Blog

Agents Killed the Pull Request: Zed Launches Delta in Public Beta

Sep 17, 2026

Christopher Shaun Godwin

Author

Agents Killed the Pull Request: Zed Launches Delta in Public Beta

Zed did something most teams treat as unthinkable: it turned off pull requests on its own repository. On September 16, 2026, the company launched Delta in public beta (Zed, 2026). Delta is a multiplayer environment where developers and coding agents work, review, and revise code together in shared threads (Zed, 2026). The pull request, says CEO Nathan Sobo, does not fit a world where agents write most of the code (Zed, 2026).

Why the pull request is the problem now

“Since GitHub introduced pull requests over 15 years ago, they’ve become the standard way to ask teammates to review changes to your codebase,” Sobo writes (Zed, 2026). “But with agents generating so much code, the diffs we’re asking each other to review have mushroomed” (Zed, 2026).

A small diff still hides the decisions behind it. A reviewer often feeds the diff to another agent, and that agent has to reconstruct choices the author already worked through (Zed, 2026). The result is a review loop built for human-sized changes, applied to agent-sized output.

The pressure on GitHub itself is real. The platform suffered a near-eight-hour outage in August 2026, with web and API error rates reaching around 20 percent at the height of the incident (InfoWorld, 2026). “Everyone is in a race to replace GitHub right now,” Sobo says (Zed, 2026). Most contenders promise better uptime on top of the same old primitives: branches, commits, and diffs (Zed, 2026). Zed instead bets that the thread becomes the new unit of software development (Zed, 2026).

How Delta works: the thread replaces the PR

Delta’s core unit is the thread: a running record of an agent-assisted task where the conversation and the files stay connected (Delta docs, 2026). Collaboration no longer depends on committing and pushing code (Zed, 2026). You invite teammates directly into the conversation with the agent. They see the same worktrees you do, on their own machines, and can ask the agent why you chose a Mutex instead of an RwLock (Zed, 2026). If you log off, they can keep working with the agent where you left off (Zed, 2026).

Review happens in dedicated subthreads (Zed, 2026). A review subthread gets an isolated copy of the parent thread’s worktrees (Zed, 2026). The reviewer can explore the code with agents, try changes without disrupting the original work, and request a revision or fix it themselves (Zed, 2026). Fixes made during review fold back into the parent thread before landing (Zed, 2026).

The storage layer is DeltaDB, which extends Git’s content-based versioning with incremental versions called deltas (Zed, 2026). It records edits between commits alongside the messages from humans and agents, so the code’s evolution stays attached to the reasoning behind it (Zed, 2026). A commit remains the checkpoint you push, pull, and build from (Zed, 2026). Git compatibility is intact: teammates who never open Delta still see a normal Git repository (Zed, 2026).

Zed calls the resulting workflow continuous engineering: the idea, the implementation, the review, and the landing of a change all happen in one place (Zed, 2026). CI is not replaced yet. For now, an agent triggers a run with an existing CI provider and checks the results before landing the change (Zed, 2026).

The proof is in Zed’s own repo

Zed disabled pull requests on the Delta repository last week and now builds the product entirely within Delta (Zed, 2026). Since the switch, 33 developers have landed 570 changes to main without using pull requests (Zed, 2026). Sobo expects the company is only a few months away from leaving GitHub behind entirely (The New Stack, 2026).

Delta is not a fork-and-run migration. It rides alongside Git today: you can use it with any repository, keep GitHub for community contributions, and share Delta threads next to pull requests (Zed, 2026). The company keeps zed-industries/zed on GitHub because hundreds of external developers contribute there each month, and it does not want to strand them (The New Stack, 2026). Delta is free during the public beta, with paid plans coming later and a free version promised forever (Zed, 2026). It runs on macOS, Linux, and Windows, on the web without any download, and from a mobile browser (Zed, 2026).

For context, Zed is not a new player. The editor was founded in 2021 by veterans of GitHub’s Atom editor team, and the company raised a $32 million round led by Sequoia Capital in August 2025 (The New Stack, 2026).

