Artificial Intelligence
OpenAI teams with Hacktron to probe AI system vulnerabilities
OpenAI announced a partnership with security firm Hacktron to probe its systems for weaknesses, examine integrations with external services, and harden its frontier AI defenses. The collaboration aims to uncover vulnerabilities before they can be exploited and to validate the safety of third-party connections used by OpenAI’s models. The program will involve continuous testing, automated scanning, and coordinated disclosure processes to improve resilience across the model serving stack.
Why it matters: By engaging a dedicated red-team partner, OpenAI can systematically stress-test the attack surface that grows each time a new plugin or API is added. Early detection of flaws reduces the window for misuse, protects downstream applications that rely on the models, and signals a shift toward continuous security validation in large-scale AI deployments.
Source: Partnering with Hacktron to find vulnerabilities in OpenAI’s systems
Google launches Z4M storage-optimized instances for AI/ML workloads
Google has made generally available its Z4M machine series in Compute Engine, offering both VM and bare-metal instances built for AI/ML training and inference workloads. Powered by fifth-gen Intel Xeon Scalable processors, Z4M provides up to 168,000 GiB of local SSD storage and 400 Gbps Cloud RDMA networking. The RDMA capability reduces data-access latency by up to 60% compared to TCP networking. Z4M VMs deliver 875 GiB of local SSD per vCPU, while bare-metal instances give direct hardware access without virtualization overhead for workloads like custom hypervisors or those with specific licensing requirements.
Why it matters: The Z4M series addresses a key bottleneck in large-scale AI/ML workloads where parallel data processing at high volume and high storage throughput are needed to keep GPUs and TPUs fully utilized. By combining large local SSD capacity with low-latency RDMA networking, Google aims to let teams right-size cloud infrastructure for checkpointing, distributed KV cache, and parallel file systems without over-provisioning compute. Bare-metal options further reduce latency for specialized workloads.
Source: Introducing Z4M: storage-optimized compute for AI/ML and parallel file systems
Cloud Computing
AWS EC2 launch failures in US-WEST-2 resolved after EBS provisioning issue
Between 2:35 PM and 4:21 PM PST on November 7, AWS experienced elevated EC2 instance launch failures across all four availability zones in the US-WEST-2 region. The problem affected any service that needed to start new instances, including DataSync and AWS Backup. Engineers traced the root cause to a subsystem that provisions EBS volumes during launch, began remediation at 3:20 PM, and completed full recovery by 4:21 PM. Existing instances and previously created EBS volumes continued running without interruption. AWS advises customers to retry any failed launch requests.
Why it matters: The outage shows how a single storage-provisioning component can block new compute capacity across an entire region, halting workloads that rely on on-demand scaling such as backup jobs, data-transfer tasks, and auto-scaling groups. While running workloads were unaffected, any pipeline that provisions fresh instances during the window would have stalled, potentially delaying deployments, CI/CD runs, and disaster-recovery drills. The incident underscores the importance of designing services to tolerate launch-time failures and of monitoring AWS health dashboards for rapid retry logic.
Source: Service is operating normally: [RESOLVED] Elevated Launch Failures
DevOps
GitHub expands Copilot Code Review API with attribution and granular settings controls
GitHub has added REST and GraphQL endpoints that let administrators manage Copilot code-review policies from the enterprise level down to individual repositories. The API now surfaces explicit attribution fields for each review and comment, reports the review effort used, and lists the skills, MCP servers, and custom instructions that informed a suggestion. Enterprise admins can enable or disable reviews globally, organization admins set default effort and runner configuration, and repository admins control effort level and use of custom tools. The release also includes fixes for billing, automatic reviews, and overall reliability for Copilot Pro, Pro+, Max, Business, and Enterprise plans.
Why it matters: Programmatic policy control lets teams embed AI-review governance into CI/CD pipelines and audit trails, while attribution fields give security and compliance groups a verifiable record of AI-generated suggestions. Granular, non-overridable settings prevent accidental drift between enterprise mandates and project-level configurations. The reliability and billing fixes reduce noisy automated reviews that can waste developer time.
Source: Copilot code review: API management and review overview updates
GitHub expands Copilot dashboard to track chat and agent usage, renames passive user cohort
GitHub has expanded its Copilot impact dashboard to track engagement with Copilot Chat and the VS Code Agents window, bringing the total monitored experiences to nine. The “Passive users” cohort has been renamed “Chat-first users” to describe developers who interact with Copilot but haven’t used a qualifying feature on at least two days within a 28-day window. Enterprise and organization 28-day usage reports now include chat and vscode_agent entries. Adoption phase calculations remain unchanged, meaning the new metrics do not influence adoption status.
Why it matters: The update gives organizations a more complete view of how developers actually use Copilot, especially chat interactions that were previously invisible. Renaming the cohort clarifies that these users are actively engaging with AI assistance, even if they don’t meet the threshold for formal adoption phases. However, since chat and agent usage still don’t count toward adoption metrics, teams should not expect changes in reported adoption rates.
Source: Copilot impact dashboard adds chat and VS Code agent usage
GitHub Copilot adds Agent Merge, session tools, and unified CLI settings
GitHub Copilot’s November 2 release expands the AI assistant to JetBrains Air and Xcode, adds an Agent Merge button that automatically merges pull requests once checks pass, and lets reviewers request additional reviews or quote comments directly in Copilot chats. The update also introduces conversation compaction when context limits are hit, drag-and-drop file sessions, CSV/TSV table views, bulk session archiving and pinning, more than ten custom My Work views, opt-in personal instructions for assisted approvals, and a unified /settings dashboard in the CLI for plugins and MCP servers.
Why it matters: These changes reduce friction in code-review workflows by letting Copilot handle merge automation and reviewer interactions, while session-management improvements keep long-running AI chats usable. The unified CLI settings surface plugin and MCP configuration in one place, simplifying setup for teams that embed Copilot in CI/CD pipelines. Opt-in personal approval rules give developers finer control over automated tool actions without imposing organization-wide policy changes.
Source: GitHub Copilot weekly releases — November 2
Cybersecurity
SonicWall SSLVPN flaw added to CISA exploited list, bypasses SAML and MFA
SonicWall has added CVE-2026-19868 to the CISA Known Exploited Vulnerabilities catalog. The flaw resides in SonicOS SSLVPN and stems from a single-factor authentication weakness. An attacker who possesses valid credentials for an alternative authentication method can circumvent SAML-based authentication controls, and the same weakness can also defeat SAML-enforced multi-factor authentication. The entry indicates the vulnerability is actively exploited in the wild as of November 2026.
Why it matters: The vulnerability lets authenticated users sidestep SAML checks, effectively neutralising a primary identity-verification layer that many organisations rely on for remote access. Because the flaw also defeats MFA enforced through SAML, administrators cannot depend on the second factor to block unauthorized entry. Security teams should prioritize patching or compensating controls for any SonicOS SSLVPN deployment, especially where SAML is the sole federation mechanism.
Source: SonicWall SonicOS SSLVPN: CVE-2026-19868 added to CISA Known Exploited Vulnerabilities