On Saturday, September 5, 2026, the PGP key that signs GitHub CLI’s APT and RPM repositories expires, and any gh install done before April 8 without a keyring update will start failing. Check your local keyring before the deadline and add the replacement key 7F38BBB59D064DBCB3D84D725612B36462313325.

On August 31, 2026, Sygnia documented how the Chinese espionage group Fire Ant, which heavily overlaps UNC3886, pivoted from VMware hypervisors to Cisco IOS XR routers to intercept the traffic passing through them. An active GRE tunnel missing from the running config is enough to turn a transit router into a collection platform — and it means defenders must audit routers as vantage points, not as mere hops.

On August 26, 2026, the U.S. Department of Justice and the FBI seized the domains of QScan and QTRouter, two platforms run by a Chinese group that concealed the origin of intrusions against U.S. critical infrastructure. The lesson outlives the news cycle: network obfuscation is now an industrialized service, and it breaks where the attacker has the least redundancy.

Kaspersky has found a new CoolClient backdoor variant carrying a signed kernel driver that hides processes, files, registry keys, and network connections. The HoneyMyte group (Mustang Panda) is using it against governments in Asia — detecting it requires kernel-level telemetry.