What this means for your team

Review the conversation, not just the diff. Agents produce context a diff cannot carry. When the reasoning is attached to the change, reviewers stop reverse-engineering it (Zed, 2026).
You can start without migrating. Run threads alongside pull requests. Contributors who never open Delta still get a normal Git repository (Zed, 2026).
Automate the landing loop. Zed’s own flow: the agent squashes the work into one commit, pushes a branch, runs CI, lands on main after CI passes with approval, then deletes the branch (Zed on X, 2026). That same squash-and-merge discipline is how this very post ships to production through the cgodwin.io merge-request flow.
Watch the race to replace GitHub. The outage in August showed the cost of a single review platform (near-8-hour, ~20 percent error rates at the peak) (InfoWorld, 2026). Sobo is explicit that most challengers just promise uptime on old primitives; Delta is the first serious bet that the review artifact itself changes (Zed, 2026).

The takeaway

Pull requests were designed for human review of human diffs. Agents changed the volume and the context of the code, and the review tool did not change with it (Zed, 2026). Delta’s bet is that review becomes a shared conversation with the agent, not a batch handoff of files. It is in public beta, running in production on its own dogfood, and 570 changes in. Download it today and try a thread with your next agent-driven change (Delta, 2026).

One Email, Root Access: Cisco's Mail Gateway Zero-Day Is Under Attack

Sep 16, 2026

Christopher Shaun Godwin

Author

One Email, Root Access: Cisco’s Mail Gateway Zero-Day Is Under Attack

The Cisco Secure Email Gateway exists to keep malicious email out. This week it became a way in. An unauthenticated attacker sends one crafted message and gets root on the appliance (The Register, 2026). Cisco confirmed active exploitation on September 14 (Rapid7, 2026). CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026). If you run this appliance, this is the story to act on now.

The flaw: SQL injection in the mail path

The vulnerability is CVE-2026-76461. It is a SQL injection flaw in the email parsing logic of AsyncOS, the software that runs Secure Email Gateway appliances (CyCognito, 2026). The parsing logic does not validate message content before it reaches a database query (CyCognito, 2026). An attacker sends a crafted email carrying SQL statements (BleepingComputer, 2026). The statements execute when the appliance processes the message, and they run commands with root privileges on the underlying operating system (BleepingComputer, 2026).

The advisory carries a CVSS base score of 9.8 out of 10 (Rapid7, 2026). Exploitation needs no credentials and no user interaction (CyCognito, 2026). The attacker does not need access to the management interface (Rapid7, 2026). Sending mail to the gateway is enough.

Why an email gateway is the worst place for this bug

The gateway’s normal job is to process externally delivered email (Rapid7, 2026). That job is the attack surface. There is no “do not expose the admin panel” mitigation, because the vulnerable code path runs on every inbound message. Locking down the device does not reduce exposure.

The bug affects physical and virtual appliances regardless of their configuration (BleepingComputer, 2026). Cisco states there is no workaround (Cisco, 2026). Patching is the only fix (The Register, 2026).

AsyncOS versions 16.5, 16.0, and 15.5 and earlier are affected on physical and virtual appliances (Help Net Security, 2026). The fixed releases are listed below (Cisco, 2026).

Release train	First fixed version
15.5	15.5.5-014
16.0	16.0.4-302
16.5	16.5.0-780

Exploitation: confirmed, ongoing, zero-day

Cisco’s Product Security Incident Response Team became aware of active exploitation in September 2026 (BleepingComputer, 2026). Cisco published the advisory on September 14, 2026 (Rapid7, 2026). CISA added the CVE to its catalog the same day, which points to zero-day exploitation before public disclosure (Rapid7, 2026). The catalog addition orders US federal agencies to remediate the flaw (Security Affairs, 2026).

Cisco found the bug while resolving a Technical Assistance Center support case (The Register, 2026). The vendor has not named the attackers, the attack duration, or the number of compromised organizations (The Register, 2026).

