On September 1, 2026, SonicWall disclosed two flaws in the SMA 1000 line — a pre-authentication SSRF (CVE-2026-83548, CVSS 10) and an OS command injection (CVE-2026-83549) — already chained in the wild to reach remote code execution without credentials. Apply the hotfix now, and if compromise is confirmed, re-image the appliance instead of patching over the intrusion.
Announced on August 26, 2026 and confirmed in the August 31 AWS weekly roundup, the acquisition of DuckLabs by AWS brings the DuckDB maker in as a subsidiary, without touching the MIT license or the DuckDB Foundation governance. For data teams, DuckDB remains a safe bet; the open question is whether the server-side roadmap tilts toward AWS.
On August 31, 2026, Sygnia documented how the Chinese espionage group Fire Ant, which heavily overlaps UNC3886, pivoted from VMware hypervisors to Cisco IOS XR routers to intercept the traffic passing through them. An active GRE tunnel missing from the running config is enough to turn a transit router into a collection platform — and it means defenders must audit routers as vantage points, not as mere hops.
On August 31, 2026, the storagemigration.k8s.io/v1 API and its controller reached general availability in Kubernetes 1.37. Platform teams can now deprecate old CRD versions and rotate at-rest encryption keys with a single declarative object, instead of hand-maintained kubectl get/replace scripts.
On September 1, 2026, Cloudflare detailed Cache Transcoding, a prototype that compresses eligible assets with Zstandard directly inside Pingora. Encoding shrinks on-disk size to roughly a third, for a few points of CPU, and cuts bandwidth between data centers.
On August 25, 2026, Multiverse Computing published Quantization-Aware Healing, a recipe that, applied to a GPT-OSS 120B compressed to 60B and quantized to MXFP4, beats its bfloat16 version on 7 of 9 benchmarks. The method distills from the original model, not from the compressed checkpoint.
On September 1, 2026, systemd 262-rc1 shipped with a LUOSession= option that connects services to the Live Update Orchestrator. The release also adds a statically linked PID 1 for minimal containers and kexec counting surfaced through systemd-analyze time.
On August 27, 2026, Backblaze announced that SSE-B2 will automatically encrypt every new object with AES-256 starting September 14, at no extra cost and with no API changes. For self-hosters who back up to B2, encryption at rest stops being a checkbox you have to remember.
On September 1, 2026, Kaspersky detailed two cross-platform RATs, NodeRabbit and PollCat, delivered to developers as rigged recruitment challenges. The job-interview coding test is now an attack surface, and the trap sits in the node_modules that ships with the challenge.
On August 31, 2026, uutils released Rust Coreutils 0.11, whose GNU test-suite compatibility passed 95% and which adopts compiler-style diagnostics for chmod, cut, sort, and tr. The Rust rewrite of the core utilities has left the experimental stage.
On August 25, 2026, AWS opened full IAM resource-based policies to Lambda functions: a single JSON document, the complete range of condition keys, and explicit Deny statements. Platform teams gain precision, but PutResourcePolicy overwrites the whole policy in one call — adopt it with a read-modify-write and an audit of existing triggers first.
On August 30, 2026, Linus Torvalds released the first 7.3 candidate, with roughly a third of the diff coming from AMD GPU register definitions alone. Linux gamers and AMD users can test Zen 6 enablement early; Nvidia owners on the open-source driver should sit the release candidates out.
