Infra is bifurcating: more workloads are landing on €4 VPSes and Proxmox clusters while AWS quietly makes more of its managed stack and outages your problem. AI is now both a runtime (open models on local GPUs) and a coworker (Copilot/Cursor writing a big chunk of commits), which saves effort but drags in new review and security headaches.
Terraform is still the default IaC, but TypeScript/Kubernetes teams are increasingly kicking the tires on Pulumi instead of more YAML.
Key Events
/AWS Copilot CLI for ECS was officially retired, removing a popular deployment tool.
/RDS MySQL 8.0 left standard support on July 31 and instances were auto-enrolled into paid extended support.
/A 27-year-old auth bypass bug was disclosed in OpenBSD PPP, affecting legacy PPP-based stacks.
/At least 140 npm packages, including mastra-related ones, were compromised via typosquatting and backdoors.
/Gemma 4 E2B hit around 255 tokens/s fully in-browser using WebGPU kernels in a public demo.
Report
Developers are splitting workloads between cheap VPSs, Proxmox clusters, and hyperscalers, while AWS nudges services like RDS MySQL 8.0 into paid extended support.
At the same time, AI is bleeding into every layer—from WebGPU in-browser models and llama.cpp APIs to MCP-connected agents and AI-generated commits—trading raw cloud spend for new operational and security complexity.
hosting and infra drift
Cheap VPSes around €4/month are now the default for small public-facing services, monitoring relays, and especially email, because residential IPs keep getting blocked.
Self-hosters are pushing further with Docker-heavy microclouds and Proxmox clusters, up to Tesco moving roughly 40,000 VMware workloads onto Proxmox VE.
The tradeoff shows up when a cooling failure in an AWS region can still knock out big customers like Coinbase despite all that supposed redundancy.
On the cost side, RDS MySQL 8.0 left standard support on July 31 and instances were auto-enrolled into paid extended support, so do nothing now literally costs more.
Cheap VPSes and homelabs cap long-term spend but inherit hardware, ISP, and noisy-neighbor risk that managed clouds price into their margins.
iac and kubernetes expectations
Terraform is still the default IaC for many application teams, especially where ops teams already share modules and workflows around it.
But there is visible momentum to Pulumi among TypeScript and Kubernetes users, who like real-language IaC and features like `pulumi refresh` to handle drift.
Developers explicitly say Pulumi does not remove the hard parts, because most of the pain comes from the infra model itself rather than from HCL or YAML syntax.
Kubernetes is in the same bucket: people run it from homelab Minisforum boxes to production clusters, but consistently call out the complexity tradeoff versus simpler schedulers.
GitOps, canary deploys, and platform teams are increasingly seen as the normal CI/CD pattern, which quietly raises the baseline skill set expected of senior devs.
auth is standardizing, legacy bugs are biting
Gitea now speaks OIDC with JIT auto-provisioning and account linking, and many setups pair it with Authentik for full SSO, so app code barely touches auth anymore.
LangSmith sandboxes hook into the Harbor framework with streamlined installation and shared auth, reinforcing the pattern of centralizing identity into OIDC/SSO hubs.
Some devs still experiment with self-hosted authenticator apps, but others argue they add little over established password managers like Bitwarden while increasing maintenance.
A 27-year-old authentication bypass in OpenBSD’s PPP stack just surfaced, showing how legacy PPP-based dial-up or VPN paths can hide ancient auth bugs.
People explicitly call standardized auth systems less bug-prone, even as inconsistent 2FA requirements across services remain a day-to-day annoyance.
local and cheap ai runtimes
A WebGPU demo for Gemma 4 E2B runs fully in-browser around 255 tokens per second using custom kernels, and Chromium’s WebGPU enables some laptops and phones to run models locally.
But developers with cards like the RTX 2060 are seeing WebGPU fail due to missing 16-bit ops, and are explicitly steering people toward up-to-date Chrome, Edge, or Safari Tech Preview builds if they try this.
Llama.cpp added model-management APIs for load/unload/download operations and is hitting roughly 26 tokens per second of output and 659 tokens per second for prompt ingestion on a 4080 with aggressive GPU flags.
Lemonade v10.8 adds dynamic VRAM management that unloads idle models and can expose local models as MCP tools, while Differential LoRA cuts VRAM needs for image LoRAs by about half.
