Tech Pulse — Mar 28, 2026
DeepMind AlphaEvolve recovers 0.7% of Google's global compute, SQL Server CVSS 8.8 zero-day enables sysadmin escalation, Nscale closes Europe's largest-ever AI infrastructure raise at $2B, and Shield AI reaches $12.7B on defense autonomy.
Founder & AI Researcher • March 28, 2026
Today's Top Highlights
- 🚨 SQL Server Zero-Day: CVE-2026-21262 (CVSS 8.8) lets any logged-in SQL Server user self-escalate to sysadmin — full DB read/write/delete, publicly disclosed. Patch Tuesday fix available now.
- 🔴 .NET 9 & 10 DoS: CVE-2026-26127 (CVSS 7.5) remotely crashes .NET apps on Windows, macOS, and Linux — Office preview-pane RCE (no user interaction) also patched this cycle.
- 🤖 AlphaEvolve in production: DeepMind's Gemini-powered coding agent has been running inside Google's infrastructure for over a year — recovering 0.7% of global compute and speeding up a Gemini training kernel by 23%.
- 💰 Nscale $2B Series C: Europe's largest-ever AI infrastructure raise at $14.6B valuation — 200,000 NVIDIA GB300 GPUs committed, backed by NVIDIA, Dell, Nokia, Goldman Sachs, and Citadel.
- 💻 GitHub PR Dashboard: New pull request inbox + saved views in public preview; Credential Revocation API now covers OAuth and GitHub App tokens — programmatic revocation of any exposed credentials.
🚨 CRITICAL: Patch Tuesday — SQL Server Privilege Escalation, .NET DoS & Office Preview-Pane RCE
Microsoft's March 2026 Patch Tuesday patches 83 CVEs with two publicly disclosed flaws that directly impact developers and DBAs. The highest-severity entry lets any authenticated SQL Server user silently escalate to sysadmin without additional interaction — a critical enterprise risk that has been publicly documented before patching.
- CVE-2026-21262 (SQL Server, CVSS 8.8): Authenticated privilege escalation to
sysadmin— any logged-in SQL Server user can gain full read/write/delete access and create new accounts. Publicly disclosed pre-patch. - CVE-2026-26127 (.NET 9.0 + 10.0, CVSS 7.5): Remote denial-of-service crash affecting .NET apps on all platforms (Windows, macOS, Linux). Publicly disclosed. Patch via SDK update or NuGet package.
- CVE-2026-26110 & CVE-2026-26113 (Microsoft Office): Two RCE flaws exploitable via the preview pane — no user interaction beyond opening a folder. Affects all Windows enterprise Office environments.
- APT28 linkage: Russian state actor APT28 has been attributed to CVE-2026-21513 (MSHTML zero-day, previously patched February 2026) — signals continued nation-state exploitation of Office-layer vulnerabilities.
⚠️ Developer Action Required — Patch Today
dotnet --version # verify post-update
# SQL Server: apply KB patch from Windows Update
# Verify: SELECT @@VERSION after update
- Apply March 2026 cumulative update to all SQL Server instances — prioritize internet-facing or shared-tenant databases.
- Update .NET 9 and .NET 10 SDKs on all build agents, CI runners, and production servers.
- Disable Office Preview Pane on Windows endpoints until patch is confirmed applied via Intune/WSUS.
- Review SQL Server audit logs for unexpected
sysadminrole additions since January 2026.
Tenable: Full March 2026 Patch Tuesday analysis — CVE-2026-21262 & CVE-2026-26127 →
DeepMind AlphaEvolve: AI Code Agent Recovering 0.7% of Google's Global Compute
Google DeepMind has revealed that AlphaEvolve — a Gemini-powered autonomous coding agent — has been running continuously inside Google's own infrastructure for over a year, making it the first confirmed large-scale AI agent with verified ROI at hyperscaler scope. The system uses evolutionary search to discover novel algorithms and rewrite production code.
- Compute recovery: AlphaEvolve continuously reclaims 0.7% of Google's worldwide computing resources by optimizing scheduling and kernel-level operations — at Google's scale, that represents hundreds of millions in annual cost avoidance.
- Training acceleration: A key Gemini training kernel was sped up by 23% after AlphaEvolve autonomously rewrote the underlying algorithm — a breakthrough that manual optimization had not achieved.
- Scientific expansion: AlphaEvolve's accelerated access program has been extended to U.S. Department of Energy National Laboratories for scientific algorithm design, including computational physics and climate modeling.
- Complexity theory: The agent has solved open problems in algorithmic complexity, advancing the frontier of what automated code discovery can achieve beyond existing human-written solutions.
DeepMind Blog: AlphaEvolve — evolutionary code agent at production scale →
GitHub: New PR Dashboard, Credential Revocation API & Actions Security Roadmap
GitHub shipped three significant developer-facing updates this week, addressing long-standing pain points in pull request management, supply-chain credential exposure, and CI/CD pipeline security following a wave of tj-actions and trivy-action supply-chain attacks.
- PR Dashboard public preview: The refreshed
github.com/pullsintroduces a PR inbox and saved views — enabling teams to triage, filter, and prioritize open reviews across multiple repositories from a single pane. - Credential Revocation API: Programmatic revocation of GitHub OAuth tokens and GitHub App credentials — any exposed token found in code, logs, or third-party services can now be revoked via API call without manual portal access.
