Next.js patches critical RCEs as Vercel opens its platform to Python, daemons, and persistent storage

Next.js closes two critical RCE holes

The week's most urgent news is a pair of critical unauthenticated remote code execution vulnerabilities in Next.js, patched across both the current and previous major lines. The flaws let attackers run arbitrary code through use cache functions that return typed arrays and through the Image Optimization API when SVG files are used, with a high-severity denial of service in the App Router using Server Actions fixed alongside them. Anyone running either major version should upgrade immediately; there is no workaround short of the patch.

Cloudflare moved to blunt the same class of attack. An emergency Cloudflare Managed Ruleset rule is now set to Block, targeting active exploitation of a critical RCE in popular web frameworks where malformed path sequences let attackers execute system commands with web server privileges. That rule protects unpatched applications regardless of whether they run on Cloudflare.

Vercel opens the platform beyond JavaScript

Vercel's platform week was largely about expanding what it can run. Python is now generally available for APIs, full-stack applications, and AI agents, with automatic framework detection and native SDKs — the clearest signal yet that Vercel is no longer a JavaScript-only host. Workloads that don't fit the request/response model got a home too: Vercel Daemons entered public beta for queue consumers, workflow workers, and self-hosted CI runners. Stateful work got a foundation with Vercel Drives reaching general availability, persistent storage you mount into a Sandbox so files outlive it, with forking for parallel workers. Enterprises with data-residency or compliance constraints can now run on their own infrastructure, as Bring Your Own Cloud on AWS is generally available.

Around the edges, Vercel Connect picked up two capabilities for agent-driven access: Enterprise-Managed Authorization so apps and agents act on behalf of users with access governed by the identity provider, and MCP Events support so agents can watch MCP servers and react when events arrive. The AI Gateway added Meta's Muse Spark Open and the free stealth model Cat Jam, both callable with one API key and no provider account, while Token Pass entered early access with $80 in monthly open-weight model credit for $30.

Cloudflare's network and Gateway grow sharper

Cloudflare Tunnel got dramatically more room to scale: the default route limit jumped from 1,000 to 50,000 per account, and Tunnels for Platforms lets accounts buy past the included 1,000 tunnels. The same change landed on the Core Platform side. Elsewhere in Cloudflare One, the Linux client hit general availability with a fix for split-tunnel reconnect loops, custom applications arrived in the Gateway Application Library, BGP route filtering came to IPsec and GRE tunnels, and DLP custom patterns can now call Workers to validate matches with organization-specific logic. The Gateway–Workers integration entered public beta, letting a Forward action run your own code on permitted traffic.

On the developer side, Stream WebRTC live streaming went generally available, the Agents SDK gained a persistent browser tool that keeps tabs and logins across turns, Local Explorer can invoke Cron Triggers, and AI Search keyword queries now match Japanese, Chinese, and Korean. The Cloudflare CLI added cf docs search, Workers AI welcomed Pipecat's PhoneLLM Mini for realtime voice agents, and the Workers SDK moved Access dev config under access.dev.

Tooling churn: Turborepo, Railpack, and the AI SDK

Build tooling saw steady refinement rather than headline changes. Turborepo shipped dozens of performance optimizations across lockfile parsing, cache archives, and file watching, plus a root-only turbo setup policy. Railpack added Zig builds and Turborepo cache reuse, so unchanged workspace packages skip rebuilding. The AI SDK family landed a breaking change to managed event subscriptions, image input and a 262k-token context option, a fix for lowercased URL paths, and native Pi MCP handling. Railway, meanwhile, added activity feed filters, guided IaC migration, and CLI cron jobs.