<p><strong>TLDR:</strong> Anthropic shipped Claude Sonnet 5 today, its most capable mid-tier model, hitting 63.2% on SWE-bench Pro at $2/$10 per million tokens through August 31. Cloudflare made a sweeping move against AI crawlers, announcing that Training and Agent bots will be blocked by default on ad-monetized pages starting September 15, and launching a Pay Per Use model so publishers get paid when content appears in AI answers rather than just when it’s fetched. A North Korea-linked supply chain campaign called PolinRider has expanded beyond npm into Go modules, Packagist, and Chrome extensions, with 162 malicious artifacts found across 108 packages. The npm ecosystem is also under pressure from a separate wave of attacks including a social engineering scheme that nearly shipped a RAT through Axios.</p>
<hr>
<h2>Claude Sonnet 5 ships with near-Opus performance at mid-tier pricing</h2>
<p>Anthropic launched Claude Sonnet 5 with SWE-bench Pro at 63.2%, Terminal-Bench 2.1 at 80.4%, and OSWorld-Verified at 81.2% — close to Opus 4.8 territory. Pricing is $2 input / $10 output per million tokens through August 31, 2026, though a new tokenizer increases token counts 1.0–1.35x, so real costs depend on your workload. Key improvements are task persistence, self-verification, and tool use. One thing worth knowing: at max effort, Sonnet 5 can end up costing more than Opus 4.8, so effort level selection matters more than it used to. Anthropic also released a Linux beta of Claude Desktop and announced Claude Science with access to 60+ scientific databases. <a href="https://daily.dev/feed-by-ids?id=zqf5gH3cD&amp;id=DijFVohdR" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Cloudflare blocks AI crawlers by default, launches Pay Per Use for publishers</h2>
<p>Cloudflare is giving AI companies until September 15, 2026 to separate crawlers used for traditional search from those used for AI training and agents. After that date, Training and Agent bots are blocked by default on ad-monetized pages for new and free-tier sites. The company also published data that’s hard to ignore: over 50% of internet traffic is now non-human, 52% of crawler requests are for AI training (up from 22% in Spring 2025), and some industries have seen human traffic drop up to 40% in under a year. The Pay Per Use model shifts compensation from crawl events to actual content appearances in AI answers, with <a href="http://Ceramic.ai" target="_blank" rel="noopener nofollow">Ceramic.ai</a> and <a href="http://You.com" target="_blank" rel="noopener nofollow">You.com</a> as early partners. Cloudflare also called out Google specifically for bundling search and AI crawling in ways that prevent publishers from opting out without losing search visibility. <a href="https://daily.dev/feed-by-ids?id=I5yWynW2Y&amp;id=er8fwFksU&amp;id=Zrn0fx6z7&amp;id=JJDA1t3tv&amp;id=VduMWudVn&amp;id=y7P26qDQ7&amp;id=aYLB3tUzy" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>PolinRider: North Korea-linked supply chain campaign hits Go, Packagist, and Chrome extensions</h2>
<p>Socket’s Threat Research Team disclosed PolinRider, tied to the Contagious Interview / Famous Chollima cluster, with 162 malicious release artifacts across 108 packages spanning npm, Go modules, Packagist, and Chrome extensions. The attack pattern is sophisticated: maintainer accounts are compromised, obfuscated JavaScript loaders are hidden in fake .woff2 font files or config files, and VS Code task files trigger execution. Git history is rewritten with force pushes and anti-dated commits to hide the changes. Payloads use blockchain RPC infrastructure on TRON, Aptos, and BNB Smart Chain to retrieve encrypted second-stage malware including DEV#POPPER and OmniStealer. If you think you’re affected, treat the environment as compromised, rotate all secrets from a clean machine, audit VS Code tasks, and check GitHub Activity logs rather than visible commit history. <a href="https://daily.dev/posts/xKZgY7UCD" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>npm supply chain attacks escalating: Axios nearly shipped a RAT, self-replicating worm steals tokens</h2>
<p>The npm ecosystem is under sustained attack from multiple directions. The most alarming incident: attackers impersonated a startup on a fake Teams call to convince the Axios maintainer to ship a remote access Trojan — it reached 100 million weekly downloads before being caught, in about 3 hours. A separate self-replicating worm called Shai Hulud spreads by stealing npm tokens. Dependency confusion attacks are mimicking internal company packages, and compromised GitHub accounts slipped malicious code into 32 Red Hat packages undetected. npm has blocked over 1.2 million malicious packages total, a number that grew 75% in a single year. AI coding agents that auto-install packages without human review are making this worse, as is AI hallucinating package names that attackers pre-register. <a href="https://daily.dev/posts/7NmikFdLe" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>NTLM removed from libcurl in September 2026, breaking Azure DevOps Server Git auth:</strong> In September 2026, libcurl drops NTLM support, directly breaking Git HTTPS operations for Azure DevOps Server on-premises customers — including those silently relying on NTLM via SPNEGO fallback — with migration requiring proper Kerberos configuration or a switch to SSH. <a href="https://daily.dev/posts/lk5gXHjx8" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>T-Mobile migrating 303,140 CPU cores off VMware after Broadcom refuses perpetual license renewal:</strong> T-Mobile filed suit against Broadcom after it refused to honor a third-year support renewal on perpetual VMware licenses covering roughly 303,140 CPU cores; a judge granted a temporary injunction through August 2026 for $5.28 million while T-Mobile migrates over 1,000 applications. <a href="https://daily.dev/posts/Rpbd0Mcwc" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft 365 password-spraying campaign: 81 million attempts, 78 accounts compromised via ROPC OAuth flow:</strong> A campaign observed June 12–26 by Huntress used the ROPC OAuth flow through Azure CLI to bypass MFA entirely, compromising 78 accounts across 64 organizations — the attack exploits MFA Conditional Access Policies scoped only to specific apps or left in report-only mode. <a href="https://daily.dev/posts/tNRUt3EAb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Clockwork TorchPass GA: live GPU state migration recovers training runs in seconds, targets $6M annual savings on 2,048-GPU deployments:</strong> TorchPass performs live migration of in-memory training state to a spare GPU instead of rolling back to a checkpoint, with independent SemiAnalysis benchmarks confirming it outperformed checkpoint-restart and Meta’s TorchFT on a GPT-OSS-120B run on 64x H200s. <a href="https://daily.dev/posts/NcddqAezB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>GitHub ships self-service bulk credential revocation for Enterprise after Trivy and durabletask supply chain attacks:</strong> Organization owners can now instantly revoke SSO authorizations, PATs, SSH keys, and OAuth tokens in a single action — motivated by recent incidents where incomplete credential rotation let attackers re-enter systems weeks after initial compromise. <a href="https://daily.dev/posts/cII7k9DJr" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Server-side development, system design, API patterns, and distributed architecture.

Backend Digest

Anthropic shipped Claude Sonnet 5 today, its most capable mid-tier model, hitting 63.2% on SWE-bench Pro at $2/$10 per million tokens through August 31. Cloudflare made a sweeping move against AI crawlers, announcing that Training and Agent bots will be blocked by default on ad-monetized pages starting September 15, and launching a Pay Per Use model so publishers get paid when content appears in AI answers rather than just when it's fetched. A North Korea-linked supply chain campaign called PolinRider has expanded beyond npm into Go modules, Packagist, and Chrome extensions, with 162 malicious artifacts found across 108 packages. The npm ecosystem is also under pressure from a separate wave of attacks including a social engineering scheme that nearly shipped a RAT through Axios.

Claude Sonnet 5 launches, Cloudflare rewrites the AI crawler rulebook