On September 9, 2026, Alby disclosed that its self-hosted Lightning wallet Alby Hub shipped, up to v1.18.5, a critical flaw that let an attacker take over an internet-exposed node and move its funds. If you self-host a Lightning node, check your version and close the public exposure before you patch.
On September 9, 2026, IBM released Granite Time Series PatchTST-FM-r2, a 385M-parameter model that becomes the best zero-shot forecaster shipped under a permissive license on the GIFT-Eval benchmark, ahead of several larger models. For any team doing demand, load or telemetry forecasting, it is a production-ready zero-shot starting point.
On September 9, 2026, SAP shipped fixes for four critical flaws, including CVE-2026-44756 (CVSS 10.0), a memory-corruption bug in Extended Passport processing that yields unauthenticated remote code execution across three protocols at once. Basis teams should patch the SAP kernel first, ahead of any network segmentation effort.
Docker Engine 29.8.0, released September 3, 2026, introduces a --umask flag to set a container’s file-creation mask and adds AppArmor/SELinux rules that block the 32-bit socketcall(2) path to AF_VSOCK. Upgrade if you share volumes between host and containers or harden your containers.
On September 2, 2026, Dropbox disclosed that an attacker accessed roughly 5,000 accounts by abusing a flaw in Lenovo’s email-verification process to register fraudulent Lenovo IDs — never needing the victim’s Dropbox password. Audit every identity-federation link you accept and require re-authentication on SSO sign-ins.
OpenBMB shipped MiniCPM5-2B, a dense 2.5-billion-parameter model under Apache-2.0 with a 131,072-token context, posting a 53.9 average that beats every open 4B model it was tested against — and releasing the UltraData training sets behind it. If you run local or on-device AI, this changes the cost-capability tradeoff.
Asahi Linux merged Apple M3 support into its installer on September 6, 2026: the webcam, microphones, USB 3, hardware video decoding with AV1, Wi-Fi, and Bluetooth work, but the GPU, sleep, and HDMI remain missing. Install in expert mode and wait for the GPU before making it a daily driver.
Aurora MySQL 8.4.8, available in early September 2026, adds delayed replication: a replica deliberately applies each change with a configurable lag, making it the only copy that does not reproduce an accidental DROP TABLE or DELETE. Configure it by stored procedure and write the recovery runbook before you need it.
File Browser, the self-hosted web file manager with 36,000 GitHub stars, shipped its last release v2.63.23 on July 27, 2026 and archived its repository on September 1, 2026: no more security fixes will follow. Audit your exposed instances and migrate to a maintained alternative.
On August 31, 2026, AWS Interconnect multicloud opened to Azure in public preview: a VPC and a VNet linked over AWS’s private backbone, no third-party carrier, but capped at 1 Gbps with no availability commitment. Test it for shared AWS-Azure workloads, but keep your existing circuits until general availability.
The September 8, 2026 Patch Tuesday breaks a record with 964 CVEs, including two zero-days already exploited in the wild, CVE-2026-81963 and CVE-2026-85880. Triage the bulletin by exploitability — zero-days first, then internet-facing RCEs — rather than by raw score.
The September 8, 2026 Patch Tuesday fixes nine remote code execution flaws in Windows DNS Server, including CVE-2026-69730, a CVSS 9.8 use-after-free triggerable with a single forged packet. Patch the servers running the DNS role first and segment port 53 before a public exploit appears.
