Ghostty leaves GitHub amid platform outages, RCE patch, and Warp going open-source; OpenAI lands on AWS Bedrock

GitHub Blog

GitHub Patches Critical RCE in the Git Push Pipeline (CVE-2026-3854)

GitHub patched a critical remote code execution vulnerability in its git push pipeline that let any authenticated user with push access inject malicious push options and bypass sandboxing protections. The flaw stemmed from improper sanitization of a delimiter character in internal metadata passed between services. GitHub's security team validated, fixed, and deployed the patch within 75 minutes of the Wiz bug bounty report, with forensic investigation confirming no prior exploitation. GitHub Enterprise Server customers should upgrade immediately.

GitHub Blog

An Update on GitHub Availability

GitHub's CTO published a transparency report covering two significant April incidents: a merge queue regression that inadvertently reverted changes across 658 repositories on April 23, and an Elasticsearch overload caused by a botnet attack that knocked out search-backed UI features on April 27. The post reveals that agentic development workflows have driven such exponential growth since late 2025 that GitHub's capacity target has jumped from 10x to 30x. GitHub says availability now takes priority over new features, with work underway to isolate critical services and reduce single points of failure.

GitHub

Warp Terminal Is Now Open Source

Warp terminal went open source under a dual-license model — MIT for UI components and AGPL v3 for the core — with OpenAI as a founding sponsor. Written in Rust, Warp positions itself as an agentic development environment that integrates AI agents such as Claude Code, Codex, and Gemini CLI directly into terminal workflows. The move opens the codebase for community contributions and extensions while maintaining commercial viability.

Stratechery

OpenAI Models Coming to Amazon Bedrock Managed Agents

OpenAI and AWS announced Bedrock Managed Agents, a jointly-developed service that integrates OpenAI's frontier models with AWS's native runtime infrastructure, including identity management, permissions, logging, and governance. A recent amendment to OpenAI's Microsoft agreement enables the company to serve products on other cloud providers while keeping Azure as the primary platform. Both CEOs emphasized that the runtime harness and models are tightly integrated by design, signaling that AI agent deployment is shifting toward managed cloud environments rather than raw model APIs.

Anthropic

Claude for Creative Work

Anthropic launched connectors that embed Claude directly into major creative software tools including Adobe Creative Cloud, Blender, and Autodesk Fusion, enabling AI assistance within the applications designers, musicians, and 3D artists already use daily. Use cases span tutoring on complex features, writing custom scripts and plugins, automating batch processing, and translating between creative tools. The announcement includes partnerships with leading art and design schools and reflects a broader strategy of embedding AI capabilities into existing workflows rather than building standalone products.

Martin Fowler

Structured-Prompt-Driven Development (SPDD)

Thoughtworks' internal IT organization introduced Structured-Prompt-Driven Development, a methodology that treats prompts as first-class delivery artifacts kept in version control alongside code. The core framework — the REASONS Canvas — is a seven-part structure for capturing requirements, domain models, design decisions, and constraints before AI-assisted code generation. The authors identify three skills critical for effectiveness at team scale: alignment on intent, abstraction-first thinking, and iterative review of AI-generated outputs.

Buchodi

How ChatGPT Serves Ads

A reverse-engineering analysis reveals that OpenAI has built a full advertising platform inside ChatGPT, injecting ads as structured objects into response streams using contextual targeting based on conversation topics. The system uses encrypted tokens and a merchant-side SDK that tracks user interactions through first-party cookies with a 30-day expiration, creating a complete attribution loop from ad impression through conversion. The implementation signals that OpenAI is pursuing ad revenue as a significant monetization layer alongside subscriptions.

Armin Ronacher

Before GitHub

Flask creator Armin Ronacher reflects on how GitHub transformed open source by removing friction from project discovery and contribution, but argues the platform's declining influence creates a new problem: critical project context — issues, discussions, and artifacts — risks being lost to history as projects migrate away. Rather than returning to decentralized self-hosting, he proposes that the community establish a public, well-funded archive to preserve this institutional memory independently of any commercial platform.

Waymo

Waymo Expanding to Portland

Waymo announced expansion to Portland, Oregon, beginning with manual testing to adapt its autonomous driving system to the city's distinctive conditions including bridges and wet road corridors. The company cites a 13x reduction in serious injury crashes in cities where it already operates and is working with state and city officials to establish regulatory pathways toward commercial service. Portland's Vision Zero initiative aligns with Waymo's safety mission, making it a natural fit for the next expansion market.