This week brought two kinds of news. One is a date fixed for years and still overlooked: signatures expire on a day nobody in the building thinks about. The other is a 720 euro device that needs somebody else's servers to work. Both can be measured before anything breaks. This week we did.

Deep Dive: Expiry dates that hit our infrastructure in 2027

Two Windows certificates, two dates in 2027

Microsoft rotates the Windows Update signing schemes on a cadence invisible until a client stops getting through. Two dates sit in our calendar: 17 May 2027 and 19 June 2027. Windows 10 client images at the 14 October 2025 state and Server 2019 machines in the fleet face the shorter deadline first, because extended support for Windows 10 ends only on 9 January 2029 while the certificates come earlier. Deadlines by operating system, including the affected WSUS path, are in Windows update: two certificates expire in 2027.

Two numbers from our own SIEM make that actionable. Between 7 and 11 September 2026 we counted 12,728 relevant events across 100 hosts, 97 reporting Windows. Of these, 8,918 events carried no operating system field, so a large share stays unassigned. LTSC 2019 and LTSC 2021 also cannot be cleanly told apart in the data. Managing dates like these starts with the fields, then the deadline.

OneDrive and SharePoint: tempauth URLs gone by April 2027

The second expiry trail is newer and hits automation. Microsoft is retiring temporarily authorized download URLs, deadline 1 April 2027. For us that is a line item in backup operations: our M365 console works with tempauth addresses, the download path falls back to /content with a token, and the restore site has three calls without a fallback. Deadline and affected calls are in OneDrive and SharePoint: tempauth URLs disappear.

Assessment: Expiry dates are an inventory topic, not a patching topic. Whoever has not linked the certificate and tempauth deadlines to a host list carrying at least operating system and version will hear about it in 2027, the first time an update or a backup stops going through. That list takes three days to build; a backup job that must run without a token is a rebuild.

Deep Dive: Compute we pay for ourselves

A 125 billion parameter agent on a 2020 graphics card

We measured the numbers around Niko1221/Strata ourselves rather than adopting them. As of 11 October 2026: created 24 September 2026, last pushed 11 October at 14:37:54 UTC, 21,461 stars, 2,021 forks, 690 open issues and merge requests combined, MIT license, version 0.1.43. The claim that a 125 billion parameter model runs at 50 to 60 tokens per second on an AMD Radeon RX 6800 with 16 GB comes from the repository itself. We did not measure it on our own RX 6800 and its methodology is missing. We can back up the substance of the project, and that such a number on a card of this class is a statement. Strata: a 125B agent on an RX 6800 keeps those two levels apart.

Inference under Proxmox: VM or container

The second set of numbers comes from our own operation. GPU inference under Proxmox: what LXC actually buys over a VM compares both modes on our hosts, including the passthrough trap, testable only on nodes with a passed-through card. It pairs with Two GB300 stations, two 400G copper cables at the other end of the rack and Two vLLM cache flaws in self-hosted operation for the running system.

Assessment: A foreign number is no reason to re-equip a card we already own. The useful first step is asking what inference costs us in GPU terms with a container in front instead of a VM; that answer is cheaper for hardware planning than any benchmark.

Deep Dive: Consumer hardware on the network

A 720 euro vacuum robot and four addresses

I bought an Ecovacs DEEBOT X12 OmniCyclone for private use, 720 euro, two days before delivery. Behind the purchase sat one question: what does such a device actually do on a home network. Measured in A vacuum robot on the network: what the Ecovacs X12 reports.

The price first, because it makes the discussion honest. The vendor's shop lists 999.00 euro, struck-through retail price 1,399.00 euro. The Austrian comparison on the evening of 11 October 2026 at 21:24 showed a best price of 698.82 euro across 20 offers and minus 22 percent over thirty days. So 720 euro is a good price, not a bargain below market; comparing it against 1,399 euro would be a number game.

The network question is the more interesting one, and answerable before delivery: the library for exactly these robots is open source. An Austrian account yields four targets: portal-eu.ecouser.net, gl-at-api.ecovacs.com, gl-at-openapi.ecovacs.com and, as persistent connection, mq-eu.ecouser.net. The constant names the login domain ecouser.net rather than ecovacs.com, so a filter on the company name misses most traffic. A user agent claims to be an Android phone.

The vendor's privacy policy, current as of 24 November 2025, names Wi-Fi network name and Wi-Fi password among collected fields, plus the working environment map. The camera is conditional: a photo of an unknown object goes to China only if unknown-object detection is enabled and the customer joined the product improvement program. That condition belongs with the sentence.

Three more findings from the same research: the public vulnerability database lists 16 entries for this vendor, none of the fetched texts mentioning the X12. Valetudo, the tool that cuts other manufacturers' vacuums loose from the cloud, does not list Ecovacs anywhere on its supported list. In July 2026 the community reported error code 1013 with a hint to install a newer version, after the vendor began requiring a different server-side check; issue #176484 in home-assistant/core is titled "1013 Error, Change within EcovacsAPI?".

Assessment: Anyone letting consumer hardware onto a network should first find those four names in the DNS log, then know what still works without the cloud. A device that needs someone else's MQTT broker for control commands is as dependent as a service in a data centre, only without your own emergency mode. That question is cheaper before the purchase than after.

