the shape of the setting: the default is fixed when the project is created, but the opt out is per request. Set store=false once in the shared client wrapper every call path goes through, rather than at each call site, because one forgotten background job retains what you told users you would not. Then check staging against production, since older projects keep their old setting.

Source: Google, Gemini API release notes

GitHub shipped four supply chain defences this fortnight, and the strongest is Enterprise Cloud only

Opinion
28 Oct

Four releases between 20 and 28 October, not equally available. The package firewall, which blocks packages at install time, is public preview for Enterprise Cloud only, supports npm alone, and is free during the preview but metered at general availability. Actions workflow lockfiles reached general availability on 28 October, including Free and Team plans. Push protection for AI detected secrets is public preview, off by default, and consumes AI credits. Expiring OAuth tokens in the CLI are opt in from v2.103.0.

So what

Two of these cost nothing. Turn on Actions workflow lockfiles for the workflows that hold deploy keys, cloud credentials or publish rights, and run gh auth login --expiring so a leaked token dies in hours. The firewall is the strongest control of the four and the one a solo founder cannot buy; the nearest free approximation is a lockfile plus a habit of not taking a dependency on the day it ships.

Source: GitHub, package firewall in public preview

Post mortems

2

What broke, and the specific thing to check in your own stack.

TeamUpdraft says its customer database was accessed, including UpdraftCentral connection keys

Security
19 Oct

TeamUpdraft, which makes the UpdraftPlus WordPress backup plugin, says it found unauthorised access to teamupdraft.com over the weekend of 17 to 18 October, closed the route and replaced the keys that could have been affected. It believes its customer database was accessed, including hashed passwords, two factor settings and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone, and says no card details are stored. A 21 October update says the attacker used those connections to create admin accounts and install malicious plugins on users' sites, and that the extent is unknown. Plugin updates 1.26.13 and 2.26.13, published on 19 October, revoke the keys.

So what

The action is per site and it is manual. Confirm the plugin is on 1.26.13 or 2.26.13 or later, then open UpdraftCentral through My Account and check every site listed that you did not knowingly connect since 19 October. On each one, look for accounts you did not create, plugins you do not recognise and addresses in the logs you cannot place. Change your teamupdraft.com password, and anywhere you reused it.

Source: TeamUpdraft, security incident: what customers need to know

Google Cloud's London region went down on 20 October, and Google attributed it to power

Outage
20 Oct

Cisco ThousandEyes reports that from about 06:10 UTC on 20 October, Google Cloud's europe-west2 London region saw a complete drop in availability, with network traffic unable to reach the service. Google acknowledged the incident on its status page and attributed it to power related issues. ThousandEyes observed services beginning to recover from about 11:30 UTC, and says Google declared it fully resolved at around 14:00 UTC.

So what

Going multi region is the advice everyone gives and almost nobody at this size should take. The cheaper work is knowing your blast radius: write down which region each service, database, queue and file store actually sits in, because backups often sit beside the thing they back up. Keep your status page and DNS somewhere other than the provider you are reporting on. Then decide what your app does when a dependency is simply gone.

Source: Cisco ThousandEyes, Google Cloud outage analysis, 20 October 2026

Wins

3

Rounds, launches, and benchmarks worth measuring yourself against.

Actions workflow lockfiles are generally available, on Free and Team plans too

Launch
28 Oct

GitHub moved Actions workflow dependency lockfiles to general availability on 28 October, on Enterprise Cloud, Enterprise Cloud with data residency, Team and Free plans. Lockfiles let you keep readable tag and branch references in your workflows while running the exact commits you locked. The gh actions-lock extension generates the lockfile, workflows are onboarded one at a time, and Dependabot regenerates the matching entry in the same pull request when it updates an action.

So what

We covered this in preview on 14 October, and general availability is the signal to onboard the workflows you were waiting on, starting with any that can deploy, publish a package or read a cloud credential. Read the generated pins before you commit them, because the tool locks whatever you point it at. Add the stale lockfile check to CI. The Dependabot behaviour is what makes pinning survive in a small team.

Source: GitHub, Actions workflow lockfiles are generally available

The GitHub CLI can hold expiring, auto refreshing tokens, so a leaked one dies in hours

Security
21 Oct

From GitHub CLI v2.103.0 you can opt in to expiring, automatically refreshing OAuth credentials, in public preview. gh stores an expiring access token alongside a rotating refresh token and refreshes it in the background, so you stay signed in, and GitHub says a leaked access token becomes unusable within hours instead of lasting indefinitely. You opt in per login with gh auth login --expiring, or for every sign in with gh config set expiring_credentials enabled. GitHub says it plans to make this the default.

So what

Turn it on today, because a laptop that has been logged in to gh for two years holds a credential with no expiry on it. The thing to check first is anything that captures a token once and reuses it later: scripts that run gh auth token and store the result will eventually be holding an expired one. Read it fresh each time instead, and run gh auth setup-git if you authenticate to git over HTTPS.

Source: GitHub, CLI expiring and auto refreshing OAuth tokens

Google released a stateless, zero dependency Gemini API client for scripts and CI

Tooling
27 Oct

The Gemini API release notes for 27 October announce the Gemini API CLI in beta, a stateless, zero dependency command line client for AI coding agents, scripts and CI pipelines. Google says you use it on the Interactions API to generate text and media, analyse files and run Gemini managed agents. It is a separate thing from the interactive Gemini CLI coding assistant.

