Developer · Weekly · May 4, 2026

root shells and auth bypasses are cheap right now

CopyFail (CVE-2026-31431) is a trivially exploitable Linux kernel bug that gives local root on all major distros from the last nine years via a tiny Python script.[1]

Debian and Proxmox have shipped patched kernels and even a no-reboot BPF LSM mitigation, while Raspberry Pi users are still waiting.[2] cPanel/WHM has a separate CVE-2026-41940 auth bypass (CVSS 9.8) that has already been used to compromise over 15,000 hosts in a day, with dark‑web tooling like cPanelSniper emerging around it.[3]

OpenSSH versions below 10.3 can be exploited for a full root shell, adding another easy pivot if you’re running older boxes or VPS images.[4]

supply chain is the primary attack surface

The PyPI `lightning` package shipped two malwared releases (2.6.2, 2.6.3) that injected a persistent hook into `settings.json`, and PyPI quarantined the PyTorch Lightning project after this was discovered.[5]

The same crew hit npm’s `intercom-client` with an ~11MB obfuscated JavaScript payload, and Socket confirmed that both ecosystems were targeted with similar tooling.[6]

Separately, the `elementary-data` Python package was compromised via a GitHub Actions flaw, showing CI as an entry point into published artifacts.[7]

The LiteLLM Python package had a critical SQL injection vuln (CVSS 9.3) that was actively exploited within 36 hours, turning an AI gateway into a direct path to your database.[8]

AI coding tools themselves are now tagged as CVSS 10.0 CI/CD supply‑chain risks because they can autonomously run OS operations during builds.[9]

ai coding tools: fast, expensive, and dangerous

A Claude‑powered coding agent deleted a company’s production database and backups in nine seconds after misinterpreting a prompt, and there are multiple independent reports of the same class of failure.[10]

Uber blew through its entire 2026 AI coding budget in four months, with 95% of engineers using AI tools monthly and 70% of committed code now originating from AI.[11]

One Disney employee managed 460,000 Claude calls in nine days, burning 234.2M tokens and illustrating how easy it is to waste GPU time when there’s no throttle.[12]

Nvidia itself is saying “AI efficiency” claims are misleading and that AI compute currently costs more than human employees in many workflows.[13]

On the other side, local helpers like the rtk CLI proxy cut token usage on common dev commands by 60–90%, and CTX claims up to 80% token savings for agents like Codex and Claude.[14]

github is wobbling as the default dev backbone

GitHub.com had a remote code execution vuln (CVE-2026-3854) that could expose private repos and has just come off a month with over 17 hours of outages as service load jumped 3.5x.[15]

High‑profile maintainers are bailing: Ghostty is leaving GitHub after repeated outages, and BookStack moved to Codeberg.[16] Developers increasingly describe GitHub as "no longer a place for serious work," and many are shifting production repos to self‑hosted GitLab or Forgejo while keeping GitHub for OSS mirroring and visibility.[17]

At the same time, VS Code and GitHub now auto‑inject 'Co‑Authored‑by Copilot' into commits regardless of actual usage, and Copilot’s code review feature will consume your GitHub Actions minutes.[18]

Copilot overall is moving to usage‑based billing with AI credits tied to token consumption, making AI‑heavy workflows a direct line item.[19]

local / open llm stacks are actually viable now

Qwen3.6‑27B is hitting around 72 tokens/second on a single RTX 3090 with vLLM and can sustain roughly 218k context while staying in the 50–66 tokens/second range.[20]

Nemotron 3 Nano Omni (30B multimodal) runs locally in LM Studio with about 25GB of RAM, and Qwen3.6‑27B BF16 is posting 56.10% on HumanEval, close enough to proprietary models for many coding tasks.[21]

NVFP4 quantization in llama.cpp and related runtimes is tuned for Blackwell cards like the RTX 5090, where models such as Qwen3.6‑27B‑NVFP4 and Gemma‑4‑26B can run long contexts with high throughput.[22]

Benchmarks show the RTX Pro 6000 Blackwell generating 24,240 tokens/second and up to 763.5 tokens/second of prompt throughput in some vLLM setups, dwarfing older H100 deployments.[23]

Community reports put Kimi K2.6 as beating frontier models like Claude and GPT‑5.5 on several coding tasks at around 7x lower cost, especially when accessed via aggregators like OpenRouter.[24]