- Actions 2026 Security Roadmap: GitHub published its full Actions security strategy in direct response to the tj-actions/changed-files, Nx, and trivy-action supply-chain compromises — including mandatory workflow pinning enforcement and provenance attestation requirements.
- Copilot Coding Agent metrics: GitHub now separately tracks Copilot Coding Agent (CCA) users in usage dashboards — distinguishing agentic multi-step task completion from single-line IDE completions.
Stay Updated with Tech Pulse Daily
Get the latest tech news delivered to your inbox. Free, no spam.
Join 10,000+ readers
Nscale $2B Series C — Europe's Largest-Ever AI Infrastructure Raise
UK-based AI hyperscaler Nscale has closed a $2 billion Series C — the largest venture capital round in European history — valuing the company at $14.6 billion. The raise consolidates Nscale's joint venture with Aker ASA and positions it as Europe's primary sovereign AI infrastructure alternative to US hyperscalers.
- GPU deployment: Plans to deploy approximately 200,000 NVIDIA GB300 GPUs across data centers in Europe and the US — creating one of the highest-density AI training clusters outside the US hyperscalers.
- Strategic investors: Consortium led by Aker ASA and 8090 Industries; co-investors include NVIDIA, Dell, Nokia, Goldman Sachs, Citadel, Jane Street, Point72, and Lenovo — unusually broad institutional and strategic backing.
- UK commitment: £2 billion committed to UK data center buildout by 2028, addressing European sovereign AI compute demand driven by GDPR and EU AI Act compliance requirements.
- Board expansion: Sheryl Sandberg, Susan Decker, and Nick Clegg join as new board members — signaling governance maturity ahead of potential future public offering.
Shield AI $1.5B Series G — Defense Autonomy at $12.7B Valuation
San Diego-based Shield AI has raised a $1.5 billion Series G at a $12.7 billion valuation, cementing its position as the leading AI autonomy stack for military drones and aircraft. The round represents the largest defense-AI raise of Q1 2026 and signals that autonomous weapons systems are moving from R&D into large-scale production deployment.
- Hivemind stack: Shield AI's core product enables drones and aircraft to operate autonomously without GPS, communications links, or human pilots — critical for contested electromagnetic environments.
- Investors: Round led by Advent International and JPMorgan Chase's Strategic Investment Group — both with deep aerospace and defense portfolio experience.
- Acquisition target: Plans to use capital to acquire Aechelon Technology, a defense simulation specialist, consolidating software, autonomy, and synthetic training environments into one platform.
- Market context: AI defense companies are consolidating — full-stack government platforms integrating autonomy, simulation, and live fleet management are becoming the new standard contract requirement.
OpenAI GPT-5.4 Codex Plugins + SoftBank's $40B Bridge Loan
OpenAI's GPT-5.4 ships with a 1-million-token context window and autonomous multi-step workflow execution across desktop environments — a direct upgrade path for developers building agentic applications. Separately, SoftBank has secured a $40 billion bridge loan to fund further OpenAI investment, underscoring the scale of capital committed to the frontier AI race.
- 1M context window: GPT-5.4 supports up to 1 million tokens in a single context — enabling full codebase ingestion, long document analysis, and sustained multi-session agentic workflows without summarization truncation.
- Codex plugins: Standardized repeatable AI workflows with 20+ initial integrations including Figma, Notion, Gmail, and Slack — enabling production-grade automation without custom API glue code.
- OSWorld-V benchmark: GPT-5.4 scores 75% on OSWorld-V (simulated desktop productivity tasks) — highest score on autonomous software execution benchmarks to date.
- SoftBank $40B: Arranged with JPMorgan, Goldman Sachs, Mizuho, SMBC, and MUFG, running to March 2027 — total SoftBank commitment to OpenAI now exceeds $50 billion, the single largest position in the AI stack.
AI Model Releases 2026: GPT-5.4 technical details and benchmarks →
Meta & Alphabet Found Liable in Child Harm Trials — Legal Precedent Set
A Los Angeles jury has returned the first US verdict holding both Meta and Alphabet (Google) liable in child harm lawsuits, ordering a combined $6 million in damages. While the dollar amount is modest, the verdict establishes legal precedent that platform recommendation algorithms can carry product liability — a ruling with profound implications for how developers and product teams design content distribution systems.
- Precedent value: This is the first time a US jury has found Big Tech liable for algorithmic harm to minors — hundreds of similar pending cases will now use this ruling as a template for damages claims.
- Algorithm design risk: The verdict targets recommendation engine behavior, not just content moderation failures — suggesting courts are prepared to treat algorithmic amplification as a design defect subject to product liability law.
- Regulatory convergence: Ruling aligns with the EU Digital Services Act's algorithmic accountability requirements and KOSA (Kids Online Safety Act) provisions currently advancing in US Congress.
- Developer impact: Teams building recommendation systems, social feeds, or content ranking algorithms should now treat algorithmic amplification of harmful content as a legal liability risk, not just a moderation concern.
TechStartups: Meta & Alphabet child harm trial verdict — full coverage →
💱 Currency & Crypto Snapshot
INR holding near 3-month average; markets quiet ahead of RBI Q2 policy review.
🚀 Tech News Delivered Daily
Stay ahead of the curve with our daily tech briefings.