The cloud-delivered product line was hit too. Cisco directly contacted customers who own Secure Email Cloud devices where malicious activity was detected (Help Net Security, 2026).

Cisco shared indicators of compromise. Look for suspicious SQL statements in each cluster device’s mail_logs. Cross-check network and firewall logs for uploads and downloads to external or malicious IP addresses, because attackers may remove evidence of exploitation (BleepingComputer, 2026). Shadowserver currently tracks more than 400 public-facing Secure Email Gateway appliances (BleepingComputer, 2026).

What to do today

Patch outside the normal cycle. Confirm the AsyncOS version on every appliance. Upgrade to 15.5.5-014, 16.0.4-302, or 16.5.0-780 (Cisco, 2026). There is no workaround (Cisco, 2026).
Hunt before you wipe the evidence. Grep mail_logs for SQL fragments embedded in message bodies. Compare firewall and proxy logs for unexpected outbound connections from the appliance (BleepingComputer, 2026). Attackers can remove traces, so collect the logs first.
Treat email infrastructure as a hostile-input product. This is the second AsyncOS root-RCE zero-day in a year. CVE-2025-20393 carried a CVSS score of 10.0 and was exploited by the China-linked group UAT-9686 (SecurityWeek, 2026). Email gateways must process untrusted input by design. Give them the same patch discipline you give routers and identity providers.

The takeaway

A security product that scans hostile mail cannot be secured by hiding it. The AsyncOS mail path processes attacker-controlled content on every message, and this path now hands root to whoever sends the right email. Check the version, patch, and sweep the logs. Attackers are already doing the same math (SOC Prime, 2026).

GitLab's Perfect 10: One Request Reads Every File on Your Server

Sep 15, 2026

Christopher Shaun Godwin

Author

GitLab’s Perfect 10: One Request Reads Every File on Your Server

GitLab shipped patches on September 10 with a CVSS 10.0 advisory, the maximum score on the CVSS v3.1 scale (The Register, 2026). The flaw, CVE-2026-85706, lives in the repository commits API. It lets an unauthenticated attacker read arbitrary files from a self-managed GitLab server (Rapid7, 2026). Exploitation attempts started within roughly a day of the fix (Security Affairs, 2026). If you host GitLab yourself, this is the story to act on today.

The flaw: two failures, one request

GitLab attributes the bug to two layered weaknesses. The repository commits API lacked proper path confinement, and the endpoint was missing authentication enforcement (SOC Prime, 2026). The API built a file path from attacker input without confining it to the repository, and the vulnerable condition did not require a login (Horizon3, 2026). Together they let a remote attacker walk the path out of the repo and read files anywhere the GitLab process can reach.

The exploit is one HTTP POST request with a crafted file.path parameter (Security Affairs, 2026). No credentials, no plugin, no multifactor bypass. watchTowr assessed the exploitation complexity as low and predicted broad in-the-wild attacks the day after the fix shipped (watchTowr, 2026).

GitLab fixed the flaw in versions 19.1.8, 19.2.6, and 19.3.2 for Community Edition and Enterprise Edition. Every earlier supported release is vulnerable (Field Effect, 2026; AhnLab ASEC, 2026).

What one request can expose

Arbitrary file read on a GitLab server is a credential grab, not a curiosity. The files most teams store on that box include SSH keys, database credentials, deploy tokens, CI/CD variables, and cloud keys (Security Affairs, 2026). Those files give an attacker the repositories, runners, registries, and production deployments that GitLab orchestrates (SOCRadar, 2026). Dark Reading framed the outcome directly: a maximum-severity GitLab flaw puts software supply chains at risk (Dark Reading, 2026).

Typical file on a self-managed GitLab box	Why it matters
SSH keys	Direct access to repositories and hosts
Database credentials	Control of the GitLab database
Deploy and runner tokens	Impersonate pipelines and CI/CD jobs
CI/CD variables	Secret values injected into every build
Cloud keys	Access to the infrastructure GitLab deploys to

The confirmed behavior is file disclosure, not direct code execution (SOCRadar, 2026). The risk does not stop there. The disclosed files are usually the credentials that unlock code execution and lateral movement elsewhere (Bank Info Security, 2026).

