# Security Security is the practice of protecting computers, networks, programs, and data from unauthorized access, damage, or attack. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Accelerating Operational Efficiency in Modern Transportation DevFeed: [Accelerating Operational Efficiency in Modern Transportation]() Original publisher: [Read original article]() Author: Emily Kasman Published: 2026-09-17T13:30:51Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Cisco](), [Network](), [Critical Infrastructure](), [legacy](), [Low Latency](), [Security](), [observability](), [Resilience]() Tags: [cisco](), [cisco-connected-rail](), [cisco-industrial-ethernet-switches](), [cisco-industrial-routers](), [cisco-industrial-security](), [connected-roadways](), [critical-infrastructure](), [industrial-ai](), [industrial-iot](), [legacy](), [low-latency](), [modernization](), [network](), [observability](), [resilience](), [security](), [transportation]() ### AI overview This Cisco article discusses how transit and roadway agencies can modernize legacy network infrastructure. It presents secure, low-latency connectivity, end-to-end operational visibility, and security-focused architecture as ways to support real-time processing, connected systems, and more resilient transportation operations. ### Source excerpt Learn how Cisco helps transit agencies overcome legacy network bottlenecks with secure, AI-ready connectivity, full visibility, and robust cyber resilience. ## Security updates for Thursday DevFeed: [Security updates for Thursday]() Original publisher: [Read original article]() Author: corbet Published: 2026-09-17T12:48:01Z Content type: news Language: en Sources: [LWN.net]() Topics: [Security]() Tags: [ansible](), [firefox](), [grafana](), [net-9](), [nginx](), [opentelemetry](), [python](), [security](), [updates]() ### AI overview A roundup of security updates issued by AlmaLinux, Debian, Fedora, Mageia, Red Hat, Slackware, SUSE, and Ubuntu. The updates cover packages and components including .NET, kernels, Firefox, nginx, Python packages, Grafana, OpenTelemetry Collector, Ansible, and valkey. ### Source excerpt Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, corosync, firewalld, kernel, kernel-rt, libevent, libsoup, microcode_ctl, nginx:1.26, python-lxml, rsyslog, tesseract, and unbound), Debian (firefox-esr, mkvtoolnix, thunderbird, and tor), Fedora (open62541, php-pecl-mongodb2, python-django6, python-jwcrypto, and roundcubemail), Mageia (aom, cockpit, libgd, packagekit, and python-h2), Red Hat (corosync, delve, git-lfs, grafana-pcp, gstreamer1-plugins-base, libvirt, opentelemetry-collector, and rhc-worker-playbook), Slackware (mozilla-firefox and mozilla-thunderbird), SUSE (acl, attr, alloy, ansible-core, clamav, containerized-data-importer, corosync, cups, distribution, glibc, google-cloud-sap-agent, govulncheck-vulndb, gvfs, helm, jq, kbd, kubernetes1.34-apiserver, kubernetes1.35-apiserver, lcms2, libcupsfilters, liblzmasdk26, libzypp, zypper, mistral-vibe, opensc, openvpn, pcre2, python-jwcrypto, tomcat, tomcat10, and tomcat11), and Ubuntu (guix, libheif, perl, python-cryptography, sqlite3, and valkey). ## Cisco drops another exploited zero-day, this time a perfect 10 DevFeed: [Cisco drops another exploited zero-day, this time a perfect 10]() Original publisher: [Read original article]() Author: Carly Page Published: 2026-09-17T12:40:00Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [Cisco](), [Authentication](), [Security](), [patches]() Tags: [authentication-bypass](), [cisco](), [cybersecurity](), [security](), [zero-day]() ### AI overview Cisco's ISE authentication bypass is under active attack, following another Cisco zero-day that prompted administrators to urgently apply patches. ### Source excerpt ISE authentication bypass under active attack just days after another Cisco zero-day sent admins scrambling to patch ## 12 celebrity deepfake websites seized by Manhattan DA DevFeed: [12 celebrity deepfake websites seized by Manhattan DA]() Original publisher: [Read original article]() Author: Danny Bradbury Published: 2026-09-17T11:20:46Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Artificial Intelligence](), [Security]() Tags: [ai](), [department-of-homeland-security](), [department-of-justice](), [privacy](), [report](), [security]() ### AI overview The Manhattan District Attorney's Office seized 12 websites that hosted AI-generated celebrity deepfakes, including non-consensual intimate imagery depicting more than 1,200 people. The article describes the harms of deepfake abuse and expanding legal