Tech radar: week 38 of 2026
14–20 Sep 2026
In the week of 14–20 Sep 2026, 13 notable open-source releases shipped (including Tauri tauri v2.11.6, OpenAI Python SDK v3.16.0, Anthropic Python SDK v1.7.0), CISA added 7 vulnerabilities to its Known Exploited Vulnerabilities catalog, and the most discussed developer story on Hacker News was “Show HN: An e-ink frame that hears birds and draws them as 1800s illustrations” (2391 points).
Releases worth knowing about
Mobile & desktop
<summary<em<h4Cargo Audit</h4</em</summarymentions security
Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-downlo
AI & machine learning
api: add webhook endpoint management (3892) (9a11f6e)
api: add group with displayname to rate limits, deprecate grouptype (28f0a83)
Cloud & DevOps
- 15609 1f070c8 Thanks @emily-shen! - Build Containers when emitting experimental Build Output
Update urgency: SECURITY: There are security fixes in the release.mentions security
https://code.visualstudio.com/updates/v1138
What's new highlightsmentions security
Languages & runtimes
\[d414624dce] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) 65553mentions security
Web frameworks
See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.mdv840
[12.x] Default memoryExceededExitCode for Cloud by @jackbayliss in https://github.com/laravel/framework/pull/61432
Testing & security tools
Changelog: https://docs.cypress.io/app/references/changelog16-1-0
Actively exploited vulnerabilities
Added to the CISA Known Exploited Vulnerabilities (KEV) catalog this week: 7.
| CVE | Product | Weakness | Added |
|---|---|---|---|
| CVE-2026-87886 | Acronis Backup | Acronis Backup Incorrect Default Permissions Vulnerability | 2026-09-16 |
| CVE-2026-76460 | Cisco Identity Services Engine | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | 2026-09-16 |
| CVE-2026-76461 | Cisco Secure Email Gateway | Cisco Secure Email Gateway SQL Injection Vulnerability | 2026-09-14 |
| CVE-2026-58704 | Google Pixel | Google Pixel Improper Authorization Vulnerability | 2026-09-16 |
| CVE-2025-39964 | Linux Kernel | Linux Kernel Race Condition Vulnerability | 2026-09-18 |
| CVE-2026-53266 | Linux Kernel | Linux Kernel Out-of-Bounds Write Vulnerability | 2026-09-18 |
| CVE-2025-39682 | Linux Kernel | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability | 2026-09-18 |
Need help patching or assessing exposure? See our cybersecurity and DevOps services.
What developers discussed
The most upvoted technology stories on Hacker News during the week.
- 01Show HN: An e-ink frame that hears birds and draws them as 1800s illustrations2391 points · 267 comments · 2026-09-15
- 02Introducing System One Models and Jev1989 points · 520 comments · 2026-09-15
- 03AI-generated posters don’t have to be horrible1902 points · 962 comments · 2026-09-19
- 04I built non-autoregressive decision models with RL a year ago1363 points · 319 comments · 2026-09-19
- 05Android 17 is the first since 3.x to add new APIs without releasing to the AOSP1180 points · 724 comments · 2026-09-18
- 06I can't stop thinking about Papua New Guinea1160 points · 489 comments · 2026-09-15
- 07Nvidia announces native GPU programming in Rust970 points · 404 comments · 2026-09-16
- 0825 years of mass surveillance is enough964 points · 358 comments · 2026-09-15
- 09Microsoft exec called AI scraping 'the largest theft of labor in human history'955 points · 841 comments · 2026-09-18
- 10I don't like passkeys853 points · 819 comments · 2026-09-18
- 11Cloudflare Quick Tunnels844 points · 316 comments · 2026-09-18
- 12XCancel service is suspended until further notice771 points · 1055 comments · 2026-09-14
How this is made. Compiled automatically from GitHub releases API, Hacker News (Algolia search API), CISA Known Exploited Vulnerabilities catalog. Releases cover about 60 widely used projects and include minor/major versions and any release mentioning a security fix. It is a digest, not a complete list: it can miss things. Always check the linked source before acting.