The timeline: patch to exploit in under a day

Date	Event
Sept 10	GitLab ships 19.1.8, 19.2.6, and 19.3.2 with an advisory for CVE-2026-85706, one of 17 fixes (watchTowr, 2026)
~20 hours later	Exploitation and probing attempts observed, one request per hit (forkast, 2026)
Sept 11	CISA adds CVE-2026-85706 to the Known Exploited Vulnerabilities catalog (CyberSecurityNews, 2026)
Sept 12	Public proof-of-concept code circulates, lowering the skill bar further (SOC Prime, 2026)
Sept 14	The Register: “Perfect-10 GitLab bug under attack days after patch lands” (The Register, 2026)

CISA set the federal remediation due date at September 14 and marked the CVE for forensic triage under Binding Operational Directive 26-04 (Rapid7, 2026).

The rest of the batch

CVE-2026-85706 was one of 17 vulnerabilities fixed on September 10 (forkast, 2026). Two others deserve your attention:

CVE	CVSS	What it does
CVE-2026-87719	9.9	Insecure deserialization in the GraphQL subscription serializer. An authenticated user with Duo Chat access can pull Advanced Search configurations and credentials (GitLab Security, 2026; Rapid7, 2026)
CVE-2026-88765	8.5	Buffer overflow in the Unicode conversion wrapper. Remote code execution via crafted Git project exports (forkast, 2026)

GitLab’s own security response team made the practical point: install the complete patch release, not a single fix (GitLab Security, 2026). The 9.9 deserialization flaw needs the same release, and it can expose credentials of its own. Of the batch, only CVE-2026-85706 is known to be exploited in the wild so far (Rapid7, 2026).

Your checklist

Upgrade now. Move to 19.3.2, 19.2.6, or 19.1.8 depending on your track (watchTowr, 2026). Exploitation arrived before many teams finished reading the advisory.
Check for compromise before rotating anything. Look for POST requests to the commits API with a file.path parameter (Security Affairs, 2026). SOC Prime shipped detection content for the signal (SOC Prime, 2026).
Rotate exposed credentials. Tokens, SSH keys, CI/CD variables, and cloud keys must all change after the patch (GitLab Security, 2026).
Patch the whole release. A partial install leaves CVE-2026-87719 and the rest of the batch open (GitLab Security, 2026).
Treat exposure as an incident. A GitLab box with exposed SSH and a file-read hole is a source-code and secrets breach, not a patch ticket (Dark Reading, 2026).

Also today: Cisco’s email gateway under attack

Cisco patched a separate zero-day on September 15. CVE-2026-76461 is a SQL injection in the AsyncOS email parsing engine of the Secure Email Gateway, rated CVSS 9.8. An unauthenticated remote attacker can execute commands with root privileges, and Cisco confirms active exploitation (BleepingComputer, 2026; The Hacker News, 2026). It is the second Secure Email Gateway CVE in the KEV catalog after CVE-2025-20393 (SecurityWeek, 2026). If you run the appliance, the patch is the update.

The takeaway

CVE-2026-85706 is the new baseline for patch urgency in self-hosted DevOps. A CVSS 10.0 file read, no authentication, one request, exploited within a day and added to KEV in two (The Register, 2026). The fix versions are known, the detection signal is documented, and the credential rotation list is short (Rapid7, 2026). The only open question is whether your instance was scanned before you patched. Upgrade, audit, rotate, and assume the attackers already checked your version string.

