Tech radar: week 39 of 2026
21–27 Sep 2026
In the week of 21–27 Sep 2026, 15 notable open-source releases shipped (including Wrangler / Workers SDK [email protected], Tauri tauri v3.0.0-alpha.3, Angular VSCode Extension: 22.2.0), CISA added 12 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “When did Google get so weird?” (2017 points).
Releases worth knowing about
Cloud & DevOps
- 15856 4c2993b Thanks @Naapperas! - Support Workflows declared in exports on ctx.exports in local development
- [CHANGE] PromQL: A range query whose end was not aligned to step caused subqueries inside it to evaluate past the parent's last actual step, inflati
https://code.visualstudio.com/updates/v1139
Mobile & desktop
<summary<em<h4Cargo Audit</h4</em</summarymentions security
Web frameworks
- fix(vscode-extension): Support inlay hint in inline templates (c11920da48)
This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponsementions security
[13.x] Drop restartsyscalls from pcntlsignal in Worker by @jackbayliss in https://github.com/laravel/framework/pull/61590
AI & machine learning
Models run on MLX on Apple Silicon by default
api: add GCP external storage support (3943) (d12d60f)
- 1624 6032170 Thanks @SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates,
This release features 762 commits from 315 contributors (104 new)!mentions security
api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (b5cc700)
llama-index-agent-agentmesh [0.3.0]mentions security
Languages & runtimes
\[fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) 64746
Testing & security tools
SHA-256: ddac49f903da9d5bac833e5cc79395098b9c33cfd3279be5f31bd00387d2d4dbmentions security
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 12.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2026-71362 | Adobe Commerce and Magento | Adobe Commerce and Magento Incorrect Authorization Vulnerability | 2026-09-24 |
| CVE-2026-93952 | Arista VeloCloud Orchestrator | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | 2026-09-22 |
| CVE-2026-93616 | Check Point Multiple Products | Check Point Multiple Products Path Traversal Vulnerability | 2026-09-22 |
| CVE-2026-85102 | Check Point Multiple Products | Check Point Multiple Products Improper Certificate Validation Vulnerability | 2026-09-22 |
| CVE-2026-88772 | Citrix NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-09-27 |
| CVE-2026-88771 | Citrix NetScaler | Citrix NetScaler Improper Input Validation Vulnerability | 2026-09-27 |
| CVE-2026-94127 | F5 BIG-IP APM | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | 2026-09-22 |
| CVE-2026-65660 | Microsoft SharePoint | Microsoft SharePoint Code Injection Vulnerability | 2026-09-25 |
| CVE-2026-67279 | MikroTik RouterOS | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | 2026-09-25 |
| CVE-2026-87902 | WordPress Core | WordPress Core Remote File Inclusion Vulnerability | 2026-09-25 |
| CVE-2026-5430 | WSO2 Multiple Products | WSO2 Multiple Products Path Traversal Vulnerability | 2026-09-24 |
| CVE-2026-7273 | Zyxel GS1900 Series Switches | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 2026-09-21 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01When did Google get so weird?2017 points · 1125 comments · 2026-09-27
- 02Claude Opus 5.51806 points · 1134 comments · 2026-09-22
- 03GPT-6 Sol and Luna1779 points · 855 comments · 2026-09-22
- 04F-Droid 2.01465 points · 421 comments · 2026-09-24
- 05MiMo v2.61130 points · 483 comments · 2026-09-21
- 06Attention is all you have1090 points · 330 comments · 2026-09-21
- 07I don't want to read what you didn't write1070 points · 460 comments · 2026-09-21
- 08Dutch governments builds alternative for Microsoft based on NixOS1021 points · 584 comments · 2026-09-25
- 09Italian parliament votes for return to nuclear energy908 points · 818 comments · 2026-09-23
- 10I said no and Apple said yes886 points · 701 comments · 2026-09-22
- 11Show HN: Make cursed fonts like Times New Bastard862 points · 126 comments · 2026-09-23
- 12Apple has added persistent 'ads' to iOS, and it's driving users crazy822 points · 601 comments · 2026-09-22
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.