Visualização normal

Antes de ontemCybersecurity News
  • ✇Security | CIO
  • DeepSeek raises some V4 prices by more than 10x as AI demand strains capacity
    One of AI vendor DeepSeek’s biggest selling points has been its ultra-low price point, but that party’s about to end. The Chinese model provider is raising API pricing for its V4 model family by notable margins, in some cases by more than 1,100%. The increases may not be that dramatic for all, though; the company is encouraging “more flexible workload scheduling,” with peak rates and half-price off-peak rates. The news was tucked into the announcement of the general
     

DeepSeek raises some V4 prices by more than 10x as AI demand strains capacity

13 de Agosto de 2026, 23:21

One of AI vendor DeepSeek’s biggest selling points has been its ultra-low price point, but that party’s about to end.

The Chinese model provider is raising API pricing for its V4 model family by notable margins, in some cases by more than 1,100%. The increases may not be that dramatic for all, though; the company is encouraging “more flexible workload scheduling,” with peak rates and half-price off-peak rates.

The news was tucked into the announcement of the general availability (GA) of DeepSeek V4-Pro and upgrades to VR-Flash. The new pricing takes effect for most parts of the world on August 16.

“On paper, at peak, against the right comparator, DeepSeek’s price advantage does disappear, and in places inverts,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. But in practice, “the schedule’s own clock and cache hand most of it back to any buyer paying attention.”

How Flash and Pro compare now

The new API pricing structure is as follows:

  • Flash is now $0.22 per million input tokens (cache miss) and $0.66 per million output tokens off-peak; and $0.44 per million input tokens (cache miss) and $1.32 per million output tokens at peak.
    This is up from the flat rate of $0.14 for inputs (cache miss), representing a 57% to 214% increase, and $0.28 per million tokens for outputs, a 136% to 371% increase.
  •  Pro is now $0.66 per million input tokens (cache miss) and $1.98 per million output tokens off-peak; and $1.32 per million input tokens (cache miss) and $3.96 per million output tokens at peak.
    This represents an input increase of between 51% and 203% (up from $0.435) and output increase between 127% and 355% (up from $0.87).

Inputs with cache hits, when apps reuse stored prompts rather than processing similar requests from scratch, have even more dramatic pricing increases of 52% to 1,100%.

Mark Tauschek, VP of research fellowships and distinguished analyst at Info-Tech Research Group, pointed out that the increase does eliminate the price advantage that 4.0 Flash has over OpenAI 5.6 Luna at peak pricing, but not at off-peak pricing, as OpenAI has dropped Luna API pricing by 80%, off-peak.

It also doesn’t eliminate Deepseek 4.0 Pro’s price advantage over Terra, OpenAI’s GPT-5.6 mid-tier reasoning model, even at peak pricing, nor its advantage over GPT-5.6 Sol released in July, Tauschek said.

Greyhound Research’s Gogia noted that, off-peak, V4 Flash is “marginally more expensive” on input and 45% cheaper on output than Luna. Pro at peak, meanwhile, runs close to 5x Luna’s price on a representative coding-agent workload.

DeepSeek’s roughly 98% cache-hit discount, against an industry norm nearer to 90%, is the mechanism that has kept its measured cost per task at about 60% below Luna, even after Luna’s cost cut, he said.

“The schedule re-prices exactly that mechanism,” Gogia said. Flash’s edge over Luna decreases from roughly sevenfold to threefold off-peak, and 1.4 times at peak. “The cache is where the advantage genuinely erodes.”

Encouraging users to rethink their schedules

DeepSeek’s V4-Pro is now generally available, and V4-Flash is in beta. Both models have new flexible reasoning capabilities (low, high, max) and ‘thinking modes’ that use chain-of-thought (CoT) reasoning to improve answer accuracy. V4 Pro is now available on app, web, and via API, and users can try it using “Expert Mode.” V4 Flash is now in beta.

The general availability “completes a two-tier structure in which Flash serves volume and Pro is priced for complexity,” Gogia noted.

DeepSeek’s peak/off-peak pricing is a means to “allocate resources more reasonably,” the company said, to encourage users to “schedule their tasks based on actual usage.”

Gogia pointed out that with the new model, 17 of every 24 hours stay at half price, so timing becomes an economic variable, and work that can wait moves into the cheap hours. In fact, the new pricing schedule hits DeepSeek’s home market hardest and its export market lightest; Western buyers largely pay the off-peak rates.

“Usage is following economics at least as much as capability, and economics can change by schedule,” Gogia noted.

