Google's Gemini API now stores requests by default on new paid-tier projects, which matters if anything customer-related goes through a Gemini project you start from today. GitHub also rolled out its Copilot global default policy gradually through 26 October, so eligible features you left unconfigured on Copilot Business and Enterprise are set to the global default. CISA added the two php2shell CVEs to its exploited list on 26 October, with a 29 October federal deadline; our PHP2Shell patch plan covers it. For the wider archive, see AI model releases and pricing: what changes for engineering teams.
Gemini API request storage default
Google's Gemini API changelog, in its 26 October entry, says new projects on the paid tier that use generateContent, streamGenerateContent or batchGenerateContent now store requests by default (store=true), matching the Interactions API. Existing projects keep their current setting. To opt out, set store=false on individual requests or turn off Generate Content API logging in the Settings panel of the Logs and Datasets dashboard.
The changelog doesn't say how long stored requests are kept or who can see them, and we haven't verified either. If you're about to start a Gemini project with customer or regulated data, switch logging off before the first call and tell whoever owns your data processing records.
Verdict: act now for any new paid Gemini project; ignore for existing ones.
GitHub: Copilot default policy, enterprise GitHub Apps, assisted permissions, EMU deletions
Copilot default policy
GitHub's 22 October changelog says it is rolling out enforcement of the global default policy through 26 October. On Copilot Business and Copilot Enterprise, eligible generally available features left Unconfigured are set to the global default (Enabled, Disabled, or Let organizations decide). It's a one-time change, explicit choices are kept, preview features stay opt-in, and it covers "Features & clients" and "MCP servers in Copilot". Our Copilot default enablement piece covers the policy itself.
The rest of GitHub's week
Installing GitHub Apps on your enterprise is generally available, so admin automation can move off classic PATs. Assisted permissions are generally available in Copilot CLI, the Copilot app and VS Code: a model judges each permission request, clearly safe ones proceed, and admins can block Allow All. GitHub also disclosed that about 12,285 Enterprise Managed User accounts deprovisioned through SCIM between 1 and 13 June were deleted instead of suspended. It's restoring them.
Verdict: act now on the Copilot default, plan for the PAT migration, ignore EMU unless a June user.delete event shows in your audit log.
Java and .NET patch builds, plus the eMudhra CA distrust
Oracle's October 2026 Critical Patch Update has 55 new Java SE patches, 49 of them remotely exploitable without authentication. Amazon Corretto shipped matching quarterly builds on 22 October, including 25.0.5.0.9 and 21.0.13.0.10. Microsoft released out-of-band .NET fixes on 25 October (8.0.33, 9.0.22 and 10.0.14) for a Brotli buffer overflow, CVE-2026-111497. That bug affects you only if you use ASP.NET Core request decompression, HttpClient automatic response decompression or the Brotli APIs, and the first two aren't on by default. The same release also fixes a Linux tarball ownership issue and re-fixes two 13 October CVEs, so patch anyway. Self-contained apps must be rebuilt and republished.
Google Cloud's bulletin GCP-2026-071 says eight eMudhra subordinate CA certificates are no longer trusted. Self-managed hosts need a trust store update from the OS vendor.
Verdict: plan for it this sprint (Java, .NET, trust store), and act now on .NET if you use Brotli.
Anthropic's S-1: what a Claude customer should read in it
Anthropic's 26 October announcement says it filed a Form S-1 with the SEC. Skip the valuation talk. The risk factors are the part that touches your contract. In the S-1's risk factors, Anthropic writes that many top customers "are not subject to long-term contracts with us or have contracts with near-term expiration dates" and can reduce or in some cases stop spending at any time. It says it has changed its pricing models and "usage limits, rate limits, or model and product capabilities", and may change them again. It also warns that any "accelerated or forced deprecation" of older models could result in "customer attrition, contractual disputes, or reputational harm".
Separately, Anthropic's release notes say the SDKs moved to new majors on 21 October (Python 2.0.0, TypeScript 1.0.0, Go 2.0.0 and others) and now ship under Apache 2.0 instead of MIT. Pin versions, and tell whoever signs off open-source licences.
