The latest wire

The September 29 Stormcast covers Apple's emergency fixes for older operating-system releases and a separately patched macOS privilege-escalation issue. It also reviews Microsoft's analysis of the modular NeedyMantis implant and research into file-notification side channels. Johannes Ullrich highlights why defenders should distinguish legitimate libraries from malware that reuses them when investigating a compromised system.

Une vulnérabilité a été découverte dans les produits Apple. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance. Apple indique que la vulnérabilité CVE-2026-86950 est activement exploitée.

Vercel has added OpenAI’s GPT-6.1 Sol to AI Gateway through the AI SDK and OpenAI-compatible APIs. The announcement positions it for coding, computer interaction and document-heavy professional workflows, including tasks involving PDFs with tables and charts. Vercel also describes lower standard input and output pricing than GPT-6 Astra. These capability comparisons are publisher claims, rather than independent evaluation results.

AI Gateway User Insights now gives you more context about the traffic flowing through your gateway. It shows what users and agents are doing with AI, and where a selected model may be more capable than a task requires. On the analysis side, User Insights groups conversations by task, tracks conversation turns, and helps you compare model fit with cost and latency. The Potential Savings view highlights requests that may work with faster or less expensive models without compromising output quality. These are the same signals that Cloudflare's Auto Router uses to select a model based on task and cost. These new insights are available to all AI Gateway customers at no additional cost. For more information, refer to User Insights.

An update for java-21-ibm-semeru-certified-jdk is now available for Red Hat Enterprise Linux 10.0 Extended Update Support and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

SANS reports that Apple issued emergency fixes for CVE-2026-86950 on iOS 26, macOS 26 and macOS 15 after reports of targeted exploitation. Its diary distinguishes these security updates from the functional updates released for version 27 systems. The article credits Meta's product security team and points readers to Apple's release information for the affected platforms.

Sep 28, 22:08 UTC Resolved - On September 28, 2026, between 19:23 UTC and 22:08 UTC the Copilot Code Review service was degraded and pull request reviews did not complete in all environments.

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Cloudflare reported a brief network performance disruption in Eastern North America on September 28. Customers routing traffic through the region may have encountered higher error rates between approximately 19:50 and 20:20 UTC. Cloudflare published the notice as resolved at 20:36 UTC, after the reported impact window had ended.

EFF is urging San Francisco's Police Commission to strengthen proposed rules for police drones as their use expands. The organization argues that vague deployment criteria could enable broad surveillance and that the revised policy still lacks adequate safeguards. Its article says the commission is scheduled to consider the proposal on October 14.

New Zealand's NCSC brought its threat assessment to Cyber Summit Korea, where experts and officials discussed emerging technology, cooperation and cybersecurity policy. Catriona Robinson's address covered changes in New Zealand's security environment and the opportunities and risks of AI. The agency links to the full speech for the underlying assessment and detail.

GitHub moved full enforcement of its Enterprise Cloud self-hosted runner requirements to September 29, 2026. Registration requires at least version 2.329.0, but running workflow jobs has a separate, higher minimum. The notice points operators to the runner-deprecation API for version-specific dates and says Enterprise Server is unaffected.

Google announced that filmmaker Jeff Synthesized won the Future Vision XPRIZE with The Gifted, a fictional story about a child recreating his late mother through technology. The project receives a $100,000 prize and $2.5 million in feature-production funding. Google’s 100 ZEROS initiative and Range Media Partners will help develop the film, which was selected from more than 2,500 entries.

Google recommends combining frontier-model APIs with smaller open-weight models instead of using one model for every production task. Its article presents Gemma for local execution, repetitive routing and task-specific tuning, with larger models reserved for demanding synthesis. Customer examples describe latency and cost improvements, but these are attributed case studies rather than evidence that the same architecture will benefit every workload.

Google Earth Engine’s new Ask panel brings Gemini assistance into its Code Editor for writing, explaining, debugging and optimizing geospatial scripts. It uses the active script, imported assets and chat context, and can present proposed changes as a reviewable diff. The feature is available globally with a user-supplied Gemini API key; usage with a paid-tier key is billed accordingly.

Mistral opened a Munich hub for industrial and physics-focused AI research, with applied engineers supporting enterprise partners. The company says it is working with BMW on crash simulation and Siemens Energy on industrial applications, alongside a Technical University of Munich research partnership on aerodynamic digital twins. These efforts extend its industrial research program; the announcement does not establish independently measured production gains.

UK NCSC says CVE-2026-88771 and CVE-2026-88772 are being actively exploited in customer-managed Citrix NetScaler ADC and Gateway systems. They are two of eight vulnerabilities covered by Citrix's bulletin. The agency urges affected operators to investigate for compromise, isolate and replace systems where possible, and install current updates. It says the impact on UK organisations is still being assessed.

Google Cloud's Z4D storage-focused machine family targets databases, analytics and other workloads needing large local SSD capacity. Google specifies configurations reaching 84,000 GiB of local storage, with AMD EPYC processors and Titanium storage processing. Z4D VMs are available in selected regions, while bare-metal instances remain in preview through account-team access.

The September 28 Stormcast reviews urgent NetScaler security updates and reports of renewed attacks on Oracle PeopleSoft. It also revisits uncertainty about the malware family behind a macOS ClickFix campaign. For a separate Kiteworks incident, Johannes Ullrich notes limited public detail and directs affected customers to the vendor for clarification rather than treating reported shutdown instructions as universal guidance.

Vercel added Anthropic’s Claude Sonnet 5.5 to AI Gateway for coding, document creation and other scoped tasks. It is accessible through the AI SDK and OpenAI- or Anthropic-compatible APIs, and supports Zero Data Retention on the gateway. Vercel describes better multi-step coding, desktop interaction and document output than Sonnet 5.

[Mise à jour du 30 septembre 2026] Dans un billet de blogue du 29 septembre 2026 (cf. section Documentation), Mandiant et Google Threat Intelligence Group (GTIG) fournissent des indicateurs de compromission ainsi que des règles de détection au format YARA.

De multiples vulnérabilités ont été découvertes dans Citrix NetScaler ADC et Gateway. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.

The Cloudflare CLI, cf, is now in beta. cf is one command-line interface for the public Cloudflare API and for Workers projects. Use it to manage zones, DNS, storage, and security settings, and to create, develop, and deploy Workers, without switching between tools. Install cf globally, then sign in: npmyarnpnpmbun npm install --global cf yarn global add cf pnpm add --global cf bun add --global cf cf auth login With cf, you can: Manage resources across Cloudflare. More than 2,900 commands cover the public Cloudflare API, and most print their results as JSON. Create and deploy Workers. cf init creates a project that uses cloudflare.config.ts, a typed configuration file. cf dev, cf build, and cf deploy develop, build, and deploy it. Move from Wrangler. cf migrate converts a Wrangler configuration file to cloudflare.config.ts.

Vercel now allows domain discovery and checks of availability and pricing without an account session or access token. The CLI supports keyword searches, while the Domains Registrar API accepts up to 200 exact domain names per request and returns registration and renewal prices when available. Buying a domain or managing an existing one still requires authentication.