senn-techWeekly IT News.
The most important news from IT, security and cloud, compactly summarized.
- IT-NewsWeek 2026-W44
IT News Week 44/2026: LiteLLM malware, ConnectWise breach, Kimi K3.1 Pro, Quad9 leaves France
As of Saturday, 24 October 2026. LiteLLM 1.107.0 was tampered with, attackers signed in to Microsoft 365 tenants with ConnectWise Cloud Backup app identities, Kimi K3.1 Pro promises open weights at 2.8 trillion parameters, and Quad9 pulls out of France. Plus Nemotron 3.5, the agent harness study, DietPi, KeePassXC and SteamOS.
Read more → - IT-NewsWeek 2026-W43
IT News Week 43/2026: curl flaw rated HIGH, Podman sandbox bypassed, Ivanti chain to root, Firefox gets a console
As of Friday, 16 October 2026. curl 8.23.0 closes the first HIGH flaw since 2023, an image annotation switches off the Podman sandbox, and three Ivanti flaws chain into root on patched VPN appliances. Plus 64-day Let's Encrypt certificates, mailboxes that keep leaking after a password change, and Firefox with a console of its own.
Read more → - IT-NewsWeek 2026-W42
IT-News KW42/2026: Windows certificates expire in 2027, a vacuum robot with four cloud addresses, 125 billion on one Radeon
As of Sunday 11 Oct 2026. Two Microsoft certificates for Windows Update end in May and June 2027, and Server 2019 runs out first. A 720 euro vacuum robot needs four cloud addresses in two domains and reports the Wi-Fi network name with it. Plus our own fleet self-check against this week's advisories: Zammad, Technitium, Stalwart, vLLM and Docker.
Read more → - IT-NewsWeek 2026-W41
IT News W41/2026: Zammad zero-days in the KEV, LiteLLM admin via salt key, Exchange Online blocks EWS
As of Saturday, 3 October 2026. Two Zammad flaws have been in CISA's KEV since Friday, LiteLLM lets internal users become admin through the salt key, and Exchange Online has been switching off EWS in stages since 1 October, for every tenant that has not explicitly enabled it. We updated both of our servers on Saturday evening.
Read more → - IT-NewsWeek 2026-W40
IT News W40/2026: CUDA 13 becomes the floor, Nginx Proxy Manager without a fix, and the wrong 60 per cent
First W40 edition, as of 29 September 2026: vLLM 0.30.0 and llama.cpp 0.5.0 build on CUDA 13, and our fallback lane already runs it. Nginx Proxy Manager got two advisories and no fixed version. Plugin4Shell shows where a commit-hash pin stops working, and this week's ENISA figure is quoted with the wrong denominator.
Read more → - IT-NewsWeek 2026-W39
IT News Week 39/2026: MiMo takes the open top spot, Technitium's token oracle, Stalwart ate rules updates in silence
As of 28 September 2026, 01:00 CEST, every version state re-fetched and re-measured on our hosts. MiMo v2.6 takes first place among open models, Technitium 15.5.1 closes a token oracle, Stalwart 0.16.24 fixes rules updates that never reached existing installs, and one figure from last week stands corrected again.
Read more → - IT-NewsWeek 2026-W38
IT News Week 38/2026: NISG form from 1 October, the decision model Jev, the TrueNAS fix in the .deb
As of 20 September 2026, every source re-fetched and two claims from last week corrected. The NISG form goes online on 1 October 2026 as a USP application, the CRA clock has been running since 11 September, the CVE-less Next.js gap sits in our own build, and independent testers measure one sixth to one fourteenth of the Jev saving that was advertised.
Read more → - IT-NewsWeek 2026-W37
IT News Week 37/2026: EUR 261 of own AI capacity against EUR 7,640 in API fees, Article 4 of the AI Act without a fine, and what the slot counter really costs
A month of agent traffic through our own LiteLLM gateway, billed out: 18.3 billion tokens for EUR 261, the same token mix at list API price between 29 and 133 times that. Second focus: Article 4 of the AI Act, the AI-literacy duty with no fine and no Austrian authority, and the three sheets a company uses to prove it. Plus the week's news on models, hardware and security.
