WHAT CHANGED TODAY
Recent developments and essential updates across AI, development, cloud, cybersecurity, software, gaming infrastructure, marketing and SEO.
AI agents, Copilot, GitHub Actions and WordPress security: key technology developments from 28 October 2026.
GitHub has made Copilot Fusion generally available. Instead of requiring developers to choose one model at every step, the system routes tasks and orchestrates models as needed. Standard, High and Max effort settings offer different balances between capability and resource use.
Why it matters: Teams can assess real task-level quality and cost rather than assuming a single model is best.
GitHub Changelog ↗GitHub is previewing Projects in the Copilot app, allowing a goal to combine repositories, design references and notes in one workspace. Multiple agents can work across that context and return results for review, extending the workflow beyond one isolated repository or chat session.
Why it matters: This matters when delivery spans repositories and connected tools.
GitHub Changelog ↗GitHub is introducing an intelligence layer around Copilot. Memory is generally available for supported paid plans, while Dreaming and broader code search seek to keep repository context usable between tasks. Availability and controls differ by feature and require separate review.
Why it matters: Teams should examine memory controls and repository access boundaries.
GitHub Changelog ↗GitHub announced local-model selection support for Copilot Fusion. This expands the routing options beyond remotely hosted models, although supported configurations and local capabilities still depend on the actual client and setup rather than an assumed universal offline mode.
Why it matters: Practical value depends on hardware, privacy needs and supported configurations.
GitHub Changelog ↗GitHub has added image generation and editing capabilities to Copilot through natural-language requests. The feature broadens its prototyping and design-adjacent workflows, but generated visual assets still require review for correctness, suitability and reuse rights before deployment.
Why it matters: Teams may prototype faster while retaining visual and rights checks.
GitHub Changelog ↗GitHub is rolling out verified MCP connectors in public preview, allowing one authenticated service connection to work across several Copilot clients. The initial catalog includes 26 services, including Slack, Figma, Notion, Sentry and Cloudflare, reducing repeated integration setup.
Why it matters: Permission boundaries remain important when agents connect to external tools.
GitHub Changelog ↗GitHub has introduced a connected cloud experience for Copilot sessions across supported clients. Developers can resume or inspect work without being tied to one desktop session, while the underlying permissions, cloud runtime and client compatibility still need to be checked.
Why it matters: This continuity is useful for teams moving between IDEs and web clients.
GitHub Changelog ↗GitHub Agentic Workflows is now generally available. Teams can describe issue triage, maintenance and documentation tasks in Markdown, compile them into standard Actions workflows, and execute coding agents within the policy constraints of existing GitHub runners.
Why it matters: The approach brings agent-driven maintenance into an existing CI environment.
GitHub Changelog ↗GitHub introduced shared workflows for Copilot Automations, giving teams a way to reuse recurring agent tasks without keeping them tied solely to one individual's setup. Shared ownership also makes configuration, maintenance and review responsibilities more explicit.
Why it matters: Recurring agent tasks can be governed as team processes.
GitHub Changelog ↗GitHub outlined new Copilot capabilities for Visual Studio Code, including closer links with cloud sessions and agent-driven work. The changes aim to make task handoffs less fragmented, but exact behavior depends on client versions and the services enabled for the account.
Why it matters: Developers can reassess which tasks should run locally or in cloud sessions.
GitHub Changelog ↗GitHub says the GitHub Copilot SDK is becoming the Microsoft Copilot SDK. Developers using its libraries should follow the published naming and transition guidance, rather than assuming that a branding change alone modifies application behavior or existing API contracts.
Why it matters: Integrations should track official package and documentation changes.
GitHub Changelog ↗GitHub has introduced a Max option in public preview for Copilot code review, alongside changes involving review approvals. Automated feedback can support pull-request analysis, but repositories still need clear policies for approval authority and the human responsibility for merging.
Why it matters: Maintainers should distinguish automated feedback from authorized approval.
GitHub Changelog ↗GitHub added Agent Merge to pull requests, allowing Copilot to watch for failing Actions checks or merge conflicts and work on fixes in a cloud environment. Maintainers choose what it may address, and availability depends on paid-plan and organization policies.
Why it matters: Teams should review proposed fixes before enabling unattended merges.
GitHub Changelog ↗GitHub has added a way to create and manage Copilot Automations directly in Visual Studio Code. This brings recurring agent tasks closer to development work, while trigger scope, permissions and review conditions still deserve explicit configuration.
Why it matters: This reduces context switching when supervising recurring engineering tasks.
GitHub Changelog ↗GitHub announced that Copilot Automations can learn from previous outcomes and suggest changes to their own workflows. Teams should still verify suggested revisions, since a self-improvement loop does not remove the need for explicit change control and evaluation.