MikroTrick: the SSH flaw letting attackers own MikroTik routers without a password

Sep 14, 2026

Christopher Shaun Godwin

Author

MikroTrick: the SSH flaw letting attackers own MikroTik routers without a password

Attackers are taking over MikroTik routers with no password at all. Poland’s CERT agency (CERT Polska) confirmed that a chain of two RouterOS flaws, named MikroTrick, is being exploited against devices whose SSH service is reachable from the public internet (BleepingComputer). Exploitation began around September 2, one day before MikroTik shipped patched builds on September 3 (SOCPrime). On September 10, CISA added both CVEs to its Known Exploited Vulnerabilities catalog (Decryption Digest). If you run MikroTik gear, this is the story to act on today.

The chain: two flaws, one takeover

CERT Polska disclosed six RouterOS vulnerabilities on September 5 (eSecurityPlanet). Two of them chain together to hand an attacker full administrative control.

CVE	CVSS	What it does
CVE-2026-67276	9.2	SSH public-key authentication bypass. RouterOS compares only the key type and RSA modulus, not the full key. An attacker who knows a username and its key’s public modulus can forge a different key and log in without the private key (SOCPrime).
CVE-2026-86060	9.2	Privilege escalation via a specially crafted username during SSH login. The crafted username manipulates the session policy so the attacker gets full administrative privileges (BleepingComputer).

The first flaw gets the attacker in. The second makes them an administrator (Malwarebytes). No credentials required, as long as SSH is exposed to the internet (BleepingComputer).

The other four flaws cover the bandwidth-test service, X.509 certificate validation, SSH authentication state, and the WebFig management interface (eSecurityPlanet). CERT Polska highlighted CVE-2026-67277, a bandwidth-test flaw rated CVSS 8.8, because it lets an unauthenticated attacker leak kernel memory or crash the router (BleepingComputer).

The exposed surface

CERT Polska found roughly 122,500 MikroTik devices with SSH exposed to the public internet as of September 5 (daily.dev). CERT Polska confirmed the chain in its advisory. “We have obtained confirmation that the attackers are exploiting this combination of vulnerabilities to take full control of devices whose SSH service is accessible from public networks” (BleepingComputer).

A compromised router is not just a broken box. It sits at the edge of your network. An attacker who owns it can change DNS settings, redirect or capture traffic, and create remote-access tunnels. It can also alter firewall rules or serve as a foothold to attack other hosts on the network (Malwarebytes). Those are the same capabilities a cautious defender would refuse to hand to anyone.

There is a turnaround worth noting: CERT Polska accelerated the research with OpenAI’s GPT-5.5-cyber and GPT-5.6-sol models, with human researchers directing and validating the work (BleepingComputer). AI-assisted vulnerability research is now production practice at national CERTs, and it shortens the window between disclosure and exploit (daily.dev). That window is your patch deadline, and it is getting smaller.

The fix and the checks

MikroTik released patched builds on September 3, and CERT Polska validated them (BleepingComputer):

Branch	Fixed version
RouterOS 6 (long-term)	6.49.21
RouterOS 7 (long-term)	7.23.4
RouterOS 7 (stable)	7.24.2
RouterOS 7 (beta)	7.25beta3

MikroTik later released 7.23.5 to fix an unrelated IPv6 DHCP regression (daily.dev). The vulnerable ranges are RouterOS 6.0.0 through below 6.49.21, RouterOS 7.0.0 through below 7.23.4, and RouterOS 7.24 through below 7.24.2 (daily.dev). If you track which branch you run, the update path is short.

The patched firmware also adds a compromise-detection mechanism. At startup it looks for known signs of unauthorized configuration changes, disables malicious entries, and logs a critical warning (BleepingComputer). After updating, check /system/device-mode/print for a “Flagged” marker, and look for unknown users, scripts, or tunnels (SecureTechIn, 2026).

Rules for your fleet

Do not expose SSH to the internet. MikroTik recommends closing SSH to untrusted networks and using a VPN such as WireGuard for remote administration (daily.dev). Management planes belong behind the perimeter, not on it.
Patch the day fixes ship, not the day exploits ship. Exploitation started one day before patches existed (SOCPrime). Treat every patch as a race.
Treat a compromised edge device as a full incident. Assume the attacker changed DNS, firewall rules, and tunnels. Rebuild or wipe the device, rotate every credential it touched, and re-check the rest of the network (Malwarebytes).
Add network gear to your vulnerability inventory. Your CVE feed should list routers, firewalls, and switches, not just servers and containers. This chain hit devices most teams never patch automatically.
Assume the AI-assisted disclosure cadence is the new baseline. When national CERTs use frontier models to find flaws, the gap between public disclosure and working exploit shrinks (daily.dev). Your automation must shrink with it.