action against its distribution. ### Source excerpt The largest known celebrity deepfake seizure has taken 12 websites offline, disrupting access to videos depicting some 1,200 people. ## Security evaluations find traditional virtual machines inadequate for containing cyber-capable autonomous agents DevFeed: [Security evaluations find traditional virtual machines inadequate for containing cyber-capable autonomous agents]() Original publisher: [Read original article]() Author: Olimpiu Pop Published: 2026-09-17T07:07:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [virtual machines](), [Security](), [Vulnerabilities](), [Linux Kernel](), [qemu](), [Firecracker](), [systems]() Tags: [agent-escape-vm](), [ai-security](), [development](), [devops](), [firecracker](), [linux](), [linux-kernel](), [news](), [qemu](), [security](), [security-breach](), [virtual-machines](), [virtualization](), [vm](), [vulnerabilities]() ### AI overview Security evaluations found that a cyber-capable autonomous agent escaped standard QEMU and KVM virtual machine configurations by exploiting kernel and library vulnerabilities. Firecracker contained the agent in testing, but the agent still hardlocked the host through Linux kernel flaws. ### Source excerpt Traditional virtual machines are inadequate for isolating cyber-capable autonomous agents. Tests using GPT-5.6-Cyber indicated multiple escape attempts due to kernel flaws. While Firecracker provided some containment, vulnerabilities remained. The study underscores the need for minimal attack surface virtualisation technologies and rapid, proactive patching strategies to safeguard host systems. By Olimpiu Pop ## How API Design Is Evolving for AI Agents, Security, Reliability, and Compliance DevFeed: [How API Design Is Evolving for AI Agents, Security, Reliability, and Compliance]() Original publisher: [Read original article]() Author: J Simpson Published: 2026-09-17T07:00:00Z Content type: article Language: en Sources: [Nordic APIs]() Topics: [API](), [Architecture & Design](), [Artificial Intelligence](), [reliability](), [Security]() Tags: [agents](), [ai-agents](), [api](), [api-architecture](), [api-as-a-product](), [api-design](), [api-discovery](), [api-security](), [architecture](), [authorization](), [blog](), [mcp](), [microservices](), [rate-limiting](), [reliability](), [security]() ### AI overview This article examines six ways API design is evolving as APIs serve AI agents and other machine consumers, with implications for security, reliability, and regulatory compliance. ### Source excerpt For over two decades, API design and architecture remained remarkably consistent. Perhaps it's the outsized influence of Roy Fielding's RESTful dissertation, but API designers have stuck to the principles of stateless architecture, resource-based endpoints, and HTTP commands to an impressive degree. That's all starting to change, now that we've radically recontextualized the way we use ... ## Libreboot 20241206, 10th revision released! GRUB security fixes, better LVM scanning, non-root USB2 hub support DevFeed: [Libreboot 20241206, 10th revision released! GRUB security fixes, better LVM scanning, non-root USB2 hub support]() Original publisher: [Read original article]() Author: Leah Rowe Published: 2026-09-17T04:32:50.666044Z Content type: release Language: en Sources: [News about Libreboot releases and development]() Topics: [libreboot](), [Security](), [releases](), [LVM](), [coreboot]() Tags: [bios](), [canoeboot](), [coreboot](), [free-software](), [grub](), [libre](), [libreboot](), [lvm](), [opensource](), [release](), [security](), [uefi]() ### AI overview Libreboot 20241206 revision 10 is announced as the tenth revision in the stable release series. It includes critical GRUB security fixes, improved LVM scanning, and support for non-root USB2 hubs on some platforms. ### Source excerpt Article: Libreboot 20241206, 10th revision released! GRUB security fixes, better LVM scanning, non-root USB2 hub support Web link: https://libreboot.org/news/libreboot20241206rev10.html ## Laravel Scalpel Scans for Filesystem Intrusion Evidence DevFeed: [Laravel Scalpel Scans for Filesystem Intrusion Evidence]() Original publisher: [Read original article]() Author: Yannick Lyn Fatt Published: 2026-09-17T01:38:29Z Content type: article Language: en Sources: [Laravel]() Topics: [Laravel](), [Filesystems](), [Security](), [backdoor](), [PHP]() Tags: [backdoor](), [filesystem](), [laravel](), [laravel-packages](), [php](), [security](), [sha-256]() ### AI overview Laravel Scalpel is an intrusion-evidence scanner