Last checked October 4, 2026 · News roundup
Today in brief: HubSpot has started selling a new seats-and-credits plan to new customers in Europe, a likely preview of what US buyers will see later. Supabase raised $150 million and is buying Turso, while GitLab and Epic both had to stop and fix serious security problems. On the legal side, Google won dismissal of two AI Overviews antitrust suits, and a new executive order renames AI in federal documents.
| Date | Story | Who it hits |
|---|---|---|
| Oct 1 | HubSpot seats + credits pricing | New EMEA customers now; US later (no date) |
| Oct 2 | GitLab AI Gateway, CVSS 9.9 | Self-hosted AI Gateway admins |
| Oct 2 | Epic pauses most product work | US hospitals and clinics on MyChart |
| Oct 2 | Supabase $150M + Turso deal | Supabase and Turso developers |
| Oct 1 | Armadin $255.5M Series B | Security teams buying pen testing |
| Oct 1 | AI Overviews suits dismissed | Publishers and SEO-driven businesses |
| Sept 29–30 | "Super Intelligence" executive order | Federal agencies and contractors |
Is HubSpot changing its pricing? Yes, to seats plus credits
From October 1, 2026, new HubSpot customers in Europe, the Middle East and Africa buy one platform edition (Starter, Professional or Enterprise) plus seats and a monthly pool of usage credits, instead of buying hub by hub. Each edition includes credits every month: 5,000 on Starter, 10,000 on Professional and 15,000 on Enterprise, Martech Notes reported. Credits reset monthly and do not roll over.
Usage draws on those credits. A marketing email costs 15 credits per send for the first 10,000 sends, with lower rates at higher volumes. One-to-one emails are excluded. A UK partner, The Growth Agency, lists seat prices of €20/£18 for a Starter GTM seat, €100/£90 for Pro and €175/£155 for Enterprise. It also says the change cuts HubSpot's catalog from 73 products to 23.
Existing customers stay on their current pricing, and HubSpot has given no migration date. It also hasn't announced when the model reaches the US. What to do: if you plan to sign with HubSpot in the US, ask your rep whether your quote will be honored if the credit model arrives before your renewal. Then estimate your monthly email and workflow volume in credits. Other October price changes, including Atlassian and GitHub Copilot, are in our SaaS pricing watch.
GitLab AI Gateway vulnerability CVE-2026-90970: patch self-hosted servers now
GitLab fixed a critical flaw in its self-hosted AI Gateway, tracked as CVE-2026-90970 with a CVSS score of 9.9, The Hacker News reported on October 2. A specially crafted custom flow configuration could escape the prompt-template sandbox and run arbitrary commands on the gateway.
Affected versions are 18.1.6 through 19.2.3, 19.3.0 to 19.3.1, and 19.4.0. The fixes are 19.2.4, 19.3.2 and 19.4.1. GitLab.com and GitLab Dedicated are not affected, because GitLab has already patched its hosted gateways. GitLab "strongly recommends" that self-hosted customers update immediately. No exploitation had been reported as of October 2.
What to do: if you run Duo through your own AI Gateway, update the Docker image or Helm chart to a fixed version today, then check gateway logs for flow configurations you don't recognize.
| If you run | Upgrade to |
|---|---|
| 18.1.6 – 19.2.3 | 19.2.4 |
| 19.3.0 – 19.3.1 | 19.3.2 |
| 19.4.0 | 19.4.1 |
| GitLab.com or GitLab Dedicated | No action: already patched |
Why Epic paused product development for about six weeks
Epic Systems, whose MyChart portal holds more than 320 million patient records, has paused most product development to fix security bugs, TechCrunch reported on October 2. The flaws were found with Anthropic's Mythos security model. Epic's chief security officer said some customer configurations of MyChart "could allow outsiders to access patient records without recording any intrusion."
CEO Judy Faulkner said the pause would "likely last six weeks." Patient data sits with each hospital or clinic, not with Epic. The risk is that one undiscovered bug could expose many MyChart systems at once.
Who this affects: US hospitals, clinics and the IT vendors that integrate with Epic. Expect delayed feature releases through mid-November, and watch for configuration guidance from Epic. If you run a MyChart instance, have your team confirm which settings Epic flags and apply its fixes first.
Supabase raises $150M and buys Turso: what changes for developers
Supabase announced a $150 million Series G on October 2, led by GIC with CapitalG, IronArc and SquarePeg. It comes four months after a $500 million Series F that valued the company at $10.5 billion. The new valuation wasn't disclosed. Supabase is also acquiring Turso, the SQLite-based database company, for undisclosed terms.
