On September 21, 2026, AMD posted AMDGPU kernel patches that add the GDDR7 memory identifier and new IP blocks, signalling the first RDNA5 GPUs. Linux users get the benefit of this open-source enablement months before any card ships.
On September 21, 2026, OpenAI released ’Building standards for the next phase of AI’, proposing global technical standards including for recursive self-improvement, plus an incident-reporting framework. CISOs should read this as the de facto definition of the coming model audit.
On September 21, 2026, CISA added CVE-2026-7273, a stack-based buffer overflow in the CGI of Zyxel GS1900 switches, to its KEV catalog after confirming active exploitation. Lock down the management interface, apply Zyxel’s fix before September 24, and hunt for signs of compromise on exposed devices.
On September 17, 2026, AWS released Corretto 27, its free OpenJDK distribution, with hybrid post-quantum key exchange for TLS 1.3 and compact object headers turned on by default. Test these wins in non-critical environments, but keep your LTS workloads on Java 21 or 25 — this release is only supported through April 2027.
On September 12, 2026, Frigate 0.18, the self-hosted AI object-detection NVR, replaced its YAML-first workflow with full UI-based configuration and added profiles and multi-provider GenAI. Back up your config and frigate.db, review the breaking changes, then migrate if you want UI configuration.
On September 8, 2026, the CNCF announced the graduation of Karmada, the multi-cluster orchestrator that runs an application across several clusters without modifying it. If you operate three or more clusters, or are building multi-cluster infrastructure for AI, this is the moment to evaluate the move to a mature, audited project.
On September 22, 2026, D-Link confirmed two critical flaws in the end-of-life DIR-822A router: a stack-based buffer overflow in the DHCP server (CVE-2026-86296, CVSS 10) and an out-of-bounds write in the L2TP parser (CVE-2026-86510, CVSS 9.9), both with public proof-of-concept code and no patch available. Replace or isolate these routers, and never expose them to the internet.
On September 22, 2026, researcher Patrick Wardle showed that an undocumented setting in Muse, Meta’s AI assistant, lets a simple local command redirect voice dictation and steal the account authentication token. Cut back the permissions you grant AI agents and wait for Meta’s fix before deploying new ones.
On September 18, 2026, a joint advisory from the FBI, Japan’s police, and several agencies revealed that WaterPlum, a North Korean group, infected more than 30,000 devices across 100-plus countries and siphoned $10.7 million in cryptocurrency through fake job interviews and poisoned repositories. Verify contractor identities and limit their access to source code and credentials.
Gzip 1.15, released September 20, 2026, ships 119 commits of fixes including a buffer overflow and uninitialized memory access present since the early 1990s. Update gzip and treat archive decompression as untrusted input.
SentinelOne ties North Korea’s Jade Sleet to the compromise of an Indian IT services firm, reached through fake job interviews and poisoned Terraform modules. Treat developer endpoints as high-value targets and audit your Terraform dependency locks.
Researchers found two ways out of OpenAI’s Codex sandbox, one capable of running commands on a developer’s machine from the most locked-down mode, with no prompt and nothing on screen. Update Codex and never run a coding agent with access to the Docker socket or your home directory.