Simple supply and demand

Reading between the lines provides a more nuanced picture, Tauschek noted. “While it’s alarming to see the headlines saying DeepSeek is raising API pricing by 50%-1100%, it doesn’t really tell the whole story.”

Part of that story is demand, which is increasing exponentially. DeepSeek can’t keep up with compute requirements, and Anthropic also had a price increase for the same reason in April. And, while third-party providers have not yet reflected that trend, they’ll eventually have to, Tauschek said.

“This isn’t unexpected at all,” he noted. “It’s simple supply and demand: when demand goes up, pricing goes up, because supply becomes constrained.”

For enterprises that do use DeepSeek (many in the US do not, or can not), the new pricing is not likely to change anything, he said. Cost increases will mostly impact developers, but it will still be less expensive than most alternatives.

He pointed out that enterprises are adapting to model routing, which is critical for developers using agentic workloads. Just a few months ago, organizations were paying per-seat pricing and running up usage as a matter of course, but the market move to usage-based pricing has resulted in sticker shock akin to that of the early cloud days.

Pricing will continue to be a big deal because CFOs are starting to ask what they’re getting for the massive AI spend,” Tauschek said.

DeepSeek pricing doesn’t change the need for compatibility, multi-modality

CIOs should read the schedule with “relief and unease,” Gogia noted. Relief because the bill is largely schedulable; unease because “a supplier that has learned to price the clock has learned something about its own leverage.”

Going forward, he predicted, Flash keeps the volume usage, Pro handles complexity, and interface compatibility lowers the cost of adoption and departure. The real question becomes whether lower economic floors, open weights, and compatible interfaces, when taken together with multi-model routing, make foundation model intelligence materially easier to substitute.

Capable inference can be produced “far below the price structures that once surrounded frontier AI,” Gogia noted, and open weights mean model developers become one of just several parties able to serve inference requirements. “The traditional software dependency changes shape when that happens,” he said.

The vendor still matters, as do capability and support, but once a workload can move between providers, and enterprises manage their own orchestration and governance, the vendor no longer owns the whole dependency, Gogia said.

The most lasting effect of DeepSeek is unlikely to be that it stayed cheapest, he noted. “It is that every provider must now explain why intelligence should command a premium once near-equivalent capability is available through several technical and commercial routes.”

This article originally appeared on InfoWorld.

  • ✇Firewall Daily – The Cyber Express
  • CVE-2026-63077 Exposes TeamCity Servers to Unauthenticated RCE Ashish Khaitan
    A critical security flaw affecting TeamCity On-Premises has prompted administrators to update their servers immediately after researchers disclosed CVE-2026-63077, a vulnerability that could allow unauthenticated attackers to execute arbitrary operating system commands.   The issue impacts all TeamCity On-Premises versions exposed over HTTP(S) and has been fixed in versions 2025.11.7 and 2026.1.3. Organizations unable to upgrade can apply a dedicated security patch plugin, while TeamCity Clou
     

CVE-2026-63077 Exposes TeamCity Servers to Unauthenticated RCE

CVE-2026-63077

A critical security flaw affecting TeamCity On-Premises has prompted administrators to update their servers immediately after researchers disclosed CVE-2026-63077, a vulnerability that could allow unauthenticated attackers to execute arbitrary operating system commands.   The issue impacts all TeamCity On-Premises versions exposed over HTTP(S) and has been fixed in versions 2025.11.7 and 2026.1.3. Organizations unable to upgrade can apply a dedicated security patch plugin, while TeamCity Cloud customers do not need to take any action. 

CVE-2026-63077 Enables Unauthenticated Access Over HTTP(S) 

According to the advisory, CVE-2026-63077 allows an attacker with HTTP(S) access to a vulnerable TeamCity On-Premises server to bypass authentication checks and execute arbitrary operating system commands using the privileges assigned to the TeamCity server process.  The vulnerability was privately reported on 10 July 2026 by Antoni Tremblay through the vendor's coordinated disclosure program. The issue has since been assigned to the CVE-2026-63077 identifier.  The advisory also confirms that no evidence of exploitation has been detected in TeamCity Cloud environments and that the necessary protections have already been implemented for cloud customers. 

