Day's Snapshot by WRF – 1 Nov 2026
Five stories from the last two days: Salesforce's reported Rune deal, the AWS capacity debate, Cloudflare's Q3 DDoS data, the Polymarket script hijack, and a shared AI-crawler opt-out.
Salesforce reportedly to buy defense AI startup Rune for
Salesforce has reportedly agreed to acquire Rune Technologies for million in cash and stock, according to Resilience Media; Salesforce did not comment. Rune, founded in 2024, builds AI software that helps the US military forecast supply needs and manage field logistics. TechCrunch lists Salesforce's other 2026 deals as Fin (formerly Intercom), Qualified and Listen Labs.
Why it matters: Vendor acquisitions change product roadmaps. Ask Salesforce partners which new products they plan around, and when.
AWS capacity sold out through 2027? Analysts push back on the headline
Amazon CEO Andy Jassy said AWS's large committed capacity is largely sold out through 2027, with much of 2028 already allocated, while AWS keeps headroom for On-Demand, EC2 and Bedrock. Analyst David Linthicum argued the coverage blurred pre-reserved hyperscale blocks with capacity an enterprise can use day to day.
Why it matters: Before a cloud migration, ask your partner what capacity you need reserved and how pricing changes if supply tightens.
Cloudflare: 18.2 million network DDoS attacks in Q3
Cloudflare reported mitigating 18.2 million network-layer DDoS attacks in Q3 2026, up from 13.2 million in Q2, with short, low-bandwidth bursts rising sharply. Attacks above 1 Tbps fell 69%, while DNS amplification rose 215%. Media, publishing, IT services, gambling and software were the most targeted industries.
Why it matters: Ask hosting and managed cloud partners how they handle small, short attacks, not only very large ones.
Polymarket traders robbed through a hijacked third-party script
Malicious code replaced a page-speed script Polymarket loaded from DebugBear, a monitoring vendor whose DNS was compromised through its domain registrar. On October 29 it used signed-in traders' sessions to sell positions and move funds. Polymarket is refunding about .7 million to 726 wallets, and the advice includes pinning scripts with Subresource Integrity.
Why it matters: Ask your web agency which third-party scripts run on signed-in pages and whether they are pinned or reviewed.
Google, Microsoft, OpenAI and Anthropic back a single AI-crawler opt-out
A proposed standard would let sites use one robots.txt entry to block scrapers that collect training data for generative AI, instead of one entry per provider. Google, Microsoft, Anthropic and OpenAI announced support, with Microsoft and OpenAI adding it in the coming months and Google next year. Meta backs the idea but has not committed.
Why it matters: Content owners should decide their position on AI training and ask web partners to update robots.txt when support lands.