On September 18, 2026, a joint advisory from the FBI, Japan’s police, and several agencies revealed that WaterPlum, a North Korean group, infected more than 30,000 devices across 100-plus countries and siphoned $10.7 million in cryptocurrency through fake job interviews and poisoned repositories. Verify contractor identities and limit their access to source code and credentials.
Gzip 1.15, released September 20, 2026, ships 119 commits of fixes including a buffer overflow and uninitialized memory access present since the early 1990s. Update gzip and treat archive decompression as untrusted input.
SentinelOne ties North Korea’s Jade Sleet to the compromise of an Indian IT services firm, reached through fake job interviews and poisoned Terraform modules. Treat developer endpoints as high-value targets and audit your Terraform dependency locks.
Researchers found two ways out of OpenAI’s Codex sandbox, one capable of running commands on a developer’s machine from the most locked-down mode, with no prompt and nothing on screen. Update Codex and never run a coding agent with access to the Docker socket or your home directory.
Amazon EC2 T8i instances, powered by custom sixth-generation Intel Xeon Scalable (Granite Rapids) processors and the Nitro System, became generally available on September 17, 2026 with up to 30% better price performance than T3. Low-CPU workloads should move from T3 to T8i without changing their credit model.
Changed Block Tracking for Kubernetes CSI drivers, in alpha since September 2025, moved to beta with the external-snapshot-metadata v1.0.0 release and removed the v1alpha1 API with no automatic conversion. Backup vendors and CSI driver maintainers must re-apply the CRD and migrate their manifests to v1beta1.
Navidrome 0.64, released September 12, 2026, adds an experimental Jellyfin Music API that lets clients like Finamp and Jellify connect, and re-encodes all internal IDs to a canonical 128-bit format. Back up the database before upgrading and re-sync clients that cache IDs.
On September 21, 2026 AWS released Strands Harness, an open-source AI agent that bundles tools, context, and memory, and claims a 45% cost saving over Claude Code and Codex. Teams that pay for tokens by volume can evaluate it without depending on AWS infrastructure.
On September 17, 2026 LastPass and Delphos Labs revealed that a fake LastPass Authenticator installer deployed Alinubx.sys, a Microsoft-signed kernel driver that terminates 145 security processes before a password stealer runs. Add the driver’s hash to your blocklists and treat every password on an affected machine as compromised.
On September 21, 2026 Nebula Matrix’s NBL driver was merged into net-next, clearing the way for mainline support of the 100 Gbps S1000 SmartNIC in Linux 7.4. Operators running these cards in cloud and HPC fleets should plan the move from the out-of-tree driver to the kernel.
On September 16, 2026 the ISC shipped BIND 9.20.29 and 9.21.26 to fix 14 vulnerabilities, including CVE-2026-77692, which crashes named with a single malformed DNS-over-HTTPS request. Inventory every resolver, patch, and make resolution redundant before one packet takes your platform down.
On September 10, 2026 two CNCF ambassadors published three reproducible failure scenarios that separate having backups from being able to actually recover. Test full restore into a cluster that has never run the workload, validate data against an expected result, and time the whole thing.
