This week our own production takes centre stage: the model that was rated "stable, but not a production lane" in this slot seven days ago has been serving all our agent lanes since Thursday, and since Saturday at almost double the concurrency. Alongside that, OpenAI released GPT-6 Astra and declared the AGI era; the numbers behind it are more contradictory than the press release. Apple, AMD and NVIDIA are competing for the same buyers with three desktop boxes, and a botnet from 2003 was shut down without anyone seizing a server. In the security column, this week hits self-hosted AI infrastructure above all.

Deep dive: Qwen3.8-Flash-Next now carries production

Three detours in ten days

The route from rejection to production lane ran through a self-built hybrid checkpoint of an FP8 n-gram table and NVFP4 experts, a faulty measurement with empty weights that classified a working backend as broken, and a request backlog whose cause turned out to be a slot cap of 3. With flashinfer_cutlass and expert parallelism the model delivers 205 tokens/s across 32 concurrent streams, where the dense 27B saturated at 172. Details in the full post.

The patch from the issue tracker

As shipped, the model's KV cache requires BF16, which at 192,000 tokens of context allowed only 3.2 concurrent full sessions on four RTX 5090s. An RFC in the vLLM repository opened on 30 August provided a working FP8 patch, measured on exactly one DGX Spark, with a request for confirmation on other hardware. On our side: the KV pool went from 614,478 to 1,139,662 tokens, 5.94 full sessions, identical VRAM, identical results in needle, tool-call and parallel tests. Two pull requests for the same feature are now open.

Assessment: Community code on a development build, temperature 0 is not deterministic, and the large correctness battery has never been run. Still the right call, because throughput per card is what decides here and the way back has three steps of six and a half minutes each.

Deep dive: GPT-6 Astra, and who gets to declare the AGI era

99.9 or 62.7 percent

OpenAI released GPT-6 Astra on 3 September at 10 and 50 US dollars per million tokens, 2.5 times its predecessor. President Greg Brockman closed the briefing with "Welcome to the AGI era", while the blog post itself does not contain the word. The headline number, 99.9 percent on ARC-AGI-3, comes from OpenAI's own provider harness; the ARC Prize Foundation measures 62.71 percent in the standard harness and states explicitly that it is not claiming Astra is AGI. On the Artificial Analysis Intelligence Index the model sits at 61.2 points, level with GPT-5.6 Sol and behind Claude Fable 5.1. The full post has all the tables.

The other side

Astra is the first model rated "Critical" for cybersecurity under OpenAI's own Preparedness Framework, it found two unknown zero-days in V8 during testing, and its chain of thought is harder to monitor than its predecessor's, according to the system card.

Assessment: The jump from 7.8 to 62.7 percent in the standard harness is real. For a mid-sized company little changes: anyone who needs the top tier pays 75 percent more per task, and anyone processing ERP or banking data stays local anyway, because OpenAI runs monitoring classifiers alongside this model class in production.

Deep dive: Mac Studio M5 Ultra, Strix Halo, DGX Spark

One column decides

Apple ships the Mac Studio with M5 Ultra from 22 September: 1,200 GB/s of memory bandwidth, 96 to 512 GB. DGX Spark has 273 GB/s, Ryzen AI Max+ 395 a nominal 256 and a measured 180 or so during decode. Generating text is bound by exactly that number: on the DGX Spark a dense 32B model delivers 10.7 tokens/s, a 30B MoE with 3 billion active parameters 89.3, at the same quantization. During prefill the picture reverses and CUDA is ahead of Apple. The full post has the measurements, the price per gigabyte and the successor, the Ryzen AI Max+ PRO 495 with 192 GB, on show at IFA.

