On 24 September 2026, GitHub Security Lab released an autonomous fuzzing pipeline that writes its own harnesses, reads its own coverage and drafts its own vulnerability reports. The fuzzing bottleneck — human attention — is handed to an LLM, but the code runs on the host with no container in between.
On 21 September 2026, Jeff Geerling documented a firmware lock, introduced in late 2024, that prevents swapping the RAM chips on a Raspberry Pi 5. The move targets resellers who modify entry-level boards, but it also removes the right to repair and upgrade your hardware.
Samba 4.25.0, released on 24 September 2026, ships experimental SMB3 persistent handles — the building block for transparent failover. The reward, files that stay open through an outage, comes at the cost of synchronous persistence and a share that only speaks SMB.
On September 24, 2026, Aikido revealed that GitLab’s “Email work item to this project” addresses, generated with a long-lived token and accidentally published in READMEs, let an attacker open merge requests or push code as the token owner. Search your repositories for these addresses and reset the exposed tokens.
On September 24, 2026, Manifold Security revealed that third-party.com, a documentation placeholder used as an example for years, had been registered by a third party and now serves a ClickFix lure to Windows browsers. Audit your repositories and stop letting a non-reserved domain stand in as an example.
On September 25, 2026, BleepingComputer confirmed that the ShinyHunters gang compromised the Clop ransomware leak site by exploiting CVE-2026-42608, an unauthenticated path traversal in Grav fixed in April but never backported to the 1.7 branch. If you still run Grav 1.7, upgrade to 1.7.53.4 without delay.
On September 22, 2026, Amazon CloudWatch launched Omni, a unified observability experience for applications and AI agents, delivered inside VS Code, Kiro, and a standalone web console. Adopt it to trace, compare, and evaluate your agents before a prompt regression silently degrades production responses.
On September 18, 2026, the self-hosted community identified the developer of BookOrbit — a self-hosted reading platform with about 4,600 GitHub stars — as the creator of Booklore, a twin project that disappeared after being called out for code quality, contributor mistreatment, and license abuse. Before deploying software you run yourself, verify author continuity, the license, and community history.
On September 22, 2026, Hugging Face added native GGUF support to Transformers, the llama.cpp quantized format behind Ollama, LM Studio, and Jan. If you run local models on Apple Silicon from Python, adopt `from_pretrained` with a GGUF file and drop the homegrown conversions.
On September 16, 2026, CISA added a local privilege escalation (CVE-2026-87886) caused by overly permissive default permissions in the Acronis Backup plugins for cPanel & WHM, Plesk and DirectAdmin to its KEV catalog. Update to the fixed builds — the September 19 federal deadline has already passed.
On September 22, 2026, CISA added a CVSS 10 input-validation flaw in Arista’s on-prem VeloCloud Orchestrator to its KEV catalog, exploitable with no credentials. Restrict network access to the VCO web interface and apply the fix before September 25.
On September 24, 2026, Greg Kroah-Hartman merged into driver-core-next a new taint flag, TAINT_FORCED_BIND, that marks kernels whose sysfs bind/unbind files have been written. It targets fuzzing bots like syzbot that arbitrarily bind drivers to devices and drown maintainers in pointless bug reports.