Why it matters: Traceability matters when recurring agents propose changes to themselves.
GitHub Changelog ↗GitHub expanded Copilot Automations with additional event triggers, tool integrations and cost controls. Custom MCP integrations and resource limits provide more configuration options, but actual value still depends on task complexity, usage patterns and review requirements.
Why it matters: Teams can align automation frequency with actual usage cost.
GitHub Changelog ↗GitHub announced Copilot updates for JetBrains IDEs, including local sandbox functionality and next-edit assistance. Availability varies by client, so developers should confirm which features and security controls their installed IDE version actually supports before using agent actions.
Why it matters: JetBrains users gain options without switching development environments.
GitHub Changelog ↗GitHub introduced Replica as an open-source AI prototyping tool. It is intended to help explore ideas and interactions earlier in the product cycle, while engineering teams still need to evaluate the repository, license and implementation suitability before adopting it.
Why it matters: Generated prototypes still need review before production reuse.
GitHub Changelog ↗GitHub Actions workflow lockfiles are generally available. They pin the commits executed for actions and transitive dependencies even when workflow YAML uses readable tags. Dependabot can update lock entries, but pinning a malicious dependency would not itself make it safe.
Why it matters: Lockfiles reduce unexpected dependency drift in CI pipelines.
GitHub Changelog ↗GitHub Actions is expanding eligible two- and four-core Linux runner capacity to AWS alongside Azure. Workflow labels remain unchanged, but additional outbound IP addresses may affect strict network allowlists or identity policies that assumed Azure-only infrastructure.
Why it matters: Network teams should review runner allowlists before related jobs move.
GitHub Changelog ↗WordPress released version 7.1.4 as a security update and recommends prompt installation. Fixes cover a weakness in the upgrade process, several stored cross-site scripting issues and Interactivity API problems. Site owners should back up, update and verify their themes and plugins afterward.
Why it matters: Public-facing sites should prioritize the security update and validate compatibility.
WordPress News ↗GitHub is previewing code scanning for AI applications. It looks for indirect prompt injection, sensitive information disclosures and excessive agent permissions in relevant code paths, providing pull-request guidance. The feature requires eligible GitHub Advanced Security licensing and configuration.
Why it matters: These risks matter where untrusted content reaches tool-enabled agents.
GitHub Changelog ↗GitHub introduced AI Scan for repositories in public preview, adding another approach to identifying security issues in source code. Its findings can complement other scanning techniques, but absence of an alert cannot prove that a repository or its dependencies are risk-free.
Why it matters: Findings still need confirmation and prioritization against actual exposure.
GitHub Changelog ↗GitHub has made enterprise public monitoring generally available. It helps discover exposed organization secrets in public locations beyond the organization's private repositories, supporting earlier investigation and revocation when credentials have been accidentally published.
Why it matters: Detection only helps if teams can revoke and rotate leaked credentials.
GitHub Changelog ↗GitHub is previewing push protection for sensitive values beyond its predefined secret patterns. It may flag additional accidental disclosures before code is pushed, although feature availability, activation and detection coverage still need to be checked for each repository.
Why it matters: Teams should keep complementary secret management and review controls.
GitHub Changelog ↗Dependabot is previewing reachability analysis for JavaScript and TypeScript alerts. It checks call paths to vulnerable dependency functions and labels whether they are reachable, potentially reachable or unreachable. This supplements severity and exploitation signals rather than replacing them.
Why it matters: Teams can prioritize fixes using evidence about reachable vulnerable code.
GitHub Changelog ↗GitHub announced a security extension for the Copilot app that brings code-scanning alert work into agent-supported workflows. It aims to connect investigation and remediation with the development process, while proposed security changes still require testing and review before merging.
Why it matters: Security-alert access should not bypass fix review and validation.
GitHub Changelog ↗GitHub announced a change to Copilot access for GitHub Enterprise, with plan-specific rollout and metered usage considerations. Organizations should separate account eligibility from actual model usage charges and review policy controls before changing their software budgets.
Why it matters: License reviews should account for metered use and actual adoption.
GitHub Changelog ↗GitHub is previewing Issue Artifacts, a way to connect work outputs more directly to tracked issues. This may make it easier to review supporting deliverables alongside tasks, but teams should still decide how versioned source artifacts and official records are managed.
Why it matters: Issues may become a more useful entry point for work evidence.
GitHub Changelog ↗GitHub has made an Issues moderation role generally available. It supports managing discussions and community interactions without necessarily granting the full breadth of repository administration rights, subject to the permissions and policies configured for each project.
Why it matters: Open-source projects can separate discussion moderation from repository administration.
GitHub Changelog ↗