Verdict: plan for it. Read your agreement for price, limit and retirement terms.
OpenAI: GPT-6.1 Terra pricing and Copilot default, Decisions API GA
OpenAI's model page lists GPT-6.1 Terra at $1 per million input tokens, $0.05 cached input and $5 output. Prompts over 272K input tokens cost 2x input and 1.5x output for the full request. GitHub's changelog says it's available to Copilot Pro, Pro+, Max, Business and Enterprise, and that under default model enablement new models switch on automatically unless an admin turned the global default off or disabled that model.
The Decisions API is generally available with gpt-6-luna, per OpenAI's changelog, now at up to 400 questions per request, up from 200 in beta. Our Decisions API guide was written at public beta.
Verdict: plan for it. Check which models your Copilot bill can reach; ignore the Decisions API unless you piloted it.
Cloudflare Workers AI cross-customer response exposure
Cloudflare's post-mortem says 155 responses from the GLM-5.3 model on Workers AI contained data from other customers' requests between 27 August and 9 September. All were to prompts longer than 681,280 tokens. The model was deployed with a 1,048,576-token context window, but the KV cache pool on the prefill GPUs had room for 681,280. Cloudflare says no other Workers AI model was affected and it found no evidence of deliberate exploitation. A researcher reported it on 8 September, and the disclosure came on 26 October.
Verdict: ignore unless you used GLM-5.3 on Workers AI with long prompts, in which case ask Cloudflare whether you were among the 155.
AI spend controls: JetBrains Air Governance and Copilot usage metrics
JetBrains says Air Governance, formerly JetBrains Central, is generally available to all organizational customers on free and paid plans. It sets credit limits per user, team and service account, and reports cost by user, agent, and model and provider. JetBrains says its own AI spend grew roughly tenfold in the first half of 2026 and its first cross-vendor report took four days to compile by hand. Our JetBrains Air piece covers the product.
GitHub's usage metrics now name the skills, custom agents, MCP servers, slash commands and plugins your organization creates, and report model usage from tools like OpenCode.
Verdict: plan for it if you can't say what AI tooling costs per engineer.
Apple multiseat subscriptions on by default
Apple's developer news says organizations and schools can now buy app subscriptions in volume through multiseat purchasing. It's enabled by default in App Store Connect unless you've changed the setting. Sandbox testing of group purchases starts in November, and group purchases reach the App Store this winter.
Verdict: ignore unless you sell auto-renewable iOS subscriptions, then decide whether volume seats fit your pricing and backend.
What this means for your AI vendor and tooling plan
Three items need a named owner this week. Someone sets store=false on every new Gemini project that touches customer data. Someone checks what the Copilot default policy set for your organization's unconfigured features. Someone rebuilds JDK and .NET images on the October builds, and republishes self-contained .NET apps.
One item is a contract review, not a ticket. If Claude is a dependency you can't swap in a sprint, read your Anthropic agreement for price, rate-limit and model-retirement terms next to the S-1's risk factors. Judgment: a vendor going public changes what's disclosed, not your terms today, so treat it as a prompt to check, not a reason to move.
Last week's list is in last week's engineering news, including the 16 November Copilot cutoff.
FAQ
Does the Gemini API store my existing project's requests now?
No. Google's changelog says existing projects keep their current setting. Only new paid-tier projects using the Generate Content API store requests by default, and you can opt out with store=false per request or in the Logs and Datasets settings.
When did the GitHub Copilot global default policy take effect?
GitHub rolled out enforcement from 22 October through 26 October, so timing varied by organization. On Copilot Business and Copilot Enterprise, eligible features left Unconfigured were set once to your selected global default. Explicit choices were kept and preview features remain opt-in.
Does Anthropic's S-1 change my Claude contract?
No. It's a filing that discloses risk factors, including price changes, usage and rate-limit changes and model deprecation. Your terms are whatever your agreement says, so check that document.