Tonight’s technology rundown is about resilience, measurement, and scale: GitHub spent the day recovering from a wide service failure, WordPress administrators received a serious Forminator warning, Apple’s latest mercenary-spyware alert wave drew an unusually large response, and three business stories show how fast AI infrastructure, AI operating costs, and online audience metrics are changing.
Listen to Jennifer’s synthesized 5 PM recap
This locally generated, non-OpenAI narration covers the same verified facts, limits, and practical actions as the article.
The 60-second rundown
GitHub’s rough Monday
Web, API, Git, Actions, identity, raw downloads, and Copilot all experienced trouble. Most systems recovered, but GitHub had not published a root cause by our cutoff.
Forminator needs 1.56.2+
CVE-2026-15748 can enable a dangerous PHP upload path on specifically configured public forms. The fix shipped July 30; today’s news is the public disclosure.
An 8-gigawatt plan
OpenAI, Nvidia, and SB Energy outlined an Ohio campus at a scale closer to regional power planning than an ordinary data center. Capacity is planned, not online.
Spyware alerts surge
Investigators reported an unusually large response to Apple’s latest threat notifications. Verify a warning in your Apple Account before trusting an email link.
A YouTube view changes
Starting August 24, a public view will count when playback starts. Engaged views and watch time will matter more when comparing real attention.
Agents can multiply cost
Gartner forecasts per-workflow inference costs rising more than fivefold through 2028. Cheap tokens do not guarantee cheap multi-step automation.
1. GitHub’s outage became a software-supply-chain lesson
GitHub opened an incident for GitHub.com at 9:40 a.m. Eastern after users encountered failures across several parts of the platform. At one checkpoint, GitHub reported roughly 20% error rates for web and API traffic and about 50% errors for archive and raw-content downloads. The failure affected much more than developers loading a website.
GitHub Actions, pull requests, issues, webhooks, API requests, Git operations, Copilot, SAML and OIDC authentication, SCIM, and Team Sync all experienced disruption at points during the incident. That combination matters because many businesses use GitHub as a control plane: code is stored there, build pipelines run there, deployment automations listen for webhooks, security tools read APIs, and enterprise users depend on identity integrations to get in.
By the 5 p.m. cutoff, most components had recovered, but GitHub still showed Copilot in a major-outage state and was investigating sporadic authentication failures. Independent same-day reporting documented the broad user impact, while GitHub’s own status record remains the authority for the operational timeline.
Do not invent a root cause
GitHub had not publicly attributed the incident to a cyberattack, traffic saturation, a bad deployment, or a cascading dependency failure by our cutoff. Those are possible failure categories, not established facts. An error graph cannot identify an attacker or a broken change by itself.
Good
The public status page exposed component-level updates, and most services recovered during the day. Teams with local clones, cached dependencies, alternate artifact stores, and deployment pause procedures had options.
Bad
A single platform can quietly become the shared dependency behind development, identity, automation, documentation, security scanning, and deployment. “The repository is online” is not enough if raw files, APIs, webhooks, or Actions are failing.
Practical move: keep local clones of critical repositories, pin production dependencies instead of fetching “latest” during deployment, maintain a documented way to pause CI/CD, and ensure emergency credentials or runbooks are not stored only inside the same unavailable service. For smaller organizations, even a read-only mirrored repository plus offline recovery instructions can reduce panic.
2. Forminator’s file-upload flaw is serious—but configuration matters
A same-day report on CVE-2026-15748 in the Forminator WordPress plugin describes an unauthenticated arbitrary-file-upload path that can lead to PHP execution. The vulnerability carries a CVSS score of 9.8 and affects Forminator versions through 1.56.1. The official Forminator changelog identifies version 1.56.2, released July 30, as the fix.
The exploit conditions are more specific than “every Forminator site can be hacked.” The vulnerable public form must include both a File Upload field and a Select field. The direct PHP-execution path is especially concerning when administrators use custom upload storage that does not have the default .htaccess protection blocking script execution. Wordfence’s disclosure explains the affected logic and configuration-dependent risk.
Today’s date needs context
This is an August 17 public disclosure of a flaw that received a fix on July 30. It is not evidence that the patch arrived today, and the checked sources did not establish active exploitation. That does not reduce the need to update; it changes how honestly we describe the timeline and urgency.
What site owners should do:
- Check the installed Forminator version and update to 1.56.2 or later.
- Inventory public forms with file uploads, especially forms that also contain select menus.
- Review custom upload directories and verify that PHP execution is blocked at the web-server level—not only by filename validation.
- Inspect recent uploaded files, new administrator accounts, scheduled tasks, and web-server logs if an affected version was exposed.
- Keep a backup made before any cleanup, but do not restore a vulnerable plugin version into production.