The takeaway

MikroTrick is the pattern for 2026: a cryptographically subtle auth bypass, a privilege escalation, and internet-exposed management ports turned into full device takeover in days. The fix is known, the versions are clear, and the checks are documented (eSecurityPlanet). The only open question is whether your fleet is already inside the exposed count. Close the port, ship the patch, and run the post-update checks. That is the whole job, and it is urgent (Decryption Digest).

Slow the frontier: Anthropic's three-step plan to pace the AI race

Sep 13, 2026

Christopher Shaun Godwin

Author

Slow the frontier: Anthropic’s three-step plan to pace the AI race

On September 12, Anthropic CEO Dario Amodei asked AI companies to slow the pace at which they improve model capabilities (Reuters). He published the call as an essay and outlined a three-step framework to create more time to manage risk. Reuters carried it as the week’s leading AI story, and OpenAI CEO Sam Altman endorsed part of the plan the same day (The Nation Thailand). This is a governance moment, and it changes how you buy and evaluate the models you run.

The essay and the ask

Amodei’s central request is deliberate. Labs should moderate how fast they push model capabilities forward, not stop training outright.

“We must slow the pace at which we improve the capabilities of AI models. Progress will still seem fast, and we must make wise use of the time we gain,” Amodei wrote (Reuters).

He stressed that he is not seeking an end to model training or technical advances (The Nation Thailand). He wants enough time to align systems with safety objectives and to let outside evaluators verify the safeguards (The Nation Thailand). Axios reported Amodei warned of potentially devastating consequences within months if the pace stays unchecked (Axios).

Three steps, not a pause button

The framework rests on three parts (The Nation Thailand).

Independent scrutiny inside labs. Anthropic has committed to hosting independent evaluators inside the company, with ongoing access to its tools and internal risk-assessment processes (The Nation Thailand). Amodei urged other leading developers to adopt the same approach. OpenAI’s Sam Altman backed the idea on September 12, committing to independent evaluators with employee-like access (The Nation Thailand).
Common industry standards. Amodei called for voluntary agreements on safety standards and limits on uncontrolled development (The Nation Thailand). A shared floor that every lab meets beats a race to the edge.
International coordination. Amodei argued that coordinated restraint among democratic countries must preserve the US technological lead over China (The Nation Thailand).

Why this landed now

The call did not arrive in a vacuum. It followed reporting on how Claude was misused, and Moneycontrol linked the slowdown push directly to that report (Moneycontrol). Reuters reported that OpenAI executives had earlier said leading labs should be ready to coordinate a voluntary slowdown when necessary to build confidence in safety measures (The Nation Thailand).

What it means for your stack

For an operator, the signal is not ivory-tower policy. It is supply-chain and risk math.

Independent evaluation becomes a buying criterion. If Anthropic hosts outside evaluators with ongoing access, ask what checks your vendor runs before you trust a model with production prompts (Axios).
Self-hosted models give you an exit. A model you can run and verify yourself does not hinge on one lab’s pace or policy decision. Open weights remain your escape hatch when a vendor shifts.
Vendor concentration is now a governance risk. When one lab can unilaterally slow a frontier or change terms, your architecture should not depend on it.
Verification is your job too. The industry call for more time to check the work is a reminder that you still own review, guardrails, and a rollback path for anything that ships itself.

The takeaway

The frontier is not getting slower. Amodei said progress would still seem fast at a measured pace (Reuters). The shift is that the frontier labs now treat checking the work as a first-class requirement, not an afterthought. Adopt the same standard for the models you run in production, and you are ahead of the change.