Executive Summary
Five moves landed this week and not one changed a product. Lenders repriced borrowed GPU capacity, Broadcom partner policy put a hard date on the last license-included path into VMware, and a CVSS 10.0 in GitLab turned out to live in Onigmo, the regex engine Ruby ships, rather than in code GitLab wrote. Jefferies measured announced AI capacity running roughly three times ahead of delivery by 2029, 18 gigawatts claimed against 5.86 expected. Each constraint sat beneath the thing somebody was buying.
The verdict is that capacity planning still gets written against the purchase and not against the layer under it, and the two keep different clocks. A purchase order moves when a vendor signs it. A permit, a resale agreement and a language runtime move on their own schedule, and none of them speed up because the budget got bigger. Until then, shorten the horizon on capacity commitments and price the delay in early.
Everything that bit this week sat a level below the purchase order. That is where the schedule lives now.
The credit desk repriced the fleet before the grid did
The repricing of CoreWeave debt is the clearest case. Five year credit default swaps widened 39 percent in October to 1,145 basis points, and unsecured debt trades near a 15 percent yield. The company carries about 35.6 billion dollars of debt against revenue where two thirds of last year’s total came from one customer.
The reason is not chips. Credit desks told CNBC that high yield issuance for AI data centers is on hold until the midterm elections pass, because fixed income investors want permitting and regulatory requirements substantially resolved first. That is a paperwork condition bolted onto a silicon purchase.
The same divergence showed up in the forecast data. Jefferies tracks about 65 gigawatts of North American capacity under construction and another 361 gigawatts announced, then discounts both for labor, electrical equipment and politics. For hyperscalers the expected build in 2029 comes to 5.86 gigawatts against 18.00 claimed. Its model rotates the binding constraint by year, with trades and labor biting now, equipment through 2029, and grid power taking over in 2030.
Google bought the cheapest available answer on 22 October, funding a one gigawatt virtual power plant with Voltus in PJM on top of 100 megawatts signed in June. That auction cleared at the price cap for the third time running and still finished 6,831 megawatts under its reliability requirement. A virtual power plant megawatt exists only while somebody agrees to draw less.
Broadcom put a date on the last cheap route into VMware
Microsoft put two dates in one Azure update on 18 August and they are not the same kind of deadline. PayGo SKUs with VMware Cloud Foundation included retire on 31 October, which is next week. Every license-included Azure VMware Solution service ends on 30 August 2027. The first is a purchase. The second is a project, and a project of this shape took Topgolf six months.
Broadcom set both dates. Its terms stop hyperscale partners reselling VMware licenses, so every cloudy VMware service converges on a bring-your-own VCF subscription bought from Broadcom and registered on each private cloud separately, under the private cloud licensing terms. Everyone on license-included PayGo has no reservation to exchange and no route that skips the negotiation.
The counterweight sits on the Broadcom side of the ledger. NTT DOCOMO signed ten years on 19 October covering VCF, Avi Load Balancer, vDefend and Tanzu Platform on the Forte support tier. That is the quiet half of a licensing shift. Terms get longer while the options get fewer.
Two criticals this week were in code nobody audits
GitLab shipped 19.5.1 and six backports on 21 October with a single entry scored 10.0. CVE-2026-110264 lets an unauthenticated request run code on a self-managed server. The bug is not in code GitLab wrote. It is an integer overflow in the regex compiler inside Onigmo, the engine Ruby calls for every pattern, so the fix had to land in the runtime GitLab ships and publishes alongside its own releases.
The mechanism takes one line. Past 32,767 range repeats or null checks in a single pattern, the bytecode identifier wraps negative, and at match time that negative index reads backwards past the start of the repeat stack. Every release from 7.0 onward carries the same engine, so an instance four majors behind is exposed exactly like a current one.
PHP2Shell made the same point. CVE-2026-109618 and CVE-2026-109619 were patched on 21 October, and an attempt to exploit them reached Amazon honeypots on 17 October while both were still under embargo. Neither needs a flaw in your application. A site is exposed on the strength of its runtime alone, and more than a million internet-facing hosts sit on a PHP branch that will never receive the fix.
Related reading. Three more from the week. llm-d reached 1.0 and led with a fair queue, which says admission is the scarce resource now. LiteLLM shipped a credential stealer through three stolen developer tokens. And Saudi Arabia is building 50 megawatts for a buyer it will not name.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.