Attackers are deploying AI agents to automate reconnaissance, phishing, and exfiltration, compressing the breach-to-theft window to 72 minutes in the fastest observed cases. SOC teams that still rely solely on human-first triage are structurally unable to keep up.
Cognition released SWE-2 on September 10, a coding-agent model post-trained from Kimi K3, Moonshot AI’s open 2.8-trillion-parameter base. It approaches Fable 5.1 on coding benchmarks at a claimed 64% lower cost, but collapses on Terminal-Bench 4 — the signal that its gains do not generalize to the hardest test.
The self-hosted forge Forgejo shipped versions 16.0.4 and 15.0.8 on September 10 to fix a critical RCE born of template expansion, alongside three authorization flaws that share the same root cause. Everything on 16.0.3 or earlier must be patched, and fine-grained token inventories need a review.
Arista published four security advisories for Arista EOS on September 9, including an unauthenticated RCE rated CVSS 10.0 via P4Runtime (CVE-2026-73453) and two code-execution flaws in the gNPSI telemetry interface. No active exploitation is documented yet, but patching must come before the control plane is ever exposed.
GitLab shipped versions 19.3.2, 19.2.6 and 19.1.8 on September 10, 2026 to fix eighteen flaws, including an unauthenticated arbitrary file read through the commits API and an insecure deserialization scored CVSS 9.9. Every exposed self-managed instance must be updated without delay, and protected CI/CD variable secrets need a review.
Two optimizations merged into the Linux 7.3 merge window cut memory-management lock contention: the worst-case anon_vma lock hold time drops from 705 ms to 1.67 ms, and the zsmalloc path speeds up by as much as 1.83× on modest hardware. Teams running JVMs, databases or KSM under memory pressure get a direct latency win just from upgrading.
CISA updated its KEV entry on September 10, 2026 to confirm that CVE-2025-14733, an unauthenticated RCE in the WatchGuard Firebox iked process patched back in December 2025, is now used in ransomware attacks. With nearly 9,000 Fireboxes still exposed online, check your Fireware OS version and hunt for the indicators of compromise before the encryption starts.
AWS extends Amazon EBS Volume Clones to copy volumes across accounts, with optional re-encryption in the destination account. Multi-account teams can now refresh test environments with current production data, provided they work within the encryption and Availability Zone constraints.
Cohere releases North Small Translate 1.0, a 218-billion-parameter translation model whose weights are downloadable under CC BY-NC 4.0 but not usable in production without a commercial deal. The move confirms a shift: open weights no longer mean an open license.
Microsoft documents attacks in which ShinyHunters and Helix-linked gangs impersonate the help desk to steer employees toward passkey-themed phishing pages, then exfiltrate Microsoft 365 data. The defense rests less on the passkey itself than on phishing-resistant authentication and session revocation.
On September 9, 2026, Cisco confirmed that CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center, is being actively exploited, even though a patch has existed since March. Network teams must patch immediately, then hunt for indicators of compromise before declaring a device healthy.
On September 9, 2026, Kubernetes 1.37 reserved five well-known node conditions — DrainInProgress, Drained, MaintenancePlanned, MaintenanceInProgress, and GracefulNodeShutdownInProgress — giving teams a shared way to say why a node is unavailable. Start publishing them in your maintenance automation now, without waiting for core controllers to consume them.
On September 9, 2026, NVIDIA released the 615.71.09 Linux driver, enabling Reflex for native Vulkan games via Proton and adding cgroups-based memory partitioning to the open kernel module. Linux gamers and teams virtualizing GPUs gain two capabilities they had been missing compared to Windows.
On September 10, 2026, DeepSeek shipped V4.1 Flash, an open multimodal model that cuts KV cache memory fourfold and lowers API prices by 11 to 57 percent; V4 Pro requests will be routed to Flash starting September 14. Re-benchmark your workloads before that date.
On September 9, 2026, Google announced €13 billion across 2027-2028 in four Finnish sites — Hamina, Kajaani, Muhos, and Vaala — its largest European investment, backed by nuclear and wind energy contracts. It is a signal about how Europe’s sovereign cloud capacity is concentrating around the Nordics.
On September 2, 2026, Home Assistant 2026.9 modernizes Modbus so an industrial device can be picked from the UI without writing any YAML, and hardens the instance by passing through the real source IP of Cloud connections so IP banning actually works. Upgrade if you run Modbus gear or expose your instance.
On September 9, 2026, AWS made the Amazon Quick desktop app generally available on macOS and Windows and added a mobile activity feed that consolidates email, calendar, CRM, and messaging. For an organization already on AWS, it is a lever to bring generative AI back under governance: CloudTrail audit, HIPAA, FedRAMP, SOC 2 and ISO 27001 compliance, without moving data out of your environment.
Patched in January 2026, the CVE-2025-25249 heap overflow in the FortiOS cw_acd daemon has resurfaced exploited in the wild: CISA added it to the KEV catalog on September 9, 2026, after SOCRadar observed the PivotC2 RAT deployed on 178 devices. Network teams must upgrade exposed FortiOS trains before September 12, then strip out unnecessary fabric access.
On Scalr’s platform, OpenTofu now runs 63% of Terraform-compatible runs and powers 72% of newly created workspaces — not a snapshot of the global market, but of where new work is heading. Version 1.12 adds dynamic prevent_destroy and full provider checksums. For teams provisioning infrastructure, new projects should default to OpenTofu.
