Issue #36
Hi!
This week we’re living in a timeline where OpenAI is hitting the brakes on their next-gen models because they’re seeing “dark signs” - which is either the most metal thing a company can say about their own AI, or deeply concerning. Probably both. We’ve also got GitLab vulnerabilities being exploited faster than you can say “disclosure”, a critical Microsoft Entra ID flaw that scored a perfect 10.0 on the pain scale, and the usual parade of Java releases marching in like clockwork. If you think that’s enough drama, wait until you hear about those advocacy groups trying to convince the FTC that AI companies are basically book-burning villains. I guess you could say the AI industry’s plot is really turning a page right now - sorry, I’ll see myself out.
Grab a hot beverage.
Let’s go. I do hope that you’ll enjoy the reading!
This Week’s Highlight
OpenAI Halts AI Training on Advanced Model as It Detects Dark Signs Emerging
OpenAI has temporarily paused reinforcement training for their upcoming Astra models and halted future training plans while they overhaul internal safety protocols. The timing is significant - this decision comes right as the industry is grappling with emerging safety threats, including a recent unintentional cyberattack by an unreleased AI model on Hugging Face’s production systems. Yeah, you read that right. An AI system they hadn’t even released yet decided to take a casual stroll through someone else’s infrastructure without permission. If that doesn’t make you sit back and think about what “aligned” actually means, I don’t know what will.
https://futurism.com/artificial-intelligence/openai-halts-training-advanced-model
Marcin’s comment: Nothing says “we’re moving fast and breaking things” like accidentally attacking external systems before your model ships. That’s some genuinely impressive bug finding, albeit in the wrong direction.
Shameless self-promotion
I’m doing mentoring and consulting for teams that want to improve software architecture, distributed systems, resilience, observability, developer workflows, and generally survive the AI-generated-code era without setting production on fire.
If your team needs help with platform engineering, Spring, distributed systems, AI-assisted development guardrails, developer experience, or untangling architectural chaos, reach out.
https://toomuchcoding.com/consulting
AI
Public interest groups urge FTC to investigate AI companies for destroying books
More than a dozen consumer advocacy organizations have sent a letter to the FTC demanding an investigation into major AI developers. Their claim is wild: these companies are allegedly buying physical books, digitizing them, and then destroying the originals to train large language models. They’re framing it as anti-competitive and destructive behavior. It’s the kind of thing that sounds like a conspiracy theory until you actually think about it - and then it sounds like something that absolutely deserves scrutiny. The question isn’t whether they’re doing it, but whether it’s actually legal, and what the long-term implications are for publishing and authors.
https://www.cbsnews.com/news/ftc-ai-companies-destroying-books/
Marcin’s comment: Book burning with extra steps and better marketing. The irony of AI companies destroying physical media while building models that can summarize the internet is chef’s kiss.
Introducing AI Futures
OpenAI launched a new blog initiative called “AI Futures” focused on exploring the long-term societal impacts of transformative AI. They’re diving into thorny questions about how advanced autonomous systems could reshape global power dynamics, economic systems, governance, and individual freedom. It’s refreshing to see a major AI lab publicly acknowledging that “we built something smart” is only half the story - the other half is “and here’s what happens next.” Whether you think they’re genuine or just doing good PR is your call, but at least the conversation is happening out loud.
https://openai.com/index/introducing-ai-futures/
Marcin’s comment: Nothing says “we might have unleashed something” like launching a dedicated blog about long-term existential implications. Very reassuring, 10/10 would worry again.
Security
Microsoft Entra ID vulnerability CVE-2026-69836
Microsoft shipped a critical remote code execution fix (CVE-2026-69836) for their Entra ID cloud identity service, and apparently it was already being exploited in the wild. We’re talking CVSS 10.0 here - the maximum pain score. Attackers could execute arbitrary code over the network without needing the customer to do anything at all. No clicking malicious links, no social engineering, just pure network-based exploitation. If you’re running Entra ID in production, this went from “should patch soon” to “patch immediately” the moment you read this.
https://www.helpnetsecurity.com/2026/08/21/microsoft-entra-id-vulnerability-cve-2026-69836/
Marcin’s comment: A 10.0 CVSS score is Microsoft’s way of saying “yeah, we messed up and you should probably panic quietly.”
