Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Cloudflare’s new MCP controls turn TLS-inspected Gateway traffic into an inventory and policy surface for remote MCP use, while explicitly leaving local stdio, off-network and uninspected traffic outside visibility.
Meta has made the privacy-versus-price trade explicit in its Model API: developers can choose standard pricing or a contributor model ID with steeply discounted inference in exchange for training-data permission. The choice matters for proprietary code, customer data and AI SaaS workloads.
Retention-locked backups are gaining a project-level consequence: Google Cloud plans to create automatic liens that can block project deletion while protected backups remain. Infra teams need to account for this in teardown automation, IAM and recovery design.
The Agent Host’s environment boundary has moved from local Dev Containers to remote development hosts, making persistent coding-agent sessions more portable across real remote projects.
The replacement is not a drop-in path rename: Cloudflare separates domain search, availability checks and registration operations into newer endpoints, so old registrar automation can break after the cutoff.