The M5 Ultra has not been measured anywhere yet; all Apple figures come from the M5 Max in the MacBook Pro. (Quelle: Apple tech specs, NVIDIA, measurement by lhl (llm-tracker.info))

Assessment: Capacity is cheapest from AMD at around 30 euros per GB, bandwidth cheapest from Apple. The Strix Halo price advantage has shrunk in this year's memory market: NVIDIA put 700 US dollars on the Spark, and Framework has nearly doubled the Desktop since launch. None of the three boxes replaces a four-card rig, but any of them is enough for a workstation running MoE models.

Deep dive: Sality, 23 years old, shut down by peer poisoning

No server, no arrest

On 31 August, US authorities together with Europol, CrowdStrike, Shadowserver and police forces from Bulgaria, Hungary and Romania took down the Sality botnet, which has been running since 2003 and has touched 11 million IP addresses over the years. The method: the peer-to-peer protocol trusts anyone who speaks it, and as a file infector it cannot be updated without splitting its own network. The defenders pushed legitimate super peers out of the lists and let sinkholes move up in their place. The full post explains the mechanism.

Assessment: For sysadmins one line remains: UDP traffic to the address 188.166.101.148 is a confirmed infection, according to CrowdStrike. The takedown removes nothing, and affected hosts need rebuilding. The real question is which Windows island on your own network would have reported this at all.

Deep dive: CISA adds self-hosted AI infrastructure to the KEV

LiteLLM, Kestra, Starlette

On 2 September, CISA added seven flaws to its catalogue of actively exploited vulnerabilities, three of which hit self-operated AI stacks. CVE-2026-59822 in LiteLLM (CVSS 8.8): the MCP endpoint accepted a forged Authorization header and fell back to an empty permission, giving access to every configured tool without a valid key, fixed in 1.84.0. CVE-2026-49869 in Kestra (CVSS 10.0): a suffix comparison in the authentication filter let through any path ending in the segment configs, which with script plugins enabled means code execution as root in the worker. CVE-2026-48710 in Starlette is being chained into unauthenticated code execution against LiteLLM gateways, according to Microsoft; observed payloads include crypto miners, theft of provider keys from process environments, and persistence via SSH keys. On top of that, heise reports more than 350 attack attempts against Langflow instances through a flaw patched back in January.

Our own estate checked

Our LiteLLM gateway runs on image 1.89.4, so it is past the fix, and it has no MCP servers configured. We do not run Kestra or Langflow. Not affected, checked on 6 September.

Assessment: Three of the six security items this week concern the orchestration layer of self-hosted AI itself. Anyone running a gateway should treat it like an identity system: virtual keys with limits instead of a master key, outbound traffic on an allowlist only, and the version number belongs in the weekly review.

Digest: Other important news

Security

SonicWall SMA1000: two zero-days, one at CVSS 10.0: CVE-2026-83548 (unauthenticated SSRF) and CVE-2026-83549 (command injection in the management console) chain into code execution without a login. Affected models are the SMA1000 6210, 7210 and 8200v, patched from hotfix 12.4.3-03526 and 12.5.0-02952. SonicWall confirms one exploited case, and Shadowserver counts more than 400 exposed devices according to BleepingComputer. In the KEV since 2 September.
JFrog Artifactory: admin takeover without a login: CVE-2026-82329 (CVSS 9.8) grants full administrator rights from the network in the default configuration. The patch landed on 28 August, and four days later attackers were already issuing themselves admin tokens. Cloud customers are covered, self-hosted instances have to update.
Chrome: sixth exploited zero-day of the year: CVE-2026-85046 is a type confusion in the V8 compiler with read and write access to the JavaScript heap. Fixed in Chrome 152.0.7977.82, shipped on 3 September, in the KEV since 4 September.
PaperCut NG/MF: second emergency patch: CVE-2026-81578 and CVE-2026-82078 add up to unauthenticated code execution on print servers. The first patch of 27 August could be bypassed, and "release 2" followed on 29 August. Anyone who installed only the first one is not protected. Both in the KEV since 31 August.
PostgreSQL: replication privilege becomes code execution: CVE-2026-6471 (CVSS 7.2) has been in the code since logical decoding arrived in version 9.4. An account with REPLICATION can load arbitrary output plugins and thereby run code as the database operating-system user. Fixed in 18.6, 17.11, 16.15, 15.19 and 14.24 via the new output_plugin_libraries parameter; the technical write-up appeared this week, per The Hacker News. Anyone who has handed out replication roles for CDC should review them.

