FatPipe MPVPN, WARP and IPVPN appliances on the end-of-life 10.1.2r60p100 firmware expose an OS command injection and a stack buffer overflow that both yield an unauthenticated root shell. Move to a supported release and lock down the management interface, which ships disabled by default.

AWS embeds DuckDB inside Aurora PostgreSQL to query operational data and the data lake in a single query, with no ETL pipeline. A turning point for teams that replicated the lake into Postgres.

CVE-2026-76504 lets an unauthenticated attacker bypass Catalyst SD-WAN Manager authentication through URI encoding and gain admin rights. There is no workaround: patch immediately and inspect j_security_check logs.

The GitHub Security Lab Taskflow Agent found 24 real Android vulnerabilities, from location tracking in OsmAnd to a full Wikipedia account takeover. AI can now find high-impact logic bugs, but still struggles to rank their severity.

The RMPOPT instruction, expected on Zen 6 “Venice” EPYCs, reduces the Reverse Map Table overhead that protects SEV-SNP VM memory integrity, and its Linux support lands in kernel 7.4. Confidential-computing operators on AMD can start planning their test benches.

Mandiant and Google Threat Intelligence attribute CVE-2026-88772 to a state-sponsored actor that has exploited the NetScaler DTLS flaw since early September across dozens of organizations. Updating is not enough: hunt for web shells and rotate stolen credentials.

The 29.8.2 release closes 14 daemon and BuildKit vulnerabilities, including CVE-2026-92543, which lets a malicious DNS response skip TLS verification or fall back to HTTP during an image pull. Update before your next CI/CD build and pin digests to block image substitution.

AWS launches a preview AI agent that analyzes an environment against 65+ services and produces dollar-quantified recommendations, with Terraform or CloudFormation fixes ready to apply. Read it like a junior architect, not an oracle.

Ai2 ships Olmo-core 3, an open mixture-of-experts training stack that holds a 1.2-trillion-parameter model across 512 GPUs. The FSDP-to-DDP switch and MXFP8 precision change the compute economics for labs that do not have Megatron-Core.

The 2.11.6 release caps request headers at 16 KiB, cuts Slowloris connections, and drops dot-header fields, at the cost of breaking changes. Read them before upgrading a production Caddy server.

An out-of-bounds write in CoreGraphics allows code execution when a crafted file is opened, and CISA added it to the KEV catalog after confirmed exploitation. Roll out iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1 or macOS Tahoe 26.7.1 immediately, starting with the devices of exposed people.

The v1.38.0-alpha.1 pre-release adds beta support for ML-DSA signing of pod certificates and CSRs, preparing the control plane for the post-quantum era. Enable the CertificateSigningRequestMLDSA feature gate on a test cluster and map your gRPC dependencies before upgrading.