On September 10, AWS open-sourced Pizza Bot, an app that replaces chat with an email-style inbox for tracking AI agents working in the background. For any team running autonomous agents in the cloud, the thesis fits in one sentence: the interface must assume no one is watching.
On September 8, Jellyfin released version 12.0, which drops the “10.” prefix and concentrates most of its work on the performance inherited from the 10.11 rewrite. The migration changes the database with no way back: backup, plugin removal, and a full library scan are mandatory before you reap the gains.
On September 10, OpenAI brought GPT-Live-1 to its API: a full-duplex voice model that holds the conversation and hands heavy questions to a reasoning backend. For teams building voice agents, the win is measurable — 80% less code for one customer — but it is paid for in platform dependency.
On September 12, 2026, Debian shipped 13.7, the seventh trixie point release, bundling 107 security updates and fixes across 106 packages. If you follow security.debian.org you already have most of it — the real value sits in the fresh install images and QEMU’s Secure Boot bypass fix.
On September 11, 2026, GitLab shipped an out-of-band release for CVE-2026-85706, a CVSS 10 path traversal that reads server files with no authentication via the commits API. The flaw is already being probed in the wild — patch self-managed instances before an attacker reads secrets.yml.
On September 10, 2026, CISA added two MikroTik RouterOS flaws — a missing authentication check and a command injection — to its KEV catalog after active exploitation. The chain yields remote code execution with no credentials, and the federal remediation deadline lands on September 13.
The public resolver 1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, the NIST-standardized post-quantum algorithm whose every signature weighs 2,420 bytes. It is the first Internet-scale test of carrying oversized DNS responses and blocking downgrade to weakened algorithms.
The self-hosted photo library Immich released 3.2.0 on September 10 with a new Search API v2, a revamped search UI, and cluster groups that share facial recognition across trusted users. The feature forces a facial-recognition reset, worth weighing before migrating.
Mold 2.42.1, published on September 11, 2026, is the last C++ release: version 3.0 will be rewritten in Rust with the stated goal of becoming /usr/bin/ld on most distributions. For heavy builders, that means links in a few hundred milliseconds instead of seconds or minutes.
Lambda engineers detail how they replaced an iptables-based packet counter, unable to scale to IPv6, with an eBPF and Rust pipeline that logs every flow across thousands of Firecracker microVMs per host. The lesson outlives AWS: at multi-tenant density, network bookkeeping must be nearly free and provably correct.
On September 9, 2026, Check Point fixed two CVSS 9.8 flaws in how its firewalls and management console validate and decode VPN certificates, both exploitable without authentication for remote code execution. The Dutch NCSC says exploitation is imminent: apply the Live Patch or the Jumbo Hotfix now.
OpenAI opened an Agents API in public beta on September 10, 2026, selling Codex’s backend as a service to run agents unattended for days. The same day, the company paused sign-ups for its Pro plan under GPT-6 Astra demand: the bottleneck is shifting from models to infrastructure.
