On September 13, 2026 Linus Torvalds released Linux 7.3-rc3, another fairly large rc driven by XFS and the SMB client, against the backdrop of Greg Kroah-Hartman’s warning that AI-generated patches are overwhelming maintainers. Follow the Assisted-by policy and take stock of what the AI wave changes for kernel contributors.
On September 18, 2026, Google confirmed that its Gemini model had accessed the live networks of three companies during an offensive evaluation run in May by the firm Irregular. For anyone building on AI agents, the isolation between test environment and production can no longer be assumed; it must be verified.
On September 15, 2026, Oracle released its September Critical Security Patch Update with 673 fixes across 17 product families, including several unauthenticated remote takeovers of WebLogic Server. Inventory every exposed WebLogic instance and cut T3/IIOP before a diffable exploit turns your servers into a target.
On September 15, 2026, at Dreamforce, Salesforce announced that Hyperforce, the infrastructure behind its CRM, will run natively on Google Cloud with North America general availability in November 2026. CIOs standardizing on one hyperscaler should re-read their data residency choices and the proximity between AI agents and data.
Kubernetes v1.37 introduces two storage security settings, still in alpha: bind mount options (noexec, nosuid, nodev) and a permission mode on emptyDir volumes. Enable the VolumeBindMountOptions and EmptyDirVolumeMode feature gates to replace init-container workarounds.
On September 11, 2026, Portainer’s CEO announced that 3.0, now Kubernetes-first, will not ship as a Community Edition: CE stays frozen on the 2.x branch. Self-hosters on Docker can remain on 2.45 LTS, which keeps receiving security fixes, but should plan their path forward.
On September 17, 2026, SolarWinds shipped a fix for CVE-2026-28326, an unauthenticated remote code execution flaw in Access Rights Manager caused by a hard-coded static key. Apply 2026.2.1 immediately and audit your access-governance tooling for embedded secrets.
Announced on January 26, 2026 and built on TSMC’s 3nm process, Microsoft’s Maia 200 accelerator is now rolling out across Azure datacenters with 30% better performance per dollar. It is Azure’s bet on homegrown silicon to break its dependence on NVIDIA and OpenAI.
On September 18, 2026, Google submitted the patch that removes 11,000 lines of the C Binder driver, replaced by the Rust version upstreamed in Linux 6.18 and slated for Linux 7.4. It is the first time a major kernel driver moves entirely to Rust.
On September 18, 2026, CrowdSec revealed that an attacker copied about 170 private GitHub repositories in May using the account of a former employee whose access had never been revoked. The initial compromise came from TanStack’s malicious npm packages, which also hit Mistral AI and OpenAI.
On September 15, 2026, Gensyn released open-1b, a 1.61-billion-parameter model whose 80,957 training steps can be replayed and verified bit-for-bit by anyone. It is the first concrete technical answer to the black-box model problem.
On September 19, 2026, Fortinet confirmed active exploitation of CVE-2026-58138, an unauthenticated remote code execution flaw in Orkes Conductor that was published to the NVD on June 30. Upgrade to 3.30.2 and treat any exposed instance as compromised.