Updating a plugin is the first step, not the entire incident-response plan. If you find an unexpected PHP file in an upload directory, preserve evidence and assume the site may need a full integrity review. The IT Guys’ broader WordPress operations guidance also explains why visible site behavior can be separated from what the application, server, and cache layers are doing.
3. OpenAI’s planned Ohio campus is an 8-gigawatt infrastructure bet
Nvidia announced that it will exclusively supply AI-compute infrastructure for SB Energy’s PORTS-Pike Technology Campus in Ohio and provide credit support for an initial 4.25 IT-gigawatts, with an option covering the remaining 3.75 IT-gigawatts. OpenAI says it has agreed to secure approximately 8 gigawatts of IT capacity under a 20-year lease. SB Energy will build, own, and operate the campus.
Data Center Dynamics reported that phased deployment is expected to begin in 2028. Nvidia will invest $1.5 billion in SB Energy. The companies also announced an initial $80 million community-benefits fund, plans for at least 10 gigawatts of new generation, and at least $4.2 billion in regional grid infrastructure.
Those figures demonstrate why the AI race is no longer only about chips or model quality. The binding constraints increasingly include transmission, generation, cooling, construction labor, land, financing, networking, and the ability to keep very expensive hardware productively occupied.
Potential upside
The project could bring construction, grid upgrades, new generation, regional investment, and a large anchor customer to Appalachian Ohio. Dedicated infrastructure may also reduce the uncertainty of trying to squeeze a giant AI workload into ordinary colocation capacity.
Major cautions
The announced capacity is not installed or operating. Jobs, schedules, generation, permitting, transmission, environmental impact, and the full 8-gigawatt buildout remain forward-looking company commitments. A 20-year lease also concentrates hardware, financing, and technology-cycle risk around assumptions that will be tested repeatedly before 2028.
For perspective, this is not “OpenAI opened an 8-gigawatt data center today.” The accurate sentence is that the parties announced plans and financing structures for a campus that may begin phased deployment in 2028. The distinction between contracted, financed, under construction, energized, and operational is essential in data-center reporting.
4. Apple’s latest mercenary-spyware warnings deserve calm, serious action
TechCrunch reported that Apple sent its latest threat notifications to customers in 110 countries. Access Now’s Digital Security Helpline said it received approximately 30% to 40% more requests than it typically sees after an Apple notification batch, while security firm iVerify also reported an influx.
Apple describes these notices as high-confidence warnings that a person may have been individually targeted by mercenary spyware. They are not ordinary warnings about a leaked password, a generic phishing campaign, or a mass-market virus. They are also not absolute proof that a device is successfully compromised. Apple says it has notified users in more than 150 countries since 2021 and has expanded delivery so an alert may appear directly on an iPhone as well as by email and through the Apple Account website.
Verify the warning safely
Do not click an urgent link in an email or text. Open account.apple.com yourself and look for the threat notification there. Apple says its real alerts will never ask you to click a link, open a file, install an app or profile, or provide your Apple Account password or verification code.
Apple’s official mercenary-spyware guidance recommends taking the notification seriously, seeking expert help, keeping devices updated, using a passcode and two-factor authentication, installing apps only from the App Store, and considering Lockdown Mode. Access Now’s Digital Security Helpline is one route for at-risk journalists, activists, officials, researchers, and civil-society organizations.
Good
Direct on-device alerts can make a consequential warning harder to miss. Apple’s careful wording also avoids claiming certainty where forensic confirmation may require specialist work.
Bad and unknown
The response volume suggests continuing broad use of expensive targeted spyware. The checked reporting did not identify the spyware vendor, exploit chain, or sponsoring actor. More visible notifications may also account for part of the increase in help requests.
For broader Mac-security context, The IT Guys published a dedicated guide to AmnesiaStealer and browser-session theft on macOS. That is a different threat class: commodity information-stealing malware is not the same as a high-confidence Apple mercenary-spyware notification.
5. YouTube’s public “view” will measure starts, not sustained attention
Beginning August 24, YouTube will count a public view as soon as a video begins playing or a viewer enters a livestream, according to same-day reporting on the platform’s measurement change. The previous measurement will remain available to creators in Analytics as Engaged views.
YouTube says the change will not affect creator earnings or YouTube Partner Program eligibility. It does, however, change what a large public number communicates. A person who starts a video and leaves almost immediately can add to the visible count. That brings regular video and livestream counting closer to the exposure-first conventions used for Shorts, TikTok, and Instagram.
Good
Creators receive a more consistent exposure metric across formats. A start can be useful when measuring reach, thumbnail performance, or how many people encountered a live event.
Bad
Public view totals may rise without an equivalent rise in meaningful attention. Autoplay, accidental starts, and brief visits can make popularity look stronger, and historical comparisons across the August 24 boundary become less reliable.
