TLDR IT 2026-09-30

Microsoft is splitting Copilot pricing in two. A per-user subscription still covers "Everyday AI" in Office apps, while agentic features like Cowork, Code, Autopilot, and frontier models are billed by usage on top of the seat. Admins get spending caps and alerts, but budgets that were fixed per head now have to absorb costs from agents that run without a user prompting them.

NVIDIA's Open Agent Safety Platform pairs OpenShell, an Apache 2.0 sandboxed runtime that turns operator instructions into verifiable file, network, tool, and credential policies, with Sentry, a monitor that runs on BlueField-4 DPUs. In Vera Rubin PODs, the DPU sits on the node's only path to the model, so it can enforce policy at line speed outside the agent's reach. NVIDIA's argument is that agents can't be trusted to govern themselves, so safety controls have to sit below them in hardware.

Missile and drone strikes during the March 2026 Iran conflict hit AWS facilities in the UAE and Bahrain. AWS says the damage exceeded what its multi-AZ design can withstand, and restoration isn't expected until early 2027. The piece argues that availability zones don't fail independently when a whole region is physically attacked, and that continuity plans should account for that.

Vincenzo Iozzo tested Jev, a specialized classification model, on matching accounts across systems to the same person in five real organizations. Jev scored 0.948 F1 on large orgs at $0.62 per 1,000 accounts, beating Claude Haiku 4.5 (0.894 F1, 19x the cost) and Sonnet 5 (0.911 F1, 47x the cost) at roughly a tenth of their latency. His conclusion is that small calibrated models beat prompted frontier LLMs on bounded, high-volume security classification.

WSLC, Microsoft's native way to run Linux containers on Windows, is now generally available through a new wslc.exe command. Each session gets its own storage VHD, stronger isolation, and a new networking model compared with standard WSL. The code is open source in the microsoft/wsl GitHub repository.

Cloudflare's Threat Signals uses agentic skills to read open-source threat reports from RSS feeds, summarize them, extract indicators of compromise, and tag threats. It then links those findings to WAF rules while keeping the context of the original source. Cloudflare also made its Threat Events Platform free for every account, with paid tiers for more feeds, proprietary data, and custom skills.

A new Google support page for enterprise and education customers says ChromeOS support will continue through mid-2034, and newer Chromebooks will be migrated to the Android-based Googlebook OS. This is a problem for schools, because Googlebooks start at $899 and won't have comparable management tools for a year or more.

Cloudflare is becoming a certificate authority that issues Merkle Tree Certificates for free, and it is targeting Chrome's quantum-resistant root store in early 2027. Post-quantum signatures are about 40x larger than classical ones, so MTCs batch many certificates under a single CA signature and build transparency logging into issuance. In a Chrome experiment covering 50% of Beta users, the lightweight MTC format already made handshakes 9% faster.

A finished hyperscale region can sit idle for 6 to 12 months because hundreds of interdependent services have to come up in the right order, and some depend on each other, such as DNS relying on inventory while inventory relies on DNS.

Tiger Data skipped fact extraction, knowledge graphs, and memory managers.

Databricks published a four-phase rollout plan for Genie One, its AI coworker for business data questions.