On October 29, Anthropic launched the Usage and Cost Analytics API for Claude Platform in beta: two new endpoints, /v1/organizations/analytics/usage and /v1/organizations/analytics/cost, that report an organization's tokens and cost and let you group them by model, workspace, API key, or the user or service account that made each request. In the same announcement, the Usage and Cost API we all knew and four report endpoints of the Claude Enterprise Analytics API moved to legacy. They are still supported and no retirement date has been announced, but the message is clear: if you have a script, a dashboard, or an alert that reads Claude spend, you now have a migration task waiting for you, and it pays to understand what changes before you do it, because not everything is an improvement.
Cloudflare published its DDoS threat report for the third quarter of 2026, and the headline fits in one sentence: there are far more attacks, but they're smaller and shorter. In July, August, and September, its network mitigated 18.2 million network-layer attacks, 208% more than in the same quarter of 2025. 96% lasted less than 10 minutes and 98% stayed below 1 Gbps. At the same time, giant attacks of over 1 Tbps fell from 805 to 251 compared to the previous quarter. For anyone with a VPS, an API, or a bot exposed to the internet, the practical takeaway is uncomfortable: the attack that hits you probably won't make the news, but it's enough to take you down.
Twilio moved four Conversation Relay features for AI voice bots to GA: changing language and voice mid-call, reconnecting the WebSocket after a redeploy without losing the call, filtering the agent's own echo, and using ElevenLabs v3 and v4 Turbo.
On October 30, 2026, Anthropic announced that fast mode for Claude Opus 4.8 is deprecated and will be retired on November 30, 2026. From that date on, any request to claude-opus-4-8 with speed: "fast" will return an error. Anthropic's own recommended way out is to migrate to Claude Opus 5.5, which does keep fast mode. If you have an agent, a bot, or a coding tool that depends on Opus 4.8 spitting out tokens at full speed, you have one month to move. And the change is not just swapping the model name.
On October 30, 2026, Cloudflare announced the general availability of Cloudflare services for private origins: you can now create a proxied DNS record (the orange cloud) that points to a private IP, like 10.0.0.50, and Cloudflare reaches that server through the private connection you already have with its network, not over the Internet. The origin stays without a public IP and without an open port, but it gets the same WAF, cache, bot management, rate limiting, and Workers as any public site. For anyone with internal APIs, AI agent backends, or MCP servers that need to receive traffic from the outside, this matters: it removes the excuse of "we don't protect this because it's not on the Internet." That said, it's not a switch for everyone, and that's where the fine print comes in.
On October 30, 2026, a researcher at the security firm Binary Security published part three of their Azure's Weakest Link series, and the summary fits in one line: they found five critical privilege escalation vulnerabilities in Azure API Connections, the piece Logic Apps use to talk to other services. Each one allowed the same thing: taking the connection of another Azure customer, in another tenant, and using their credentials against their backend. That includes reading secrets from someone else's Key Vault or writing to an Azure SQL database that isn't yours. According to the author, all of them have been fixed and the bounties added up to 200,000 dollars. If you have Logic Apps flows connected to anything important, this isn't just gossip: it explains where the risk lives in this kind of integration.
If you use Cursor and have the Claude Code extension installed, stop what you're doing and check your machine. On October 29, 2026, for about eleven hours, the Cursor Extensions Marketplace distributed a tampered copy of Anthropic.claude-code, versions 2.1.312 and 2.1.313 for macOS and Windows, which tries to leave an SSH backdoor on your computer. Cursor has already pulled those versions and taken down the attacker's server, but there's one detail that changes everything: uninstalling the extension does not clean up your machine. The malicious code leaves persistence scripts behind that keep running on their own.
The Meta Social Technologies MCP added six tools to create apps, Business Portfolios and add the WhatsApp use case from an AI agent. Together with the WhatsApp Business Tools MCP, it covers almost the entire bot setup, with confirmations and limits worth knowing about.
PHP2Shell is no longer a theoretical advisory. On October 26, 2026, the Dream research team published artifacts from a campaign that chained the two critical PHP vulnerabilities patched on October 21 (CVE-2026-109618 and CVE-2026-109619) with Fragnesia, a Linux kernel flaw, to get root on 25 servers. Three of them belong to an environment Dream describes as affiliated with the US government. It all started with a single HTTPS request, no credentials, against a firewall administration interface exposed to the internet. If you run servers with PHP or devices with a web panel, this is the practical version of why you don't put off a patch.
Meta deprecated the conversation_analytics field of the WhatsApp API on October 27, 2026, and it stops being available on November 1. The replacement is pricing_analytics, which counts delivered messages and adds volume tiers.
On October 29, Mistral released the weights of Mistral Large 4, its biggest model: one trillion parameters (a trillion in English), multimodal, with a one-million-token context window, under a license that lets you use it, modify it and sell it, with one important exception. It's the upgraded version of the model the French company previewed earlier this month, and Mistral itself nicknames it "Le Chonk". For anyone building agents, bots or coding tools, the news has two sides: there is an open Western model that competes in programming, but running it at home is still something very few people can do.
Since October 27, 2026, Direct Send no longer detects the OTP in text authentication messages or adds the copy code button on its own. To get the button, you have to send an interactive message with the code in otp.code.
Google introduced Gemini 4 Carbon on October 28, its new frontier model, barely two weeks after launching Gemini 4 Argon. The company describes it as its strongest model, with cybersecurity and long-task capabilities that, by its own numbers, are at the highest level ever measured. The detail that matters most if you write code: you can't use it yet. Google is releasing it first to a group of cybersecurity defenders and gave no date for developers, businesses, or consumers.
On October 26, Cloudflare published an incident report that anyone serving language models to multiple customers on the same infrastructure should read. Between August 27 and September 9, 2026, the Workers AI GLM-5.3 model (@cf/zai-org/glm-5.3) returned responses to some customers that contained data from other customers' requests made to the same model shortly before. According to Cloudflare, 155 responses were affected, all to prompts longer than 681,280 tokens. The cause was a combination of a misconfiguration on their side and a bug in SGLang, the open-source inference engine they use. The report came out as a coordinated disclosure with the SGLang team, which published its own technical analysis the same day.