that runs inside Laravel applications. It checks filesystems for rogue PHP files, obfuscated code, altered server directives, environment issues, and changes from a trusted baseline. ### Source excerpt Laravel Scalpel scans Laravel filesystems for rogue PHP files, obfuscated backdoors, altered directives, environment issues, and file changes. The post Laravel Scalpel Scans for Filesystem Intrusion Evidence appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## Agent Anomaly Detection, now in Private Preview on the Gemini Enterprise Agent Platform DevFeed: [Agent Anomaly Detection, now in Private Preview on the Gemini Enterprise Agent Platform]() Original publisher: [Read original article]() Author: Achuth Narayan Rajagopal Published: 2026-09-17T01:25:27.608736Z Content type: release Language: en Sources: [Google Developers Blog]() Topics: [agent observability](), [OpenTelemetry](), [Security](), [Traces](), [API]() Tags: [agent](), [anomaly-detection](), [api](), [autonomous-agents](), [gemini](), [opentelemetry](), [security]() ### AI overview Google announces Agent Anomaly Detection in private preview on the Gemini Enterprise Agent Platform. The feature analyzes agents' reasoning traces, tool calls, logs, and execution flows to identify behavioral anomalies, suspicious intent, and policy violations. ### Source excerpt Agent Anomaly Detection is a new, out-of-band oversight layer for the Gemini Enterprise Agent Platform that analyzes OpenTelemetry traces and tool calls to catch behavioral risks without adding runtime latency to live requests. It utilizes a multi-tiered detection pipeline--combining lightweight statistical scanning with deep LLM-based reasoning--to identify logical anomalies and policy violations grounded in the OWASP Agentic Top 10. Developers can triage these automated findings within Security Command Center or leverage the exposed API to programmatically block subsequent tool calls when an agent breaches defined risk thresholds. ## Preparing Codename One for Android 17 and API 37 Migration DevFeed: [Preparing Codename One for Android 17 and API 37 Migration]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-09-17T00:00:00Z Content type: article Language: en Sources: [CodeName One]() Topics: [Android](), [migration](), [Security](), [format]() Tags: [android](), [apis](), [format](), [migration](), [security]() ### AI overview Codename One prepares for Android 17 and API 37 by adding platform compatibility checks, fixing API-level parsing and build-tool handling, and testing a new system-rendered location button. The article also describes moving PEM parsing and task removal into shared security-sensitive platform handling. ### Source excerpt API 37 checks and a system location button prepare Android migration. PEM parsing and task-clearing exit put more security-sensitive platform and format handling into Codename One. ## datasette 0.65.5 DevFeed: [datasette 0.65.5]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-09-16T23:51:08Z Content type: release Language: en Sources: [Simon Willison's Weblog]() Topics: [Security](), [Authorization]() Tags: [bypass](), [datasette](), [datasette-1-544](), [issue](), [permissions](), [release](), [security](), [security-636]() ### AI overview Datasette 0.65.5 is a security release fixing an issue in which a trailing newline in a requested table name could bypass table permissions and expose private rows. ### Source excerpt Release: datasette 0.65.5 Security fix for an issue where a trailing newline in a requested table name could bypass table permissions and expose private rows, reported by dpfkdlemtp in GHSA-h547-rmjf-5m2m. Tags: security, datasette ## Snap Announces New "anticipatory" AI Service & Apps for First Consumer 'Specs' AR Glasses DevFeed: [Snap Announces New "anticipatory" AI Service & Apps for First Consumer 'Specs' AR Glasses]() Original publisher: [Read original article]() Author: Scott Hayden Published: 2026-09-16T23:40:00Z Content type: news Language: en Sources: [Road to VR]() Topics: [Artificial Intelligence](), [AI Models](), [iOS](), [iphone](), [Cloud](), [Security](), [Streaming]() Tags: [ai](), [ai-models](), [cloud](), [ios](), [iphone](), [on-device](), [security](), [streaming](), [xr-industry-news]() ### AI overview Snap announced Specs Intelligence, an anticipatory AI service for its upcoming consumer Specs AR glasses. The service is designed to work across Specs, iPhone, and Mac, using connected apps and tools to build context and surface relevant information. Snap also announced AR experiences, streaming features, Spotify