Hardware

NVIDIA RTX Spark: Windows PCs with N1X from October: At IFA, NVIDIA confirmed the launch of RTX Spark machines with a 20-core Grace CPU, Blackwell GPU and up to 128 GB of unified memory. Alongside them comes PAIR, an open-source router that spreads inference requests across several machines on the LAN, plus up to 1.9 times the llama.cpp throughput on the RTX 5090 from new drivers, according to NVIDIA. No prices were given.
Gutted RTX 5090s without chips sold in Germany: 1,800 euros for a board with the GPU and memory professionally desoldered off it. Anyone buying used cards for inference should check before the transfer, not after.
Acer Vero 16: a repairable notebook: The only procurement-relevant item among Acer's IFA announcements: the battery and SSD can be swapped without tool acrobatics, and damaged case parts replaced.

AI & Business

Anthropic Claude Fable 5.1 and Mythos 5.1: List prices unchanged at 10 and 50 US dollars, while cache reads drop from 1.00 to 0.25 US dollars per million tokens, which Anthropic puts at up to 45 percent savings on agentic workloads. Mythos 5.1 is the same model with relaxed safeguards, available only through vetted access programmes.
Cognition heading for a round at a 47 billion valuation: The maker of Devin is reportedly raising around one billion US dollars, per Bloomberg, against a 26 billion valuation back in May. Annualized revenue is above 900 million. Not closed as of press time.
Flex buys EPC Power for 4.4 billion US dollars: EPC builds the power converters for the 800-volt DC supply in modern GPU racks. Power conversion is turning from a side item into a bottleneck for the AI build-out.

Infrastructure and open source

Amazon Linux 2027 in preview: Kernel 7.1, SELinux in enforcing mode by default, DNF5, all packages built with LTO, and x86-64 packages targeting x86-64-v3, meaning AVX2 as a minimum, according to Phoronix. Older hardware drops out.
pnpm 12 rewritten entirely in Rust: Installs up to 90 percent faster, lockfile format compatible. For build pipelines it is an update with no migration work.
Home Assistant 2026.9: The activity log shows the full trigger chain behind a change, Matter gains a network map with signal strengths, and Modbus devices from Fronius and Sofar can be set up without YAML.
Wine 11.17: First support for display-mode emulation and VKD3D 2.1 for Direct3D 12 over Vulkan.
WordStar runs again, in the browser too: A DOSBox package for Linux, macOS and Windows plus a WebAssembly build. Nothing to act on, but a good reason to see the keyboard shortcuts of 1979 one more time.

From the blog

Qwen3.8-Flash-Next in production — how a community patch doubled the KV cache on 4× RTX 5090.
GPT-6 Astra: 99.9 percent on ARC-AGI-3 — and why the benchmark foundation still does not say AGI.
Mac Studio M5 Ultra, Strix Halo or DGX Spark — which box really makes local language models fast.
Sality: shut down after 23 years — a botnet from 2003, taken apart through its own protocol.
Qwen3.8-Flash-Next, four days in — the back story from last week.

Compiled on 7 September 2026. Sources: OpenAI, ARC Prize Foundation, Artificial Analysis, Apple, NVIDIA, Europol, CrowdStrike, CISA, Microsoft Security, Rapid7, BleepingComputer, Help Net Security, heise online, The Hacker News, PostgreSQL, AWS, Phoronix, The Register, Hackaday, GitHub (vLLM).

IT News Week 36/2026: Flash-Next in production, GPT-6 Astra and the AGI question, three AI boxes compared, a botnet shut down after 23 years