Kubernetes v1.37 introduces two storage security settings, still in alpha: bind mount options (noexec, nosuid, nodev) and a permission mode on emptyDir volumes. Enable the VolumeBindMountOptions and EmptyDirVolumeMode feature gates to replace init-container workarounds.
Version 2026.8.1 of Bitwarden’s self-host repository adds long-requested support for running the unified container fully rootless and with a read-only root filesystem, and 2026.8.2 follows up with cap_drop: ALL. If you self-host the password manager, upgrade now and re-check your Docker Compose before a container escape turns a missed patch into a vault theft.
Merged this week for Linux 7.3, the stack randomization rework led by Thomas Gleixner moves the computation to the earliest possible point and unifies the architecture-specific code. Maintainers of hardened systems have a reason to watch this merge window.
On August 5, 2026, Cisco shipped a massive hardening release for IOS XE and SD-WAN, bundling fixes for 12 vulnerabilities uncovered during an internal AI-assisted security review. Three reach CVSS 9.9. The era of AI-accelerated vulnerability discovery has hit the network hardware industry — and Cisco just showed what that looks like in production.
The 0.10 release of Rust Coreutils passes 98% of GNU test suites with compiler-enforced memory safety. If you run Linux infrastructure, now is the time to start testing the switch.
A freshly provisioned Ubuntu VPS on Hetzner, OVH, or DigitalOcean receives its first SSH brute-force attempt within 12 minutes. These 10 commands — AppArmor, firewalld, fail2ban, auditd, AIDE, kernel hardening, Lynis, and unattended-upgrades — lock it down in 5 minutes flat.