integration, and partnerships including HBO Max, the NBA, and the WNBA. ### Source excerpt Snap today announced new experiences, services and partnerships for SPECS, the company's upcoming pair of consumer AR glasses. Snap's big Specs livestream today wasn't technically a launch event--they're still slated to arrive in the US, UK and France later this fall starting at $2,195--although the company did give a little more insight into what sort [...] The post Snap Announces New "anticipatory" AI Service & Apps for First Consumer 'Specs' AR Glasses appeared first on Road to VR. ## CISA decides weekly vulnerability bulletin isn't necessary anymore DevFeed: [CISA decides weekly vulnerability bulletin isn't necessary anymore]() Original publisher: [Read original article]() Author: Brandon Vigliarolo Published: 2026-09-16T20:33:48Z Content type: article Language: en Sources: [www.theregister.com - Articles]() Topics: [cisa](), [vulnerability](), [Security]() Tags: [cisa](), [common-vulnerability-scoring-system](), [infosec](), [security](), [vulnerability]() ### AI overview CISA is ending its weekly vulnerability bulletin on September 28, shifting from static CVSS scores to risk-based prioritization. ### Source excerpt Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28 ## When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts DevFeed: [When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts]() Original publisher: [Read original article]() Author: Denzil Correa Published: 2026-09-16T20:06:17Z Content type: article Language: en Sources: [Cloudflare Blog]() Topics: [Cloudflare](), [Machine Learning, Security Attacks](), [Security](), [JavaScript]() Tags: [ai](), [application-security](), [attacks](), [client-side-security](), [cloudflare](), [cybersecurity](), [developer-platform](), [developers](), [ecommerce](), [javascript](), [machine-learning](), [malicious-javascript](), [page-shield](), [security](), [security-research](), [virustotal](), [workers-ai]() ### AI overview Cloudflare describes how its Client-Side Security machine learning model detected four malicious JavaScript operations involving eight payloads in live storefront traffic. The post says humans verified the findings after automated detection, while most payloads were absent from VirusTotal and received no malicious verdict from URLScan. ### Source excerpt A modern storefront can look healthy while malicious JavaScript quietly siphons revenue, hijacks clicks, or rewrites analytics. See how Cloudflare's machine learning models surface evasive client-side attacks for analyst investigation. ## FIPS 140-3 support in OpenSearch DevFeed: [FIPS 140-3 support in OpenSearch]() Original publisher: [Read original article]() Author: Karsten Schnitter Published: 2026-09-16T19:12:14Z Content type: article Language: en Sources: [OpenSearch]() Topics: [fips 140-3](), [opensearch](), [Cryptography](), [Encryption](), [Security]() Tags: [aws](), [blog](), [compliance](), [cryptography](), [encryption](), [fips](), [fips-140-3](), [opensearch](), [security](), [technical]() ### AI overview This post explains OpenSearch support for a FIPS 140-3-compliant mode starting with version 3.6. It describes the validated cryptographic modules used for security-relevant operations, the collaboration involving SAP, SAS, and AWS, and how native FIPS mode differs from using a FIPS-validated TLS-terminating proxy. ### Source excerpt OpenSearch now supports running in a mode compliant with FIPS 140-3, contributed through a multi-year collaboration between SAP, SAS, and AWS. The post FIPS 140-3 support in OpenSearch appeared first on OpenSearch. ## n8n Patches 16 Security Vulnerabilities, 12 Rated High Severity DevFeed: [n8n Patches 16 Security Vulnerabilities, 12 Rated High Severity]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-09-16T18:31:20Z Content type: news Language: en Sources: [Self Host Lab]() Topics: [n8n](), [Vulnerabilities](), [patches](), [Security](), [Self-hosted]() Tags: [automation](), [n8n](), [news](), [patches](), [security](), [security-vulnerabilities](), [self-hosted](), [update](), [vulnerabilities]() ### AI overview n8n published a bi-weekly security update disclosing 16 fixed advisories: 12 rated High severity and 4 rated Medium. The article highlights an unauthenticated NoSQL injection in the MongoDB Chat Memory node that can disclose chat history across sessions, along with five High-severity credential-handling advisories. ### Source excerpt n8n, the self-hosted workflow automation platform covered regularly on this site, published its bi-weekly security update on