On September 15, 2026, Plex shipped two Plex Pass audio options: Boost Dialog, which lifts the frequencies where voices live, and Normalize Loudness, which evens out volume swings. The loudness analysis that powers them runs on your CPU during maintenance, so measure the cost before you turn it on for a large library.
ThreatDown researchers reconstructed the Carbonato botnet, which compromises Docker daemons exposed on port 2375 and installs the open-source Hermes Agent framework with nothing but its persona file rewritten. Close port 2375, move to rootless or TLS, and revoke any AI API key sitting on a potentially affected host.
Microsoft documented the Azure intrusion of the JADEPUFFER actor (Storm-3168), which used two compromised service principals to map a tenant and then delete more than one hundred storage accounts in seven minutes. Protect workload identities, enforce least privilege, and enable independent locks and deletion protection.
On September 28, 2026, OpenAI dropped GPT-6.1 Astra, its next agentic model, after internal testing showed gaps in “scope, authorization and communication.” Don’t plan any deployment on this model: it won’t ship, and the release bar has shifted from capability to controllability.
Git 2.56 adds git add --resolved, which refuses to stage a file that still carries conflict markers, and optimizes merge-base computation by up to 70× on monorepos. Update your tooling and evaluate path-walk repacking if you host large repositories.
The Linux 7.4 kernel is preparing to enable large folios for FUSE, grouping multiple contiguous physical pages into a single folio to cut the overhead of user-space filesystems. The gains show up on cold reads, as long as the machine is not under memory pressure.
A flaw in the official Python SDK of the MCP protocol lets a malicious server redirect the client secret, the authorization code, and the PKCE proof key to a token endpoint it controls. Upgrade to 1.30.0 or 2.2.0, set the issuer parameter, and rotate your OAuth secrets.
The first release candidate of Immich 3.3 introduces people management, birthday memories, and TensorRT inference on NVIDIA RTX GPUs. If you self-host your photos, plan the migration and test the RC on a copy before the stable release lands.
NVIDIA ships an open foundation model for tabular data that classifies and regresses in a single forward pass, with no training and no feature engineering, and ranks first on four benchmarks. Evaluate it on your own held-out data before replacing XGBoost or LightGBM.
A new Spectre v2 variant called Branch Target Reuse abuses JIT engines to leak memory from a fully patched Intel system. Apply the CVE-2026-64507 and CVE-2026-64508 kernel fixes and revisit your assumptions about isolating untrusted code from the host.
On 26 September 2026, GNOME developer Jordan Petridis introduced Toolpak, a Flatpak-inspired format for shipping strace, ripgrep, and qemu on image-based systems without breaking them. For anyone working on Silverblue or GNOME OS, it fills the gap immutable distributions never closed.
On 28 September 2026, Cameron John Wagenius, aka kiberphant0m, was sentenced to 70 months in prison for hacking and extorting at least ten technology and telecommunications companies from his military base. The case is a reminder that insider threat and SSH brute-forcing remain an entry path as effective as any zero-day.
