On August 31, 2026, AWS Interconnect multicloud opened to Azure in public preview: a VPC and a VNet linked over AWS’s private backbone, no third-party carrier, but capped at 1 Gbps with no availability commitment. Test it for shared AWS-Azure workloads, but keep your existing circuits until general availability.

The September 8, 2026 Patch Tuesday breaks a record with 964 CVEs, including two zero-days already exploited in the wild, CVE-2026-81963 and CVE-2026-85880. Triage the bulletin by exploitability — zero-days first, then internet-facing RCEs — rather than by raw score.

The September 8, 2026 Patch Tuesday fixes nine remote code execution flaws in Windows DNS Server, including CVE-2026-69730, a CVSS 9.8 use-after-free triggerable with a single forged packet. Patch the servers running the DNS role first and segment port 53 before a public exploit appears.

Check Point unpacks JSCeal, a compiled V8 JavaScript malware that replays stolen session cookies to open access to Google accounts without a password or second factor. Lock down sessions with security keys and device-bound credentials, and watch for cookie exfiltration.

Kubernetes v1.37 enables KubeletInUserNamespace by default: the kubelet, runtimes, and CNI plugins can now run as a non-root user inside a user namespace. Turn it on to confine container-breakout flaws away from host root.

The rc2 of Linux 7.3 fixes cache-aware scheduling misfits on hybrid CPUs and keeps migrating kernel allocations to kmalloc_obj. Test this rc2 if you run Intel Core hybrid or big.LITTLE machines.

The public preview of Amazon Linux 2027 arrived on September 3 with a 7.1 kernel, SELinux enforcing by default, and AWS Neuron driver support. Test it now if you are planning an AL2023 migration.

Hcompany ships NeoMME, a 260M–800M multilingual multimodal encoder that processes text and images in one Transformer with no separate vision tower. For visual document retrieval, its Retriever variant reaches the ViDoRe v3 Pareto frontier with a 255× smaller index.

SourceHut changes its terms of service to prohibit LLM-assisted code, becoming the second major forge to follow Codeberg’s lead. If your project relies on generative AI tooling, prepare a migration to Forgejo or a self-hosted instance.

N-able publishes an emergency hotfix for CVE-2026-86218, a pre-authentication remote code execution flaw (CVSS 10.0) in its N-central RMM platform, which Huntress researchers say they have seen actively exploited. Update self-hosted instances to 2026.3 HF4 and segment your RMM from the rest of the network.

NEC fixes CVE-2026-16876, a critical missing-authentication flaw (CVSS 9.4) in the WebGUI of UNIVERGE IX-R and IX-V enterprise routers: a forged message bypasses login and runs arbitrary CLI commands. Apply the firmware update, or disable the WebGUI if it is reachable from the internet.

CVE-2026-48710, nicknamed BadHost, lets an unauthenticated attacker turn a blocked request into an allowed one by adding a character to the Host header, in every Starlette release before 1.0.1. Upgrade Starlette and audit every middleware that reads request.url.path instead of the raw ASGI path.