CVE-2026-104286, rated CVSS 9.8, lets an unauthenticated attacker write arbitrary files on FortiMail's management interface through a path traversal combined with a NULL byte. No fix is out yet — disable IBE and take the admin console off the internet.
OpenAI says it neutralized a coordinated distillation campaign that extracted protected reasoning from its models, attributed to individuals associated with Moonshot AI. An August 2026 study shows the encrypted traces of Claude, Gemini, and GPT are interchangeable across sessions, enabling a scalable decryption jailbreak.
The Ubuntu 26.10 “Stonking Stingray” beta is out: it completes the migration of coreutils to Rust, ships Linux 7.3, GNOME 51, and dbus-broker in place of dbus-daemon. Test it now to gauge the impact on your fleet before the October 15 stable release.
Cloudflare folds logs, traces, alerts, and analytics into a single platform, and opens Traces in beta to follow a request end to end. Unified pricing lands on December 1, 2026, so audit your log volumes now.
Gitea drops the historical ‘1.’ prefix and ships 28.0.0, a major release that changes Git egress routing and fixes several authorization flaws. An upgrade to read before you deploy, not to apply blind.
Most platform teams have renamed their gates ‘guardrails’ without changing the mechanics, and developers route around them. The leverage is not in validation that blocks, but in mutation and generation that make the correct configuration automatic.
FatPipe MPVPN, WARP and IPVPN appliances on the end-of-life 10.1.2r60p100 firmware expose an OS command injection and a stack buffer overflow that both yield an unauthenticated root shell. Move to a supported release and lock down the management interface, which ships disabled by default.
AWS embeds DuckDB inside Aurora PostgreSQL to query operational data and the data lake in a single query, with no ETL pipeline. A turning point for teams that replicated the lake into Postgres.
CVE-2026-76504 lets an unauthenticated attacker bypass Catalyst SD-WAN Manager authentication through URI encoding and gain admin rights. There is no workaround: patch immediately and inspect j_security_check logs.
The GitHub Security Lab Taskflow Agent found 24 real Android vulnerabilities, from location tracking in OsmAnd to a full Wikipedia account takeover. AI can now find high-impact logic bugs, but still struggles to rank their severity.
The RMPOPT instruction, expected on Zen 6 “Venice” EPYCs, reduces the Reverse Map Table overhead that protects SEV-SNP VM memory integrity, and its Linux support lands in kernel 7.4. Confidential-computing operators on AMD can start planning their test benches.
Mandiant and Google Threat Intelligence attribute CVE-2026-88772 to a state-sponsored actor that has exploited the NetScaler DTLS flaw since early September across dozens of organizations. Updating is not enough: hunt for web shells and rotate stolen credentials.