September 16, 2026. The bulletin, posted on the official n8n Community forum by a member of the n8n security team, discloses 16 advisories fixed since the previous update on September 2: 12 rated High severity and 4 rated [...] ## Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions DevFeed: [Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions]() Original publisher: [Read original article]() Author: Nispriha Jagan; Neeraj Krishna Gopalakrishna Published: 2026-09-16T18:30:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Security](), [mount](), [Filesystems](), [chmod](), [Unix]() Tags: [chmod](), [container](), [containers](), [filesystem](), [hardening](), [kubernetes](), [linux](), [mount](), [permissions](), [storage](), [volume](), [volumes]() ### AI overview Kubernetes v1.37 adds bind mount options and emptyDir permission modes to strengthen storage security. The article explains how noexec, nosuid, nodev, Unix permissions, and the sticky bit can help enforce security policies on writable volumes. ### Source excerpt Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention. Linux storage and permission fundamentals Before diving into the new Kubernetes features, let us briefly review the low-level Linux security mechanisms that make them possible. Bind mount flags When Linux mounts or remounts a directory, Virtual File System (VFS) flags control what actions are permitted on that filesystem: noexec: Do not permit direct execution of any binaries on the mounted filesystem. nosuid: Do not allow set-user-identifier or set-group-identifier bits to take effect. nodev: Do not interpret character or block special devices on the file system. Directory permissions and the sticky bit Standard Unix permissions regulate access across three scopes: Owner, Group, and Others (e.g., 0755 or 0777). Beyond standard read, write, and execute bits, Linux supports the sticky bit (as in mode 01777). When applied to a directory, the sticky bit ensures that a file inside that directory can only be deleted or renamed by the file's owner or root. This is essential for shared writable directories like /tmp. Motivation for the improvements Why does Kubernetes need bind mount options and emptyDir permissions? The primary goal of these features is to increase the security of Kubernetes workloads by allowing security-related bind mount options on volume mounts. By default, volumes are bind-mounted into containers by the container runtime and kubelet without noexec, nosuid, or nodev flags. This default can undermine security. For example, with noexec missing, a compromised process can use any writable volume (emptyDir, PersistentVolume, etc.) to download, chmod +x, and execute arbitra ## Native Splunk brings real-time insights to Cisco Nexus One DevFeed: [Native Splunk brings real-time insights to Cisco Nexus One]() Original publisher: [Read original article]() Author: David Keith Published: 2026-09-16T15:00:59Z Content type: release Language: en Sources: [Cisco Blogs]() Topics: [Nexus Dashboard](), [observability](), [telemetry](), [datacenter](), [Security](), [sensitive data](), [audit](), [configuration]() Tags: [analytics](), [audit](), [cisco](), [cisco-nexus-dashboard](), [configuration](), [data-center](), [data-center-networking](), [network](), [nexus-one](), [observability](), [real-time](), [sensitive-data](), [splunk](), [troubleshooting]() ### AI overview Cisco describes native Splunk embedded in Cisco Nexus Dashboard as an on-premises analytics and observability capability for data center and AI workloads. It processes telemetry locally, correlates network, security, configuration, and audit data, and provides dashboards, searches, and alerts for troubleshooting, data sovereignty, compliance, and cost efficiency. ### Source excerpt Discover how native Splunk embedded in Cisco Nexus Dashboard delivers real-time analytics, faster troubleshooting, and on-premises data sovereignty for modern data center and AI workloads. ## Cisco integrates Axis devices, bringing unified management across IT environments DevFeed: [Cisco integrates Axis devices, bringing unified management across IT environments]() Original publisher: [Read original article]() Author: Jonathan Cohn Published: 2026-09-16T15:00:57Z Content type: release Language: en Sources: [Cisco Blogs]() Topics: [Cisco](), [Cisco Meraki](), [Security](), [dashboards](), [Network](), [Cloud](), [Internet of things]() Tags: [analytics](), [cisco](), [cisco-cloud-control](), [cisco-meraki](), [cisco-networking](), [cloud](), [communications](), [infrastructure](), [internet-of-things](), [networking](), [security]() ### AI