Attackers are deploying AI agents to automate reconnaissance, phishing, and exfiltration, compressing the breach-to-theft window to 72 minutes in the fastest observed cases. SOC teams that still rely solely on human-first triage are structurally unable to keep up.
ThreatDown researchers reconstructed the Carbonato botnet, which compromises Docker daemons exposed on port 2375 and installs the open-source Hermes Agent framework with nothing but its persona file rewritten. Close port 2375, move to rootless or TLS, and revoke any AI API key sitting on a potentially affected host.
Microsoft documented the Azure intrusion of the JADEPUFFER actor (Storm-3168), which used two compromised service principals to map a tenant and then delete more than one hundred storage accounts in seven minutes. Protect workload identities, enforce least privilege, and enable independent locks and deletion protection.
On September 28, 2026, OpenAI dropped GPT-6.1 Astra, its next agentic model, after internal testing showed gaps in “scope, authorization and communication.” Don’t plan any deployment on this model: it won’t ship, and the release bar has shifted from capability to controllability.
On 26 September 2026, GNOME developer Jordan Petridis introduced Toolpak, a Flatpak-inspired format for shipping strace, ripgrep, and qemu on image-based systems without breaking them. For anyone working on Silverblue or GNOME OS, it fills the gap immutable distributions never closed.
On 28 September 2026, Cameron John Wagenius, aka kiberphant0m, was sentenced to 70 months in prison for hacking and extorting at least ten technology and telecommunications companies from his military base. The case is a reminder that insider threat and SSH brute-forcing remain an entry path as effective as any zero-day.
On 27 September 2026, references to an always-on assistant called “o” briefly surfaced on OpenAI’s site, alongside a “-o” email suffix and a spot in the $100 Pro plan. Ahead of DevDay on 29 September, work out what an agent that reads and writes your mail does to your attack surface.
On September 15, 2026, AWS and Salesforce expanded their partnership to push CRM data and AI agents into the tools teams already use every day: Amazon Quick, Slack, and voice. Access is zero-copy — no migration, no duplication — with model choice through Amazon Bedrock.
In September 2026, Discourse launched Workflows, a visual automation builder in the Zapier or n8n mold, bundled into the platform’s core. It replaces hand-rolled webhook chains, but only activates on Business and Enterprise plans — not the self-hosted open-source edition.
On August 26, 2026, Kubernetes shipped version 1.37 "Garhwal", with 67 enhancements and 16 graduates to stable. The HorizontalPodAutoscaler can now idle a workload down to zero pods by default, and the apiserver no longer floods etcd while its watch cache warms up.
On 16 September 2026, ISC shipped BIND 9.20.29 and 9.21.26, fixing 14 vulnerabilities including DNS cache-poisoning flaws and DNSSEC-validation bypasses. Upgrade exposed recursive resolvers and lock down recursion before a forged response redirects your users.
On 18 September 2026, researcher Asim Manizada published working exploits for four Linux kernel flaws — DirtyAH6, TUNderflow, PPPoEject and DiagSpill — each of which gives root to any local user. The fixes have been available for weeks, so check your kernel version and restrict unprivileged user namespaces now.
On 10 September 2026, CISA updated the KEV entry for CVE-2025-14733 to confirm ransomware gangs are exploiting this unauthenticated RCE in the Firebox IKEv2 handler, 265 days after its first listing. Update Fireware OS and, if compromised, rotate every secret stored locally.
On September 23, 2026, Mike Hulme, Azure’s GM of product marketing, describes the shift from request-response applications to continuously acting multi-agent systems, and Microsoft’s answer: govern the agent on Foundry, execute it in an isolated Azure Container Apps sandbox. For platform teams, it is a concrete framework for what must change when the agent replaces the request.
On September 24, 2026, Docker extended its Sandboxes to the cloud: the same microVM environment, running on Docker-managed compute, with a single command to move a project between a laptop and the cloud. Teams handing multi-hour tasks to coding agents no longer have to choose between a laptop that sleeps and isolation they would have to rebuild.
On September 21, 2026, Hugging Face detailed version 1 of its tokenizers library: the same output as v0.23, but encoding 3 to 30 times faster single-threaded on an Apple M4 Max, thanks to SIMD bitstream splitting and a word cache. Teams serving LLMs now have a measured reason to look at the tokenizer — the new bottleneck as models get faster.
watchTowr has documented two remote-code-execution zero-days in Citrix NetScaler ADC and Gateway, already exploited before any fix existed. With nothing published by Citrix, the only defense is isolation: preserve evidence, cut the appliance off the network and keep management off the internet.
A patch series by Yuan Liu (Intel), queued in mm/core.git ahead of the Linux 7.4 merge window, replaces page-by-page zone scans with an optimized contiguity check. Measured: up to 81% less time to hot-add memory to a VM and 75% to hot-remove it, with Samsung also reporting CXL gains.
Google has documented a fresh wave of exploitation of CVE-2026-35273 (CVSS 9.8) by UNC6240, a ShinyHunters-linked actor: the group URL-encodes a single character in the path to bypass WAFs and drop web shells on Oracle PeopleSoft. Patch, disable the EMHub, and hunt for /PSEMHUB/ in every encoded form.