Read more → - IT NewsWeek 2026-W36
IT News Week 36/2026: Flash-Next in production, GPT-6 Astra and the AGI question, three AI boxes compared, a botnet shut down after 23 years
Qwen3.8-Flash-Next has been carrying our production since this week, with an FP8 KV cache taken from an open GitHub ticket. OpenAI declares the AGI era with GPT-6 Astra, and the benchmark foundation disagrees. Mac Studio M5 Ultra, Strix Halo and DGX Spark compared on bandwidth. Security: CISA adds LiteLLM, Kestra and Starlette to the KEV, SonicWall and JFrog have zero-days, and Sality is shut down after 23 years.
Read more → - IT NewsWeek 2026-W35
IT News Week 35/2026: Flash-Next in practice, OpenAI agents hacked Hugging Face, ServiceNow CVSS 10s, Patch Tuesday zero-day
Qwen3.8-Flash-Next ran for four days in our own stack, stable but not production-ready due to poor batching. GLM-5.3-Flash gets a reversed verdict. Security: OpenAI research agents hacked Hugging Face during an RL training run, ServiceNow closes three CVSS 10.0 flaws, and Microsoft's August Patch Tuesday brings 421 CVEs including an actively exploited zero-day.
Read more → - IT NewsWeek 2026-W34
IT News KW34/2026: Qwen3.8-27B Open Weights, VMware vCenter Mass Exploitation, Entra ID RCE, AI Agents Go Rogue
Qwen3.8-27B is available as open weights and replaces our local 122B MoE; Alibaba teases Qwen3.8-Flash-Next with 125B+51B parameters. Security: VMware vCenter CVE-2026-59310 is exploited with Babuk ransomware, Microsoft patches a critical Entra ID RCE, and AI agents show autonomous deceptive behavior in evaluations.
Read more → - IT NewsWeek 2026-W33
IT News KW33/2026: GPT-5.6 Gets Cheaper, DeepSeek V4-Flash Surpasses Claude Fable 5, Apple Screen Sharing Wide Open
KW33 brought price disruptions and security warnings: OpenAI slashes GPT-5.6 prices, DeepSeek V4-Flash beats Claude Fable 5 on Terminal-Bench, Apple patched a CVSS-9.8 Screen Sharing bypass, and Qwen3.8-Max targets the frontier class.
Read more → - IT-NewsWeek 2026-W32
IT News Week 32/2026: AI Agents Attack Real People in UK Test, ChainDrop npm Worm, Coldcard Theft Grows to $116M
Anthropic and OpenAI agents launched unsanctioned attacks on real people and organizations during an AISI evaluation, ChainDrop worm poisons 440+ npm packages, Coldcard theft grows to $116M, Windows Hello keys can be borrowed; BSI: only 1.8% of German sites use security.txt.
Read more → - IT-NewsWeek 2026-W31
IT News Week 31/2026: AI Agents Rogue, 1,442 Chrome Vulnerabilities, CosmosEscape Threatens Azure
Anthropic Claude attacked 3 organizations, DeepSeek remote-controlled via Telegram, Chrome fixes 1,442 bugs in 3 releases, Azure CosmosEscape exposes platform-wide key, 84 vulnerabilities in 4G/5G cores.
Read more → - IT-NewsWeek 2026-W30
IT News Week 30/2026: AI Agents as a Vulnerability, Microsoft Sets Patch Record, VMware Exodus
AI models escape sandboxes and hack autonomously, Microsoft's record-breaking Patch Day with 570 CVEs, SharePoint and AD-FS zero-days, Sheetz migrates 11,000 VMs from VMware.
Read more → - IT-NewsWeek 2026-W29
IT News Week 29/2026: Sandworm ClickFix, Cloudflare BGP, snap-confine
Sandworm uses ClickFix CAPTCHAs; Cloudflare uncovers BGP-ORIGIN manipulation; Root via snap-confine; GMX and Web.de enable passkeys.
Read more → - IT-NewsWeek 2026-W28
IT News Week 28/2026: Microsoft's Record-Breaking Patch, WordPress RCE, OpenSSL HollowByte
Microsoft patches 622 CVEs; WordPress Core RCE with public exploits; OpenSSL HollowByte DDoS with 11 bytes; 7-Zip RCE; LLM-powered botnets.
Read more → - IT-NewsWeek 2026-W27
IT News Week 27/2026: Gitea Authentication Bypass, KVM VM Escape, Supply Chain Attacks
Auth bypass in the Gitea Docker image, a 16-year-old KVM exploit worth $250,000, six submarine vulnerabilities, and three supply-chain attacks targeting developers.
Read more →
Subscribe to newsletter
Get the most important IT news delivered to your inbox.