In parallel, open-weight models like GLM-5.2 and DeepSeek V4 are benchmarking near frontier proprietary models at much lower unit cost, and even small models have beaten much larger ones on web research tasks.
tooling, supply chain, and ai in the repo
Multiple mastra-related packages and roughly 140 other npm packages were compromised via typosquatting and backdoors, keeping the npm ecosystem squarely in the crosshairs for supply-chain attacks.
Developers note that many MCP server listings ignore build reproducibility and are installed via one-liner `npx` commands, which makes it hard to audit or pin what actually runs in production.
The FortiBleed incident leaked credentials for about 75,000 Fortinet devices, feeding broader anxiety about vendor security posture, including in AI-heavy stacks.
On the workflow side, people report that up to about 60% of their commits now contain AI-generated code from tools like Copilot and Cursor, while Claude Code has been seen to break Git worktrees.
Git’s binary handling and Git LFS unreliability are pushing some teams toward alternative stores like Epic’s Lore or separate asset repos, especially as AI tools touch more non-text artifacts.
What This Means
The stack is fragmenting between cheap local hardware, VPSes, and cloud services, while AI and agent tooling quietly increase the attack surface of everything from auth to npm.
The limiting factor is shifting from access to compute toward how much operational and security complexity teams are willing to absorb in exchange for lower unit costs and faster automation.
On Watch
/Vercel’s new eve agent framework and Agent Stack (AI SDK, AI Gateway, Workflow SDK, Sandbox, Chat SDK, Vercel Connect) may pull a lot of greenfield AI web apps into the Vercel ecosystem if the single-command DX holds up.
/Enterprise and research adoption of LangGraph plus tools like Agent Breaker and LangSmith could make it the default control plane for multi-step agents where evals and debugging are critical.
/Diffusion-style LLMs like Mercury-2 are on the radar as potential alternatives to autoregressive models for certain tasks, and early curiosity about where they outperform is growing.
Interesting
/The cheapest local setup for running GLM 5.x may involve a CPU-only configuration with Sapphire Rapids ES 56core + DDR5.
/Users can rent out their own GPUs on the platform designed for crowdsourcing model development.
/CourtFinder.pro's use of Supabase for real-time functionalities showcases a modern approach to backend development, integrating Postgres and Edge Functions.
/The reliance on Claude Code for feature specification in CourtFinder.pro indicates a trend towards collaborative development tools that enhance team communication.
/Users have noted that while Llama.cpp excels in performance, it demands a more technical setup compared to the more user-friendly LM Studio.
We processed 10,000+ comments and posts to generate this report.
AI-generated content. Verify critical information independently.
/AWS Copilot CLI for ECS was officially retired, removing a popular deployment tool.
/RDS MySQL 8.0 left standard support on July 31 and instances were auto-enrolled into paid extended support.
/A 27-year-old auth bypass bug was disclosed in OpenBSD PPP, affecting legacy PPP-based stacks.
/At least 140 npm packages, including mastra-related ones, were compromised via typosquatting and backdoors.
/Gemma 4 E2B hit around 255 tokens/s fully in-browser using WebGPU kernels in a public demo.
On Watch
/Vercel’s new eve agent framework and Agent Stack (AI SDK, AI Gateway, Workflow SDK, Sandbox, Chat SDK, Vercel Connect) may pull a lot of greenfield AI web apps into the Vercel ecosystem if the single-command DX holds up.
/Enterprise and research adoption of LangGraph plus tools like Agent Breaker and LangSmith could make it the default control plane for multi-step agents where evals and debugging are critical.
/Diffusion-style LLMs like Mercury-2 are on the radar as potential alternatives to autoregressive models for certain tasks, and early curiosity about where they outperform is growing.
Interesting
/The cheapest local setup for running GLM 5.x may involve a CPU-only configuration with Sapphire Rapids ES 56core + DDR5.
/Users can rent out their own GPUs on the platform designed for crowdsourcing model development.
/CourtFinder.pro's use of Supabase for real-time functionalities showcases a modern approach to backend development, integrating Postgres and Edge Functions.
/The reliance on Claude Code for feature specification in CourtFinder.pro indicates a trend towards collaborative development tools that enhance team communication.
/Users have noted that while Llama.cpp excels in performance, it demands a more technical setup compared to the more user-friendly LM Studio.