Argo CD 3.6.0-rc1, released September 16, 2026, adds metrics and conditions to ApplicationSet progressive sync and expands the health-check library — CloudNativePG, cert-manager, Prometheus Operator, Kyverno. Teams that roll out changes in waves across clusters should plan the upgrade once the stable release lands.
On September 17, 2026, Check Point shipped an emergency fix for CVE-2026-91843, a CVSS 9.8 stack overflow in the login process of its management and log servers that lets an unauthenticated attacker run code as root. Apply the Live Patch to every instance, confirm it with cplp list, and tighten Trusted Clients before someone takes over your firewall’s management plane.
Released September 16, 2026, GNOME 51 “A Coruña” removes WEP and legacy NVIDIA driver interfaces, migrates secret storage to the new oo7 component, and adds offline maps to Maps. For teams managing Linux fleets, this is the release to validate before it lands in major distributions.
On September 2, 2026, Google DeepMind released Gemini 3.8 Flash Cyber, a model built for vulnerability discovery and automated patching, but it is only available to vetted defenders through the new Fairwind Program. Security teams need to understand what it changes for patching and how to get in.
On September 9, 2026, AWS raised the Lambda function timeout to 90 minutes on Lambda Managed Instances and added Graviton5 instances, up to 25% faster than Graviton4. Teams that were working around the 15-minute cap or torn between serverless and EC2 now have a single bridge.
Versity’s S3 gateway, a stateless Apache-2.0 Go binary, exposes any POSIX storage behind the S3 API without deploying MinIO or Ceph. Self-hosters who want to point Restic, rclone, or Velero at their NAS get a bridge that is lighter than a full object store.
On September 11, 2026, CISA added two JFrog Artifactory flaws to the KEV catalog: CVE-2026-42016, which validates a token’s signature without checking its scope, and CVE-2026-42018, which leaks an anonymous token even when anonymous access is disabled. Upgrade to 7.133.11, revoke the affected tokens and audit anonymous access before a poisoned artifact ships to production.
On September 18, 2026, CISA added three Linux kernel vulnerabilities to the KEV catalog: a race in AF_ALG, an out-of-bounds write in ebtables SNAT, and mishandled zero-length TLS records. Patch before September 21 and confirm your distribution has backported all three commits.
On September 15, 2026, nginx shipped 1.31.6 and 1.30.5 to close CVE-2026-90439, a heap buffer overflow in its HTTP/3 module that hits builds linked against OpenSSL 3.5.0 or earlier. Upgrade both nginx and OpenSSL, then disable HTTP/3 on edges that do not need it.
Cilium 1.20, released on September 14, 2026, turns the Gateway API into a full traffic-management layer and finally closes the IPv6 gap in ENI mode on AWS. Teams migrating off ingress-nginx or extending their CNI now have a concrete reason to move.
The Linux 7.3 cycle — with rc2 out on September 6, 2026 and rc3 on September 13 — stands out for filesystem and BPF verifier hardening, plus a surge in sched_ext work. Teams that will maintain this kernel long-term should anticipate which security fixes to backport.
Microsoft delivered 973 fixes on September 8, 2026 — the biggest Patch Tuesday in its history — including two elevation-of-privilege flaws already exploited in the wild. Deploy the two zero-days within 24 hours, then address the critical remote-code-execution flaws within seven days.