overview Cisco announces an integration with Axis Communications that brings network and physical security management into its cloud-managed ecosystem. The article describes Cisco Meraki dashboard management, shared visibility, and potential operational benefits for IT and physical security teams. ### Source excerpt Cisco and Axis Communications are committed to bridging the gap between IT and physical security infrastructure, as we believe that close collaboration between these teams leads to a stronger, more comprehensive security strategy. ## Arduino announces a live build of a privacy-focused smart doorbell on the Arduino UNO Q DevFeed: [Arduino announces a live build of a privacy-focused smart doorbell on the Arduino UNO Q]() Original publisher: [Read original article]() Author: Arduino Team Published: 2026-09-16T14:06:15Z Content type: article Language: en Sources: [Arduino Blog]() Topics: [Arduino](), [Computer vision](), [Security]() Tags: [arduino](), [computer-vision](), [model](), [notify](), [privacy](), [security](), [smart-doorbell](), [uno-q]() ### AI overview Arduino announces a live build showing how to create a smart doorbell using a computer vision model that runs locally on an Arduino UNO Q board. The event is scheduled for September 22 at 3 PM CET / 9 AM ET and will include questions for the Arduino team. ### Source excerpt Go on your favorite online shopping platform, and you'll find any number of smart doorbell options. Click to purchase, have it delivered, install it, download some app. But where's the fun in that? And also, don't you wonder how that thing works? That thing that watches you and your loved ones go in and out, [...] The post Build your own smart doorbell and protect your privacy - in one hour, with Massimo Banzi appeared first on Arduino Blog. ## Security updates for Wednesday DevFeed: [Security updates for Wednesday]() Original publisher: [Read original article]() Author: corbet Published: 2026-09-16T13:40:53Z Content type: news Language: en Sources: [LWN.net]() Topics: [Security](), [Linux](), [nginx](), [openssl](), [Python](), [OpenSSH]() Tags: [debian](), [linux](), [nginx](), [openssh](), [openssl](), [python](), [security](), [updates]() ### AI overview Security updates were issued by AlmaLinux, Debian, Fedora, Oracle, Red Hat, SUSE, and Ubuntu for packages including kernels, nginx, OpenSSL, Python, Perl, Git, Docker, OpenSSH, and other software. ### Source excerpt Security updates have been issued by AlmaLinux (kernel, kernel-rt, libkcapi, nginx, nginx:1.24, openssl, osbuild-composer, perl, perl:5.32, python-tornado, rsync, and rust), Debian (cjose and nginx), Fedora (environment-modules, erlang, GitPython, knot, perl-Authen-SASL, python-configargparse, ruby, rubygems, and sblim-sfcb), Oracle (firefox, git-lfs, gstreamer1-plugins-base, kernel, libkcapi, nginx, nginx:1.26, openssl, osbuild-composer, perl, perl-YAML-Syck, postgresql18, python-tornado, and rust), Red Hat (fence-agents, git-lfs, microcode_ctl, osbuild-composer, podman, python-pyasn1, and resource-agents), SUSE (389-ds, ant, bson-devel, chirp-20260911, docker, gimp, google-cloud-sap-agent, hauler, kernel, kimi-code, libpcap, python-GitPython, python310, syncthing, yast2-samba-client, and zstd-jni), and Ubuntu (aom, imagemagick, kitty, openssh, phpseclib, policykit-1, python-sql, python-webob, shibboleth-sp, simplesamlphp, snapcast, srt, and suricata-update). ## AMD Sends Out Linux Patches For Enabling SEV-TIO TDISP With PCIe 6.0 DevFeed: [AMD Sends Out Linux Patches For Enabling SEV-TIO TDISP With PCIe 6.0]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-16T13:02:52Z Content type: news Language: en Sources: [Phoronix]() Topics: [Linux Kernel](), [pcie](), [trusted-execution-environment](), [Confidential Computing](), [virtualization](), [Security](), [Encryption](), [MERN]() Tags: [amd](), [arm](), [attestation](), [confidential-computing](), [cpu](), [desktop-linux](), [encryption](), [intel](), [kernel](), [linux](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-kernel](), [linux-performance](), [linux-server-benchmarks](), [open-source-graphics](), [pcie](), [phoronix](), [phoronix-test-suite](), [processors](), [risc-v](), [security](), [ubuntu-benchmarks](), [ubuntu-hardware]() ### AI overview AMD submitted 17 Linux kernel patches to enable SEV-TIO TDISP for PCIe 6.0 and newer. The work is intended to secure direct I/O device assignment for confidential-computing environments, including AMD Secure Encrypted Virtualization guest VMs, and includes a common TEE Security