Check Point unpacks JSCeal, a compiled V8 JavaScript malware that replays stolen session cookies to open access to Google accounts without a password or second factor. Lock down sessions with security keys and device-bound credentials, and watch for cookie exfiltration.
Kubernetes v1.37 enables KubeletInUserNamespace by default: the kubelet, runtimes, and CNI plugins can now run as a non-root user inside a user namespace. Turn it on to confine container-breakout flaws away from host root.
The rc2 of Linux 7.3 fixes cache-aware scheduling misfits on hybrid CPUs and keeps migrating kernel allocations to kmalloc_obj. Test this rc2 if you run Intel Core hybrid or big.LITTLE machines.
The public preview of Amazon Linux 2027 arrived on September 3 with a 7.1 kernel, SELinux enforcing by default, and AWS Neuron driver support. Test it now if you are planning an AL2023 migration.
Hcompany ships NeoMME, a 260M–800M multilingual multimodal encoder that processes text and images in one Transformer with no separate vision tower. For visual document retrieval, its Retriever variant reaches the ViDoRe v3 Pareto frontier with a 255× smaller index.
SourceHut changes its terms of service to prohibit LLM-assisted code, becoming the second major forge to follow Codeberg’s lead. If your project relies on generative AI tooling, prepare a migration to Forgejo or a self-hosted instance.
N-able publishes an emergency hotfix for CVE-2026-86218, a pre-authentication remote code execution flaw (CVSS 10.0) in its N-central RMM platform, which Huntress researchers say they have seen actively exploited. Update self-hosted instances to 2026.3 HF4 and segment your RMM from the rest of the network.
NEC fixes CVE-2026-16876, a critical missing-authentication flaw (CVSS 9.4) in the WebGUI of UNIVERGE IX-R and IX-V enterprise routers: a forged message bypasses login and runs arbitrary CLI commands. Apply the firmware update, or disable the WebGUI if it is reachable from the internet.
CVE-2026-48710, nicknamed BadHost, lets an unauthenticated attacker turn a blocked request into an allowed one by adding a character to the Host header, in every Starlette release before 1.0.1. Upgrade Starlette and audit every middleware that reads request.url.path instead of the raw ASGI path.
In early September 2026, developer Yureka Lilian posted the first Device Tree patches for the Apple A18 Pro SoC in the MacBook Neo, with support still limited to a single CPU core. It is the first concrete step toward Linux support on Apple’s entry-level laptop, but daily use is months away.
On August 31, 2026, between 07:35 and 21:45 UTC, an attacker compromised a Coder Cloudflare API key and redirected part of the module registry’s traffic to a malicious server that exfiltrated cloud credentials. Check your logs for coder-infra[.]com and rotate the affected secrets.
Broadcom patched two flaws in VMware Workstation and Fusion: CVE-2026-59346 (CVSS 9.3) and CVE-2026-59347 both let a virtual machine administrator execute code on the host machine. Update to 26H1u1 now — no workaround exists.
