Tech radar: week 37 of 2026
7–13 Sep 2026
In the week of 7–13 Sep 2026, 14 notable open-source releases shipped (including Tauri tauri v3.0.0-alpha.0, Vite v8.3.0, Electron electron v43.7.0), CISA added 14 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “Navier-Stokes – Tristan Buckmaster [pdf]” (2054 points).
Releases worth knowing about
Mobile & desktop
<summary<em<h4Cargo Audit</h4</em</summarymentions security
Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-downlomentions security
Web frameworks
build: avoid settling seen preload dependencies for performance (23446) (e6f6b3e)
Below is a list of all new features, APIs, and bug fixes.
[12.x] Ensure password hash matches stored cookie before authenticating the user by @crynobone in https://github.com/laravel/framework/pull/61386
AI & machine learning
api: add Agents API (1c4284a)
api: add auto mode tool permissions for Managed Agents (62aa21b)
This release features 594 commits from 277 contributors (91 new)!mentions security
<img width="1503" height="827" alt="image" src="https://github.com/user-attachments/assets/e6ed85ee-eb1d-40eb-a0d4-c649f6337ca9" /
pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/
Cloud & DevOps
- 15480 36aed7f Thanks @skepticfx! - Add Durable Object-managed Containers to top-level container configurationmentions security
https://code.visualstudio.com/updates/v1137
- [SECURITY] Bump github.com/klauspost/compress to v1.18.7 (GO-2026-5841) and golang.org/x/crypto to v0.55.0 (GO-2026-6303).mentions security
Languages & runtimes
\[616bd3fa26] - doc: deprecate Server.prototype.listen2 in node:net (Antoine du Hamel) 65593mentions security
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 14.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2026-75650 | Adobe Commerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 2026-09-08 |
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-09 |
| CVE-2026-19490 | Citrix NetScaler | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-09 |
| CVE-2026-84869 | ConnectWise ScreenConnect | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | 2026-09-11 |
| CVE-2025-25249 | Fortinet Multiple Products | Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability | 2026-09-09 |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | 2026-09-11 |
| CVE-2026-87491 | Google Chromium V8 | Google Chromium V8 Out of Bounds Write Vulnerability | 2026-09-09 |
| CVE-2026-42016 | JFrog Artifactory | JFrog Artifactory Incorrect Authorization Vulnerability | 2026-09-11 |
| CVE-2026-42018 | JFrog Artifactory | JFrog Artifactory Improper Authentication Vulnerability | 2026-09-11 |
| CVE-2026-81963 | Microsoft Windows | Microsoft Windows Link Following Vulnerability | 2026-09-08 |
| CVE-2026-85880 | Microsoft Windows | Microsoft Windows Heap-Based Buffer Overflow Vulnerability | 2026-09-08 |
| CVE-2026-86060 | MikroTik RouterOS | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | 2026-09-10 |
| CVE-2026-67277 | MikroTik RouterOS | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | 2026-09-10 |
| CVE-2026-86218 | N-able N-central | N-able N-central Static Code Injection Vulnerability | 2026-09-08 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01Navier-Stokes – Tristan Buckmaster [pdf]2054 points · 827 comments · 2026-09-08
- 02iPhone Duo1485 points · 2545 comments · 2026-09-09
- 03On the Navier–Stokes Millennium Prize Problem1346 points · 1137 comments · 2026-09-08
- 04Shopify is moving from React Native back to Swift and Kotlin1275 points · 957 comments · 2026-09-10
- 05A misalignment of AI in mathematics1242 points · 1215 comments · 2026-09-11
- 06Fable 5.1 Solves the Cyphral Distich, a 370-year-old cipher1218 points · 570 comments · 2026-09-13
- 07Claude, change the “Add to Cart” button to blue1215 points · 453 comments · 2026-09-09
- 08LG smart TVs caught logging audio with screen off and snooping on local devices1201 points · 4 comments · 2026-09-07
- 09Shopify acquires Tailwind1149 points · 444 comments · 2026-09-09
- 10Keep Our Servers Running1058 points · 284 comments · 2026-09-07
- 11DeepSeek v4.1 Flash1016 points · 574 comments · 2026-09-10
- 12OpenAI agents carried out an undisclosed attack on RubyGems975 points · 613 comments · 2026-09-11
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.