Manager developed with Intel, Arm, and RISC-V. ### Source excerpt The newest Linux kernel patches out of AMD for enhancing the upstream support with the new AMD EPYC 9006 "Venice" processors is for enabling SEV-TIO TDISP that is supported with PCI Express 6.0 and beyond... ## Constraining AI agents with Red Hat AI: Containment, identity, and governance DevFeed: [Constraining AI agents with Red Hat AI: Containment, identity, and governance]() Original publisher: [Read original article]() Author: Grace Ableidinger Published: 2026-09-16T13:01:59Z Content type: tutorial Language: en Sources: [Red Hat](), [Red Hat Developer]() Topics: [Artificial Intelligence](), [Security](), [Zero Trust](), [Containers](), [Kubernetes](), [Architecture & Design]() Tags: [ai](), [ai-agents](), [containers](), [deployment](), [kubernetes](), [prompt-injection](), [security](), [trust]() ### AI overview This tutorial explains how to secure AI agents running on Red Hat OpenShift using containment, verifiable identity, and governance. It covers namespace isolation, quotas, sandboxing, workload identity, and admission control, with OpenClaw used in the demo. ### Source excerpt When an agent process runs on your laptop, it typically inherits anything your user has access to. Often this includes the full network stack, the file system, and the credentials sitting in memory. When integrating with GitHub, Slack, or a cloud provider, you could be one faulty permission or well-crafted prompt injection away from a security incident. The post Constraining AI agents with Red Hat AI: Containment, identity, and governance appeared first on Red Hat Developer. ## Cloud Sovereignty, Provider Risk, and Migration Options for EU Companies DevFeed: [Cloud Sovereignty, Provider Risk, and Migration Options for EU Companies]() Original publisher: [Read original article]() Author: Adam Gordon Bell Published: 2026-09-16T13:00:00Z Content type: opinion Language: en Sources: [Pulumi]() Topics: [Cloud](), [migration](), [pulumi](), [Security](), [scaleway](), [Tooling]() Tags: [aws](), [azure](), [cloud](), [customers](), [kubernetes](), [migration](), [platform-engineering](), [pulumi](), [scaleway](), [security]() ### AI overview This recorded discussion examines cloud sovereignty, legal and cost concerns for EU companies using major US cloud providers, and the practical tradeoffs of moving to European providers. Three guests discuss provider exposure, encryption and account shutdown risks, migration costs, and whether Pulumi and agentic infrastructure can make future moves easier. ### Source excerpt Recorded September 3, 2026. Quotes are lightly edited for clarity. Maybe this sounds familiar. You run infrastructure at a company that isn't American. Your workloads are on AWS, Azure, or Google Cloud, probably more than one, because that is what everyone picked. Until recently nobody asked you where the data lives or who can reach it. Now you're getting questions. Legal wants to know what NIS2 means for where your systems run. Someone on the leadership team read that the US government locked the cloud accounts of judges at the International Criminal Court and wants to know if that could happen to you. Finance wants to know why the bill went up again. A customer's security review asked, in writing, which country your data sits in. So now you have questions of your own: If a US court or agency wants my data, can they get it from my provider without involving me? Does putting everything in an EU region change that? The big providers now sell "sovereign cloud" in Europe. Is that different, or a rename? If I encrypt everything and hold the keys myself, am I covered? Could my account be switched off one day? What would I do? Are Hetzner, OVH, and Scaleway usable for real workloads? How much cheaper are they once you count the migration? What should I be building on now so I can leave later if I need to? A migration like this used to be a multi-year project. Does Pulumi and agentic infrastructure change that? Is any of this worth the disruption, or should I leave what works alone? I put those questions to three people who have each dealt with this for real. One of them helps EU companies work out their exposure and builds the tooling to leave. Another has spent fifteen years sizing what cloud actually costs, and thinks most people should stay put. The third moved his company off AWS and onto a European provider. They don't agree on how big the risk is. The full hour is below. Don't just default to the hyperscalers Waldemar Kindler co-founded Think Ahead Technologies, whe [Next page]()