On September 3, 2026, Broadcom updated VMware Cloud Foundation to 9.1.1 with multi-tenant model sharing in general availability, a gateway to more than 150 models, and a 2.6x jump in Kubernetes scale. For inference on regulated data, compare the total cost of a consolidated on-premises GPU estate against a hyperscaler’s per-token price before you commit.
Starting August 28, 2026, a BGP hijack diverted Softaculous traffic to an attacker-controlled server for 33 hours, which served a malicious Virtualizor update to several hypervisors. Check for the java-jre-update.service unit, demand cryptographically signed update packages, and turn on RPKI filtering with your upstream.
On September 17, 2026, Lasso Security showed that SynthID-Text watermarking, required by the EU AI Act for provenance, changes how AI agents call tools and hold safety refusals, especially under prompt injection. Treat provenance compliance as a model-behavior change: re-evaluate and red-team with watermarked content.
Version 2026.8.1 of Bitwarden’s self-host repository adds long-requested support for running the unified container fully rootless and with a read-only root filesystem, and 2026.8.2 follows up with cap_drop: ALL. If you self-host the password manager, upgrade now and re-check your Docker Compose before a container escape turns a missed patch into a vault theft.
With Kubernetes 1.37, the Pod-Level Resource Managers feature graduates to beta (disabled by default): the Topology Manager, CPU Manager, and Memory Manager now read .spec.resources declarations directly. Latency-critical workloads can reserve exclusive NUMA cores for the primary container while sidecars share an isolated pod-level pool.
On September 8, 2026, ConnectWise shipped a fix for CVE-2026-84869, a missing authorization (CVSS 9.9) that lets an attacker push and run files on a machine during an active ScreenConnect session without host confirmation. Upgrade the client to version 26.6.5, then audit past sessions and file transfers before remote access becomes the entry point into your fleet.
Red Hat has published a bulletin for CVE-2026-53362, an out-of-bounds write in the Linux kernel’s IPv6 fragmentation path that lets a local user escape a container and bypass SELinux. Apply the patched kernel, or disable unprivileged user namespaces in the meantime.
Jellyfin ships 12.0, a major release that drops the ‘10’ prefix and rewrites playlist and collection storage to speed up large libraries. Back up first, then upgrade from 10.11.x and run a full library scan.
Kubernetes 1.37 enables Prometheus native histograms by default, replacing static buckets with dynamic exponential buckets. Components stay backward-compatible via dual exposition: enable scrape_native_histograms, then migrate your histogram_quantile queries.
The Pub/Sub AI Inference SMT reaches general availability: it applies a Gemini Enterprise Agent Platform model to every message in flight. For real-time enrichment you no longer need a separate inference service.
IBM and NASA open-source the NASA-IBM Lunar Foundation Model, a foundation model trained on decades of multi-instrument lunar data, paired with a unified 30-layer dataset. It cuts ice-deposit identification error by up to 22% and joins the Prithvi family.
A Chinese-speaking actor tracked as Red Heron exploited CVE-2026-60004, the Gitea RCE, to scan 1,386 instances across seven countries and steal industrial source code. Patch self-hosted forges, lock down registration, and treat any exposed instance as already breached.
