Daily brief · August 24, 2026

Lifecycle discipline matters on quiet news days.

Four developments cleared the verification and significance bar. Each item links to a primary source and includes the engineering implication.

10 minute read4 developmentsPrimary sources

AI & Models2 min read

Vertex AI shuts down the legacy Claude 3 Haiku endpoint

Google Cloud’s published lifecycle schedule reached its August 23 shutdown date for Anthropic’s Claude 3 Haiku on Vertex AI, six months after deprecation. Workloads still pinned to that partner-model endpoint need to move to a supported Claude generation.

Why it mattersModel endpoints are infrastructure dependencies. Teams need deprecation inventories, fallback tests and explicit model-version ownership to prevent a scheduled retirement from becoming an application outage.

Source: Google Cloud Vertex AI release notes ↗ · Published Effective August 23, 2026

#Vertex AI#Claude 3 Haiku#deprecation#model migration

Cloud & Infrastructure2 min read

Google completes the Looker 26.14 rollout

Looker 26.14 reached its scheduled final deployment and download availability on August 23. The release fixes stalled string filters, obstructed visualization editing, and rendering failures involving LookML drill links and Liquid variables, alongside other platform changes.

Why it mattersAnalytics applications often embed Looker behavior into customer workflows. Completing the rollout makes this the right point to regression-test dashboards, embedded views and custom LookML rather than relying on staged-release assumptions.

Source: Google Cloud release notes ↗ · Published August 23, 2026

#Looker#Google Cloud#LookML#analytics

Security3 min read

Critical justhtml flaws expose unsafe sanitization paths

CVE-2026-5388 covers multiple issues in the Python justhtml package before 1.15.0 that can permit active HTML or JavaScript injection through URL helpers, serialization, Markdown passthrough and custom policy edge cases. The default sanitize=True path is not affected by most of the custom-policy issues.

Why it mattersSanitizers sit at a high-risk trust boundary. Teams using helper APIs, html_passthrough=True or custom transformations should upgrade and add adversarial tests instead of assuming the default sanitizer’s safety extends to every configuration.

Source: GitHub Security Advisory ↗ · Published August 23, 2026

#CVE-2026-5388#Python#HTML sanitization#XSS

Security3 min read

Fabrik for Joomla fixes an unauthenticated code-execution path

Updated vulnerability records clarify that Fabrik versions through 4.7.1 are affected by an unauthenticated remote-code-execution flaw in the PHP form element (CVE-2026-76604). A companion issue, CVE-2026-76607, covers a missing access-control check in the download element; fixed releases begin with 4.7.2.

Why it mattersExtension-level flaws can bypass the security assumptions of the host CMS. Operators should inventory Fabrik installations, update promptly and review exposed forms and download activity for signs of abuse.

Source: NIST NVD / Joomla Project ↗ · Published Updated August 23, 2026

#Joomla#Fabrik#CVE-2026-76604#RCE