Technology worth knowing today.
Artificial Intelligence
OpenAI scales Habitat storage to serve 1B ChatGPT users at 22M RPS
What happened. OpenAI has turned its Habitat project, originally a Python library, into a globally distributed storage platform that now supports more than one billion ChatGPT users and handles roughly twenty-two million requests per second. The evolution involved re-architecting the system for massive scale, adding multi-region replication, and optimizing metadata handling to keep latency low while serving the continuous stream of model inference traffic.
Why it matters. The shift demonstrates how AI-driven workloads can push storage infrastructure beyond traditional limits, requiring designs that combine horizontal scaling, geo-distribution, and low-latency metadata services. For teams building or operating large-scale model serving platforms, Habitat’s trajectory offers a concrete reference for capacity planning, consistency trade-offs, and the operational tooling needed to sustain billions of daily interactions.
Who should care. Developers · Cloud architects · Platform engineers · Data engineers · Technology leaders · People learning AI · Students and career changers
Source: OpenAI
Cloud Computing
Cloudflare Adds Automatic Remediation to CASB for SaaS Security
What happened. Cloudflare has added automatic remediation policies to its Cloud Access Security Broker (CASB), enabling security teams to configure event-driven actions that revoke risky file shares and send custom webhooks immediately after a finding appears. The feature builds on the existing clientless integration that continuously scans SaaS applications such as Google Workspace for overshared files, dormant admin credentials, and over-privileged OAuth apps. Previously, CASB only surfaced findings, leaving administrators to act manually.
Why it matters. Automatic remediation closes the detection-to-action gap that previously let misconfigurations persist for hours or days, reducing the window for sensitive data exposure. By turning findings into immediate, policy-driven responses, organizations can enforce consistent SaaS hygiene without adding manual workload, which is especially valuable for teams managing large, dynamic Google Workspace or similar environments.
Who should care. Security teams · Administrators · Cloud architects · Platform engineers · Technology leaders
Source: Cloudflare
Cybersecurity
CISA Adds ConnectWise ScreenConnect Flaw to Known Exploited Vulnerabilities List
What happened. CISA has added CVE-2026-84869, a vulnerability in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities catalog. The flaw combines improper privilege management with missing authorization checks, enabling an attacker to perform file transfers and execute code within an active remote session without needing authorization or host confirmation. The vulnerability affects ScreenConnect instances where remote sessions are active, potentially allowing unauthorized actions during legitimate support or administrative connections.
Why it matters. Because the flaw lets an attacker hijack an ongoing remote session to transfer files and run commands without any prompt, it undermines the trust model of remote support tools. Organizations using ScreenConnect for IT administration or customer support could see unauthorized changes or data access during legitimate sessions. The inclusion in CISA's KEV list signals active exploitation, raising urgency for detection and patching.
Who should care. Security teams · Administrators · Developers · Platform engineers
Source: CISA
CISA adds JFrog Artifactory privilege-escalation flaw to Known Exploited Vulnerabilities
What happened. CISA added CVE-2026-42016, an incorrect authorization flaw in JFrog Artifactory, to its Known Exploited Vulnerabilities catalog. The vulnerability arises because the token validation logic checks only the signature and issuer, omitting verification of the token’s scope. As a result, a holder of a valid token can obtain higher privileges than originally granted, enabling privilege escalation within the platform in production environments.
Why it matters. Because Artifactory is widely used for artifact storage and build pipelines, a privilege-escalation flaw can let an attacker manipulate stored packages, alter build metadata, or gain administrative control over the repository. The inclusion in CISA’s list signals active exploitation, urging operators to assess exposure and apply vendor patches promptly.
Who should care. Developers · Platform engineers · Security teams · Administrators · Cloud architects
Source: CISA
GitLab CVE-2026-85706 Added to CISA Exploited Vulnerabilities List
What happened. GitLab Community and Enterprise Editions have been added to CISA's Known Exploited Vulnerabilities catalog for CVE-2026-85706. The flaw is a path-traversal issue in the repository commits API that lets an unauthenticated attacker read arbitrary files because the API does not properly confine paths or enforce authentication. The vulnerability stems from missing authentication checks and insufficient path validation, allowing remote file disclosure without credentials.
Why it matters. Because the API is reachable without authentication, any internet-facing GitLab instance can be probed for sensitive configuration files, source code, or secrets, expanding the attack surface for organizations that rely on GitLab for CI/CD and source-control. The inclusion in CISA's exploited list signals that threat actors are already leveraging the flaw, so teams must prioritize patching and monitor for unusual file-read activity.
Who should care. Developers · Security teams · Administrators · Platform engineers · Technology leaders
Source: CISA