For creators and advertisers: track engaged views, watch time, average percentage viewed, completion rate, returning viewers, conversions, and traffic quality. Do not use a public view count alone to price sponsorships or declare a campaign successful. YouTube never formally disclosed the old public-view threshold, so avoid repeating the familiar “30-second rule” as an official universal standard.
6. Gartner’s warning: cheaper tokens can still produce more expensive agents
Gartner forecasts that AI inference cost per agentic workflow will rise more than fivefold through 2028, even as per-token prices decline. The reason is workload expansion: an agent may plan, call tools, inspect results, negotiate with another agent, retry failed steps, and run self-checks before declaring a task complete.
The Register’s same-day coverage explains the business problem: routing a task to an agentic reasoning model can already cost providers at least five times as much as a basic chatbot interaction, and more complex workflows multiply the difference. A company that watches only the price per million tokens can miss the number of turns, tool calls, models, retries, and verification passes required for one useful outcome.
A forecast is not a bill
Gartner’s figure is a forecast, not an observed market-wide increase, and its public release does not expose a full model of every assumption. A tightly bounded classification agent and a free-roaming research agent can have radically different costs. The useful lesson is to measure the completed workflow rather than treat the forecast as universal arithmetic.
Practical controls for businesses:
- Define a maximum cost, tool-call count, runtime, and retry budget per workflow.
- Route simple tasks to the least-expensive capable model.
- Require human approval before financial, account, security, deletion, or customer-facing actions.
- Measure successful completed outcomes—not demonstrations, prompts, or raw token volume.
- Log model choice, tool use, errors, retries, and the reason an agent escalated.
- Keep a manual fallback when the agent, API, or identity provider is unavailable.
AI agents can create value when a more expensive workflow eliminates larger labor, delay, or error costs. They can also become an invisible cloud-spending multiplier when every task gets the most capable model and unlimited retries.
What to do tonight
- Developers: verify GitHub-dependent builds and deployments before assuming the status-page recovery means every webhook, raw file, token, and Action worked.
- WordPress owners: update Forminator to 1.56.2 or later and inspect public forms with upload plus select fields.
- Apple threat-notification recipients: verify at account.apple.com, update devices, consider Lockdown Mode, and seek expert help.
- YouTube creators: mark August 24 in analytics notes and preserve engaged-view and watch-time baselines.
- AI buyers: budget per completed workflow, set cost ceilings, and require approval for consequential actions.
- Windows administrators: read The IT Guys’ guides to WMIC removal and the movable Windows 11 taskbar preview rather than treating either as a same-day production patch.
Windows, Apple, consumer, and business-tech watch
Today’s dedicated The IT Guys reporting already covered the Meta privacy trial and YouTube’s role, business VoIP outage and 911 planning, Windows taskbar changes, WMIC retirement, and AmnesiaStealer. This recap does not repeat those articles as if they were separate discoveries. Instead, it links them where they add practical context.
Frequently asked questions
Was GitHub hacked?
GitHub had not disclosed a root cause by our cutoff. The outage affected many services, but service disruption does not by itself prove a cyberattack. Use GitHub’s incident record for the final postmortem.
Is every Forminator website vulnerable to remote code execution?
No. The disclosed path requires affected versions and a susceptible form configuration, including File Upload and Select fields. Custom upload storage can increase the PHP-execution risk. Update regardless, then verify form and upload-directory configuration.
Is the 8-gigawatt Ohio AI campus already running?
No. The parties announced planned capacity, financing, leases, generation, and grid investment. Phased deployment is expected to begin in 2028. Contracted or planned capacity is not the same as energized operating capacity.
Does an Apple threat notification prove my iPhone is infected?
No. Apple describes it as a high-confidence warning of individualized targeting, not absolute proof of successful compromise. Verify the alert at account.apple.com and follow Apple’s official guidance.
Will YouTube creators be paid more because public views count sooner?
YouTube says the change will not affect creator earnings or Partner Program eligibility. Public views, engaged views, watch time, and revenue are different measurements.
Will every AI agent become five times more expensive?
No. Gartner’s figure is a forecast for per-workflow inference cost through 2028. Actual cost depends on model routing, turns, tools, retries, task complexity, and controls. Measure your own completed workflows.
Sources and methodology
This edition covers developments published or materially updated from midnight through 5:05 p.m. Eastern on August 17, 2026. The reporting uses direct vendor status pages, official security guidance, company announcements, plugin records, and reputable same-day reporting. Company plans and forecasts are labeled as such; the GitHub root cause is not guessed; the Forminator patch date is separated from today’s disclosure date; and planned data-center capacity is not described as operating infrastructure. Direct sources appear in each section.
For continuity, read the August 16 technology recap. News, outage status, exploitation evidence, and vendor guidance can change after publication, so follow the linked primary sources for the latest record.
Published by Jennifer Hudsen for The IT Guys. Jennifer’s narration is locally synthesized and is not a human recording.