Mold 2.42.1, published on September 11, 2026, is the last C++ release: version 3.0 will be rewritten in Rust with the stated goal of becoming /usr/bin/ld on most distributions. For heavy builders, that means links in a few hundred milliseconds instead of seconds or minutes.
Lambda engineers detail how they replaced an iptables-based packet counter, unable to scale to IPv6, with an eBPF and Rust pipeline that logs every flow across thousands of Firecracker microVMs per host. The lesson outlives AWS: at multi-tenant density, network bookkeeping must be nearly free and provably correct.
On September 9, 2026, Check Point fixed two CVSS 9.8 flaws in how its firewalls and management console validate and decode VPN certificates, both exploitable without authentication for remote code execution. The Dutch NCSC says exploitation is imminent: apply the Live Patch or the Jumbo Hotfix now.
OpenAI opened an Agents API in public beta on September 10, 2026, selling Codex’s backend as a service to run agents unattended for days. The same day, the company paused sign-ups for its Pro plan under GPT-6 Astra demand: the bottleneck is shifting from models to infrastructure.
On September 11, 2026, Anthropic published an abuse report covering December 2025 through August 2026, attributing to Midnight Blizzard the use of Claude to reverse-engineer a drone maker’s vision SDK and evade detections. The published indicators of compromise belong in your threat feed, and the report raises the bar for AI lab transparency.
On September 11, 2026, Kubernetes 1.37 graduated Prometheus native histogram support to beta, enabled by default. Latency metrics now expose dynamic exponential buckets that can reduce time-series count by up to 90%, provided you follow the four-step migration.
On September 10, 2026, PaperCut published NG/MF versions 26.0.5, 25.0.13, and 24.1.10, replacing three emergency patches and closing two actively exploited flaws, CVE-2026-81578 and CVE-2026-82078. If you are still running an emergency patch, move to the maintenance release now.
Cognition released SWE-2 on September 10, a coding-agent model post-trained from Kimi K3, Moonshot AI’s open 2.8-trillion-parameter base. It approaches Fable 5.1 on coding benchmarks at a claimed 64% lower cost, but collapses on Terminal-Bench 4 — the signal that its gains do not generalize to the hardest test.
The self-hosted forge Forgejo shipped versions 16.0.4 and 15.0.8 on September 10 to fix a critical RCE born of template expansion, alongside three authorization flaws that share the same root cause. Everything on 16.0.3 or earlier must be patched, and fine-grained token inventories need a review.
Arista published four security advisories for Arista EOS on September 9, including an unauthenticated RCE rated CVSS 10.0 via P4Runtime (CVE-2026-73453) and two code-execution flaws in the gNPSI telemetry interface. No active exploitation is documented yet, but patching must come before the control plane is ever exposed.
GitLab shipped versions 19.3.2, 19.2.6 and 19.1.8 on September 10, 2026 to fix eighteen flaws, including an unauthenticated arbitrary file read through the commits API and an insecure deserialization scored CVSS 9.9. Every exposed self-managed instance must be updated without delay, and protected CI/CD variable secrets need a review.
Two optimizations merged into the Linux 7.3 merge window cut memory-management lock contention: the worst-case anon_vma lock hold time drops from 705 ms to 1.67 ms, and the zsmalloc path speeds up by as much as 1.83× on modest hardware. Teams running JVMs, databases or KSM under memory pressure get a direct latency win just from upgrading.