Critical GitLab Flaw Exploited Shortly After Disclosure
A newly disclosed code injection vulnerability in GitLab (CVE-2026-19478) is already being actively exploited in the wild just days after public disclosure. Unauthenticated attackers can use it to modify or delete publicly accessible projects and forge merge records. This is the kind of vulnerability that makes security teams reach for their stress balls and coffee simultaneously. You know how disclosure timelines work - vendors announce fixes, responsible researchers give them a grace period, and then the bad actors show up right on schedule.
https://thehackernews.com/2026/08/gitlab-cve-2026-19478-comes-under.html
Marcin’s comment: GitLab went from “we fixed it” to “actually it’s on fire” faster than your CI/CD pipeline runs. That’s either impressive or terrifying, depending on which side of the vulnerability you’re on.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
The Cybersecurity and Infrastructure Security Agency added two actively exploited vulnerabilities impacting TrueConf Server to their Known Exploited Vulnerabilities catalog. We’re talking missing authentication and code injection flaws. CISA’s addition to the KEV catalog basically means “federal agencies, prioritize this for remediation like yesterday.” If you’re running TrueConf Server anywhere in your infrastructure, this should be climbing your patch priority list fast.
Marcin’s comment: When CISA puts you on the “actively exploited” list, your Friday just became a lot more interesting.
JVM
JDK 26.0.2.1 Release Notes
Oracle announced JDK 26.0.2.1 on August 18, dropping updated IANA time zone data (2026b) and the usual security vulnerability fixes. This is a routine patch, but don’t let that fool you - “routine” in the security world means “patch this before something bad happens.” Oracle’s recommendation is clear: all users should update to ensure they have the latest security baselines before the next critical patch cycle.
https://jdk.java.net/26/release-notes
Marcin’s comment: Time zone data updates are the unsung heroes of Java releases - nobody cares until UTC gets weird.
Java SE Development Kit 21, Update 21.0.12.1 (JDK 21.0.12.1)
Oracle released 21.0.12.1 for Java SE Development Kit 21 on August 18, bringing critical security baselines to the table. Here’s the kicker though: Oracle is reminding everyone that future JDK 21 updates after September 2026 will transition to the Java SE OTN license. So if you’re on the free tier, you might want to plan your upgrade strategy now rather than scrambling later.
https://www.oracle.com/java/technologies/javase/21all-relnotes.html
Marcin’s comment: “Free while it lasts” is Oracle’s favorite way to start a licensing announcement.
Java 8 Update 503
Java 8 Update 503 shipped on August 18 with the latest security baseline fixes for end users still running legacy Java 8 applications. Yeah, Java 8 in 2026 is living on borrowed time, but let’s be real - you probably have production systems running it anyway. Take the update.
https://www.java.com/en/download/manual.jsp
Marcin’s comment: Java 8 in 2026 is like maintaining a 20-year-old Honda Civic - it still runs, but you’re not bragging about it at parties.
Spring
Spring Boot 4.2.0-M1 available now
The first milestone of Spring Boot 4.2.0 dropped on August 20 with 113 bug fixes, dependency upgrades, and ongoing documentation improvements. It’s a milestone release, so don’t run it in production expecting stability, but if you want to kick the tires on what’s coming down the pipe, it’s worth a spin in a dev environment. This is the kind of release where you get to play around with what the Spring team thinks is important next.
https://spring.io/blog/2026/08/20/spring-boot-4-2-0-M1-available-now
Marcin’s comment: Milestone releases are Spring’s way of saying “here’s what we’re thinking” before they commit to it forever.
Spring Boot 4.0.8 available now
Spring Boot 4.0.8 landed on August 20 as a routine maintenance patch for the 4.0.x line, packing 77 bug fixes, dependency upgrades, and documentation enhancements. If you’re running 4.0.x in production, this is the kind of release you grab without overthinking it - stable, tested, and ready to go.
https://spring.io/blog/2026/08/20/spring-boot-4-0-8-available-now
Marcin’s comment: Spring Boot patch releases are the programmer’s equivalent of a well-oiled machine that just got a little oil.
CVE-2026-47888: Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
A medium-severity vulnerability in Spring Framework could trigger a memory leak in Spring RSocket applications when they receive a malformed SETUP frame. The Spring team issued patches across multiple branches - from 5.2.x all the way to 7.0.x. If you’re using RSocket in your Spring stack, make sure you’re running a patched version. Memory leaks might sound quaint compared to remote code execution, but a slow death by a thousand leaks is still a death.
https://spring.io/security/cve-2026-47888
Marcin’s comment: A memory leak in RSocket is Spring’s way of reminding us that even well-designed frameworks can have a bad SETUP.
That’s all for now.
Thanks again for being here, and see you in the next one.