On October 7, 2026, Immich shipped version 3.3, which introduces an opt-in revision of its machine learning models: MACHINE_LEARNING_MODEL_REVISION=v2 makes inference significantly faster and less memory-hungry across every backend, including CPU. If your photo NAS is running tight, this is the variable to add — but understand what it changes first.
On October 14, 2026, Juniper published JSA112187, its largest bulletin of the year, fixing more than 60 vulnerabilities in Junos OS and Junos OS Evolved, including two flaws that let an unauthenticated BGP peer gain root when BGP Monitoring Protocol is enabled. Check whether BMP is turned on at your network edge and pull J-Web out of public exposure.
On October 15, 2026, Ubuntu 26.10 "Stonking Stingray" reached general availability with a 7.3 kernel built from rc6, days before the final Linux 7.3 release expected on October 18. It is the first release where the entire coreutils set, including cp, mv and rm, runs on the Rust implementations from the uutils project.
On October 16, 2026, BeyondTrust fixed CVE-2026-102764, an authentication bypass in Remote Support that the China-linked actor Armory Castle has exploited as a zero-day since late August. If you self-host RS or PRA and the appliance was reachable from the internet, treat it as compromised, not merely as something to patch.
On October 13, 2026, Google opened Gemini 4 Argon to everyone through the API, AI Studio and Vertex AI, with outputs up to a million tokens and an introductory price of $2 / $10 per million tokens. If you are evaluating enterprise agents, test its prompt-injection resistance — a 0.7% attack success rate — before the price doubles on November 30.
On October 8, 2026, AWS extended GuardDuty RDS Protection beyond login anomalies to detect data exfiltration and destruction in Aurora PostgreSQL and RDS for PostgreSQL, using agentless behavioral baselines. Turn on the 30-day free trial if you run PostgreSQL — but know that MySQL remains outside the scope.
On 15 October 2026, Check Point confirms that CVE-2026-85102, a pre-authentication remote code execution flaw in its Security Gateway VPN fixed on 9 September, is now being exploited at scale against Spark firewalls, and ships a fix for a zero-day in its management server. Apply both hotfixes, starting with your management servers, which are watched less closely than the gateways.
On 12 October 2026, GitLab shipped 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler that allows unauthenticated remote code execution. If you self-host GitLab, upgrade now and treat your .gitlab-ci.yml files as code, not configuration.
On 15 October 2026, Meta released the weights of Muse Spark Open, a multimodal model with 816 billion total parameters (42 billion active) and a one-million-token context, optimised to run on two Mac Studios with M5 Ultra chips. Before adopting it in production, read the license — open-weight stops at $20 million in service revenue.
On October 13, 2026, Anthropic published an engineering post explaining how it replaced Git with an in-house version control system called Scion, after daily merges grew from 2,500 in May to over 30,000 in September. For most teams, Git remains the right choice; the signal to take away is that agent-written code shifts the bottleneck from humans to infrastructure.
On October 12, 2026, Linus Torvalds released the seventh and likely final release candidate of Linux 7.3, with the stable release expected October 18. This RC cycle surfaced a bug that had been silently dropping writes since Linux 6.6; if you are on an LTS kernel, stay there — 7.3 is not a long-term kernel.
On October 14, 2026, Palo Alto Networks patched CVE-2026-0322, a code-injection flaw in the PAN-OS management interface that hands root to an authenticated attacker, and confirmed exploitation has already been observed. Patch before October 17 and verify that your management interface is not exposed to the internet.