So what

Stateless and zero dependency are the two properties that make a CI step boring: nothing to install into the image beyond the binary, and no session state to carry between runs. If you have shell scripts calling the REST endpoint with curl and hand rolled JSON, this is tidier. Pin the version you test with, and remember the 26 October storage default applies to what you send through it.

Source: Google, Gemini API release notes

On the radar

6

Shifts that have not hit you yet but will.

Existing evals in the OpenAI Evals platform become read only tomorrow, 31 October

Deadline
31 Oct

OpenAI's deprecations page sets 31 October 2026 as the date existing evals in the Evals platform become read only, with the Evals dashboard and API shutting down on 30 November 2026, alongside Agent Builder and the v1/prompts reusable prompts API.

So what

Export your eval definitions and results this week. Read only means you cannot add to them, and the window to pull them out closes on 30 November, when the dashboard and API shut down. Eval history is the asset here: it is the record of what your prompts used to score, and it is what tells you whether a forced model migration made your product worse.

Source: OpenAI, API deprecations

GitHub put a package firewall into public preview, for Enterprise Cloud and npm only

Launch
20 Oct

GitHub introduced a package firewall in public preview on 20 October, citing a flood of malware that runs at package install time, and agents and CI runners that install dependencies without a human in the loop. It sits between your endpoints and the upstream registry, inspecting metadata requests and downloads as an install time policy gate. Policy controls include a configurable cooldown period, Advisory Database checks and supply chain checks such as attestation downgrades. Enterprise Cloud only, npm only, free during the preview and metered at general availability.

So what

On Enterprise Cloud, pilot it on CI runners and coding agents first, because those are the machines that install packages unattended. Set the cooldown period deliberately: it is the single control that would have caught most of this year's npm incidents, where a malicious version is published and pulled within hours. Everyone else can read the policy list as a specification for what to do by hand.

Source: GitHub, package firewall in public preview

Push protection can now block secrets with no recognisable format, off by default

Security
28 Oct

GitHub extended push protection beyond secrets with predefined formats on 28 October. A classifier built with Microsoft Applied Sciences judges how a potential secret is used in the surrounding code, so secrets without a known pattern can be blocked on new pushes, commits made in the UI and file uploads. GitHub says early results more than doubled the number of pushes where push protection caught a secret. It is off by default, needs AI detected secrets and push protection both enabled, and consumes AI credits once you opt in.

So what

This closes the gap that bites small teams: a database URL with the password inline, a webhook signing secret, a private key pasted into a config file, none of which look like a vendor token to a pattern matcher. Enable it where a leak would be expensive and watch the first week of blocks to judge the false positives yourself. It does nothing about secrets already in your history, so the rotation job stands.

Source: GitHub, push protection beyond predefined secret patterns

Dependabot supports pnpm 12, but its default lockfile silently loses security alerts

Breaking change
20 Oct

On 20 October GitHub said Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4. The changelog carries a known limitation: when pnpm writes pnpm-lock.yaml as two YAML documents, which it calls the pnpm 12 default for projects that pin a pnpm version, the dependency graph does not yet detect those dependencies. Version updates still work, but alerts and security updates will not be created for them, and existing alerts may close.

So what

The symptom is an absence, and a quiet security tab reads exactly like a clean one. If you pin a pnpm version through packageManager, upgrading to 12 produces the two document lockfile and you stop being told about vulnerable dependencies without anything appearing to break. Check the dependency graph after the upgrade, and treat alerts that close by themselves as something to investigate rather than as progress.

Source: GitHub, Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4

The GitHub Copilot SDK is becoming the Microsoft Copilot SDK, in phases

Breaking change
28 Oct

GitHub said on 28 October that it is transitioning the GitHub Copilot SDK to the Microsoft Copilot SDK, the programmable interface for the Microsoft Copilot harness, the shared agent foundation used across Microsoft and GitHub products. The repository is moving to the Microsoft organisation and the branding is changing. GitHub says the migration happens in phases, package names may still reference the old SDK, and no immediate changes are required.

So what

Nothing to do today, which is the right amount of work for an announcement with no dates in it, but it is worth a note wherever you track dependencies that are going to move. A repository transfer and a package rename are the two steps that break imports and CI references later. If you are choosing an agent SDK this quarter, read the widening scope as both an argument for its longevity and a warning about whose priorities it will follow.

Source: GitHub, Copilot SDK is becoming Microsoft Copilot SDK

Copilot adds server to server auth, so an agent can run as the organisation

Launch
27 Oct

On 27 October GitHub put server to server authentication for Copilot into public preview, for GitHub Apps installed on organisations. You give the app the read only Copilot Requests permission and pass a short lived installation access token to the SDK, so agents make requests on behalf of an organisation rather than a signed in user. Usage is billed to the organisation that owns the installation, and its model policies, budgets and spending controls apply.

So what

If an automation runs on a founder's personal Copilot credential, which is extremely common in small teams, this is the fix: it stops breaking when that person is on holiday or leaves, and its spend stops being invisible inside one person's usage. The useful detail is app_client_id in the usage reports, since per app attribution is what separates a runaway agent from genuine growth. Set the organisation budget before you move anything over.

Source: GitHub, Copilot supports server to server authentication

Open the tool.

Most of what shows up in Post mortems maps to one of ten categories the Stack Grader already checks.

Check your stack against these failures