Supabase says 70% of new databases on its platform are now created by AI agents or AI-driven tools, and it adds more than 1 million users and 4 million databases a month. CEO Paul Copplestone said Turso's architecture will help make Supabase "the backend platform" for agents.
No pricing changes were announced. Turso will keep running, with what the company calls "a clear graduation path" into Supabase. If you're on Turso, nothing breaks today, but keep an eye on your plan terms at renewal.
Armadin, Kevin Mandia's new security startup, raises $255.5M
Armadin, founded by Mandiant founder Kevin Mandia, raised a $255.5 million Series B at a $2.5 billion valuation on October 1, TechCrunch reported. Andreessen Horowitz and Accel led the round, with Bain Capital Ventures, Redpoint, 8VC, Ballistic Ventures, GV, In-Q-Tel, Kleiner Perkins and Menlo Ventures joining. It follows a $190 million Series A in March, so total funding is now above $445 million.
Armadin sells "always-on agentic swarms": AI agents that keep testing a company's defenses by chaining vulnerabilities together the way an attacker would. For security buyers, this is a move from yearly penetration tests toward continuous testing. The size of the round also shows how much investors expect AI-driven attacks to grow. Before you sign with any vendor in this category, ask how it limits what its agents can touch in production and how it logs every action they take.
Google wins dismissal of the Chegg and Penske AI Overviews lawsuits
Federal judge Amit Mehta dismissed the antitrust suits that Chegg and Penske Media brought against Google over AI Overviews, Quartz reported on October 1. Penske publishes Rolling Stone. As Quartz summarized it, the court found the plaintiffs "have no legal expectation that Google will send them traffic in exchange for indexing their content."
For businesses that live on search traffic, this removes one legal route to pushing back on AI summaries in search results. No appeal had been announced in the coverage we reviewed. The practical takeaway is to plan for AI Overviews staying in place. Track which of your pages lose clicks when an overview appears, and put more effort into content a summary can't replace, such as original data, tools and first-hand testing.
The "Super Intelligence" executive order: what it means for businesses
President Trump signed an executive order directing federal agencies to use "Super Intelligence" (SI) instead of "artificial intelligence" in official communications, websites, reports and policy documents. Fox Business dates the signing to September 29, while GovConWire reported it on September 30. Existing contracts, grants and regulations are unchanged. The current legal definition applies until the President's science and technology adviser proposes new wording, due within 60 days, GovConWire reported.
At the same event, Sundar Pichai, Dario Amodei, Mark Zuckerberg, Greg Brockman, Elon Musk and Jensen Huang signed an industry commitment. It covers internal monitoring, dedicated control teams, independent external auditors and board-level oversight. Trump called it "morally binding." It is not law.
For most businesses, nothing changes today. Federal contractors should expect "SI" wording in new solicitations and update capability statements to match.
Quick answers
Is HubSpot raising prices in the US?
Not yet. HubSpot's seats-and-credits model went live on October 1, 2026, for new customers in Europe, the Middle East and Africa only. Existing customers keep their current pricing, and HubSpot hasn't announced a US date. US buyers should ask their rep how a future switch would affect a new contract.
Is GitLab.com affected by CVE-2026-90970?
No. The flaw affects self-hosted GitLab AI Gateway deployments. GitLab has already patched the gateways behind GitLab.com and GitLab Dedicated. Self-hosted admins should upgrade to 19.2.4, 19.3.2 or 19.4.1, depending on their branch. No exploitation had been reported as of October 2, 2026.
Is Turso shutting down after the Supabase deal?
No. Supabase said on October 2, 2026, that the Turso platform will keep operating, with "a clear graduation path" into the rest of Supabase. No pricing changes were announced, and the deal terms weren't disclosed. Turso users should review their plan terms at their next renewal.
Sources: Martech Notes, HubSpot seats-and-credits pricing (Oct 1, 2026) · The Growth Agency, HubSpot pricing explained (Oct 1, 2026) · The Hacker News, GitLab AI Gateway flaw (Oct 2, 2026) · TechCrunch, Epic pauses development (Oct 2, 2026) · PR Newswire, Supabase funding and Turso (Oct 2, 2026) · TechCrunch, Armadin Series B (Oct 1, 2026) · Quartz, AI Overviews suits dismissed (Oct 1, 2026) · Fox Business, Super Intelligence order (Sept 29, 2026) · GovConWire, order and accord (Sept 30, 2026)
