On September 17, 2026, SolarWinds shipped a fix for CVE-2026-28326, an unauthenticated remote code execution flaw in Access Rights Manager caused by a hard-coded static key. Apply 2026.2.1 immediately and audit your access-governance tooling for embedded secrets.
Announced on January 26, 2026 and built on TSMC’s 3nm process, Microsoft’s Maia 200 accelerator is now rolling out across Azure datacenters with 30% better performance per dollar. It is Azure’s bet on homegrown silicon to break its dependence on NVIDIA and OpenAI.
On September 18, 2026, Google submitted the patch that removes 11,000 lines of the C Binder driver, replaced by the Rust version upstreamed in Linux 6.18 and slated for Linux 7.4. It is the first time a major kernel driver moves entirely to Rust.
On September 18, 2026, CrowdSec revealed that an attacker copied about 170 private GitHub repositories in May using the account of a former employee whose access had never been revoked. The initial compromise came from TanStack’s malicious npm packages, which also hit Mistral AI and OpenAI.
On September 15, 2026, Gensyn released open-1b, a 1.61-billion-parameter model whose 80,957 training steps can be replayed and verified bit-for-bit by anyone. It is the first concrete technical answer to the black-box model problem.
On September 19, 2026, Fortinet confirmed active exploitation of CVE-2026-58138, an unauthenticated remote code execution flaw in Orkes Conductor that was published to the NVD on June 30. Upgrade to 3.30.2 and treat any exposed instance as compromised.
On September 18, 2026, RustFS shipped its 1.0.0 GA release, with 32,000 GitHub stars and 2.7 million instances deployed since its first commit in February 2024. It is the Rust, Apache 2.0 S3 object storage establishing itself as MinIO’s successor for self-hosted deployments.
On September 15, 2026 AWS acknowledged it cannot restore access to data hosted in availability zones hit in Bahrain and the United Arab Emirates. Replicate across regions and reread what your durability commitments actually guarantee.
On September 12, 2026 the virtual IXP BGP.Exchange was defaced and its authenticated email was abused to harass members, while the operator insists no route server was touched. Check your peering sessions, rotate credentials, and take stock of what the incident says about the gap between the management plane and the data plane.
On September 16, 2026 Google confirmed exploitation of CVE-2026-58704, a privilege escalation in the Pixel cellular modem, in limited targeted attacks. Apply the September 2026 patch and make the Android patch level a compliance gate for your mobile fleet.
Argo CD 3.6.0-rc1, released September 16, 2026, adds metrics and conditions to ApplicationSet progressive sync and expands the health-check library — CloudNativePG, cert-manager, Prometheus Operator, Kyverno. Teams that roll out changes in waves across clusters should plan the upgrade once the stable release lands.
On September 17, 2026, Check Point shipped an emergency fix for CVE-2026-91843, a CVSS 9.8 stack overflow in the login process of its management and log servers that lets an unauthenticated attacker run code as root. Apply the Live Patch to every instance, confirm it with cplp list, and tighten Trusted Clients before someone takes over your firewall’s management plane.