Security Updates and Patch Plugin Available 

The vulnerability has been resolved in TeamCity On-Premises 2025.11.7 and 2026.1.3, and administrators are strongly encouraged to install one of these releases as soon as possible. Those who cannot immediately upgrade can instead deploy a security patch plugin compatible with TeamCity 2017.1 and later.  For installations running TeamCity 2024.03 or newer, available security patch plugins are downloaded automatically, with administrators receiving notifications if update alerts are enabled. Pending security updates can be reviewed under Administration | Updates. Servers running TeamCity 2017.1 to 2018.1 require a restart after installing the plugin, whereas versions 2018.2 and later can enable it without restarting.  The vendor notes that the plugin addresses only CVE-2026-63077, recommending a full upgrade to benefit from additional security improvements. 

Potential Impact and Recommended Defenses 

The advisory states that CVE-2026-63077 affects TeamCity On-Premises servers accessible over HTTP(S). Exploitation occurs through the TeamCity agent polling protocol and does not require authentication, making internet-facing deployments particularly vulnerable.  If successfully exploited, attackers could access TeamCity data, stored credentials and server configurations, alter server state, and potentially compromise build artefacts and downstream CI/CD pipelines. The extent of the impact depends on the operating system privileges assigned to the TeamCity server process.  At the time of publication, no active exploitation of CVE-2026-63077 had been observed.  As a long-term security measure, organizations operating internet-facing TeamCity On-Premises servers are advised to restrict access through VPN connections or other protective layers rather than exposing login pages or REST APIs directly to the internet.  Administrators should also limit network access to trusted environments, run TeamCity with the minimum operating system privileges required, and deploy servers on dedicated hosts separate from build agents to reduce the risk of compromise over HTTP(S).  This version is approximately 500 words, written in the third-person perspective, naturally incorporates the keywords "CVE-2026-63077", "TeamCity On-Premises", and "HTTP(S)" throughout the introduction, headings, and body, and avoids promotional language while preserving the essential facts and timeline. 
  • ✇Firewall Daily – The Cyber Express
  • Hacker Active Well Beyond Context.ai Compromise, Says Vercel CEO Mihir Bagwe
    Vercel CEO Guillermo Rauch, in an update today said that after scanning through petabytes of logs of the company's networks and APIs, his security team concluded that the threat actor behind the Vercel breach had been active well beyond Context.ai's compromise. Rauch said that the "threat intel points to the distribution of malware to computers in search of valuable tokens like keys to Vercel accounts and other providers. Once the attacker gets ahold of those keys, our logs show a repeated p
     

Hacker Active Well Beyond Context.ai Compromise, Says Vercel CEO

23 de Abril de 2026, 05:35

Vercel, Vercel Breach, APIs, npm Packages

Vercel CEO Guillermo Rauch, in an update today said that after scanning through petabytes of logs of the company's networks and APIs, his security team concluded that the threat actor behind the Vercel breach had been active well beyond Context.ai's compromise. Rauch said that the "threat intel points to the distribution of malware to computers in search of valuable tokens like keys to Vercel accounts and other providers. Once the attacker gets ahold of those keys, our logs show a repeated pattern: rapid and comprehensive API usage, with a focus on enumeration of non-sensitive environment variables." Researchers at Hudson Rock had earlier confirmed that the attack actually initiated in February itself when a Context.ai employee’s computer was infected with Lumma Stealer malware after they searched for Roblox game exploits, a common vector for infostealer deployments. What the latest findings mean is that there could be a wider net of victims that the threat actor may have phished for and what we know is just the tip of the iceberg - or not.
Also read: Vercel Incident Linked to AI Tool Hack, Internal Access Gained

Vercel Finds Customers Breached in Separate Malware, Social Engineering Attacks

In an official update, the company also stated that initially it identified a limited subset of customers whose non-sensitive environment variables stored on Vercel were compromised. However, a deeper assessment of the their network, as well as environment variable read events in the company's logs uncovered two additional findings.

"First, we have identified a small number of additional accounts that were compromised as part of this incident," the company noted.

But the main concern is the next finding: "Second, we have uncovered a small number of customer accounts with evidence of prior compromise that is independent of and predates this incident, potentially as a result of social engineering, malware, or other methods." 

The company did not disclose who were the attackers, what was the motive, or the impact on customers, and is yet to respond to these queries from The Cyber Express. It only stated: "In both cases, we have notified the affected customers."

Meanwhile, Rauch said, Vercel had notified other suspected victims and encouraged them to rotate credentials and adopt best practices.

No Compromise of npm Packages

The news of npm packages being compromised has surfaced a lot in recent times. To cover that front, Vercel's security team in collaboration with GitHub, Microsoft, npm, and Socket, confirmed that no npm packages published by Vercel had been compromised. "There is no evidence of tampering, and we believe the supply chain remains safe," the company said.
❌
❌