Digest: Other important news

Security

CISA adds five flaws Catalog of 8 October 2026: five entries of that day, remediation due 11 October, CVE-2015-3306 (ProFTPD), CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts), CVE-2021-3199 (ONLYOFFICE Docs), CVE-2023-22894 (Strapi). | verified
Flax Typhoon exploits these flaws CISA, FBI and NSA warn with AT, CA, JP, NZ, ES and UK partners; three of the eight abused flaws, Shellshock among them, stood in the catalog before. | reported
Zammad 7.2.1 and 7.2.2 in two days The first closes the two-factor bypass in the verification workflow, the second on 8 October the root escalation in the DEB and RPM packages (CVE-2026-102490, CISA catalog since 2 October). | verified
LMCache flaw stays unpatched CVE-2026-105192, CVSS 9.8, pickle deserialisation on the unauthenticated ZeroMQ port 5555 of multiprocess mode, as root in official containers. Affected 0.3.9 to 0.5.5, no fix, countermeasure: bind the port non-routably. | reported
Docker Engine 29.9.0 and the Go note Go 1.26.9 fixes five daemon CVEs, four of them HTTP/2 attacks on daemon and BuildKit gRPC, plus cleartext in an encrypted overlay network after failed key programming. Out 8 October. | verified
Graylog advisory after four weeks Delegating user management opened rights up to admin, users:create sufficed. Fixed in 7.1.9 and 7.0.13, advisory of 5 October. | verified

Regulation

WKO overview of the NISG 2026 deadline plan Dated 6 October 2026, the chain: NISG in force since 1 October 2026, registration by 1 January 2027, self-declaration by 1 October 2027, independent audit report by 30 September 2030. The same page gives 31 December 2026 for registration, the USP editors 1 January 2027. That gap is worth knowing. | verified
BSI announces a NIS 2 enforcement push Department head Timo Hauschild promises direct approaches to unregistered entities in Q4 2026, a hearing before the fine, audits by order from Q1 2027. Nothing of it on bsi.bund.de. | reported
BSI on the CRA duties Safe presets at shipping, free updates over a period stated in advance. Reporting duties since 11 September 2026, most provisions from 11 December 2027, the update span as a buying criterion. | verified
Austria's right to repair in force Since 1 October 2026 the warranty runs three years instead of two. Afterwards the maker stays obligable to repair phones, washing machines and dishwashers at a reasonable price, with guideline prices openly listed. The AK faults the bare EU minimum. | verified

AI and development

vLLM 0.31.0 with preloaded weights 717 commits, 307 contributors, out 5 October 06:44 UTC. vllm preload keeps post-quantised weights in GPU memory across restarts, NVFP4 KV the new SM100 standard. Fast kernels cover SM100 and SM103 (GB200, GB300), skip our RTX 5090 (SM120). Breaking: fp8_per_tensor for online FP8, tokenizer_mode="slow" gone, --swap-space deprecated. | verified
DeepSeek-V4.1-Flash: fivefold agent throughput 890 bytes of KV per token in FP4, NVFP4 KV 45% smaller than FP8, up to 5.3 times throughput under 150 tokens per second. Measured by the vendor on SemiAnalysis AgentX with GB300 and GB200 NVL72, no re-measurement on our 5090 class. | vendor measurement
llama.cpp b11556: 27B on 16 GB Mainline support for Prism Bonsai 2 27B: PTQ1_0 at 5.95 GB against 53.81 GB at F16, measured via the hub API, weights in place since 16 September. The first ternary 27B stage on one 16 GB card. | verified

Hardware

DDR5 at five times the price in a year Micron adds some 256% revenue year over year and roughly $85 billion net profit in fiscal 2026, the fabs allocated to AI orders. | reported
PC shipments down more than 20% in Q3 IDC says minus 20.1%, Omdia minus 21.2% on 58.1 million systems. RAM and SSD rose per Omdia from some 15% to near 40% of component cost at several times the former level, Q4 expected minus 24%. | reported
TrendForce: memory eats the laptop budget CPU, DRAM and SSD came to some 68% of material cost on a 900 US dollar list-price laptop in Q3 2026. Fabrication outside China drops from 24% (2025) to under 20% (2027). | verified

Consumer hardware

Synology neo+ prices, non-ECC RAM only DS725neo+ €549, DS925neo+ €599, DS1525neo+ €899, DS1825neo+ €1,099, net RRP, and reaction to the memory market: only non-ECC RAM ships now. | verified
Memory costs twice the chassis The MS-A2 barebone stands at €839, the 64 GB DDR5-5600 kit inside at €1,118.93, together €2,295.93; Deskmodder logged 88.9 °C at most under stress-ng. | reported
devolo WiFi 7 BE9300 from €249.90 Tri-band router with 2.5 Gbit WAN, mesh pair €479.90, trio €699.90. | verified
MikroTik SSH flaw exploited actively CVE-2026-67279, CVSS 6.9, in the CISA catalog since 25 September, moves the SSH server into logged-in state during a rekey without logging in. Fixed in 6.49.21, 7.23.4, 7.24.2. | verified
FritzOS 8.50 on the second Fritzbox AVM frees the Glasfaser 5630 build after the 7690, with a network-wide DNS filter against ads and malicious domains in home and guest network. The 8.40 lab starts at 7510, 6860 5G, 6860 5G v2. | reported

Software releases

Next.js 16.4.0 Out 7 October at 10:03, with waitForAllReady as the new name of the static-generation stream option, resolveAlias: false for Turbopack, historical snapshots in the bundle analyzer, 82 commits on the branch since. | verified
Stalwart v0.16.26 against rewriting The blob eater is in the fixed block: garbage collection rewrote every stored blob at each compaction of the blobs column, roughly every 128 MB of new mail. Out 11 October, no security entry. | verified
Technitium DNS 15.6.1 Changelog dated 11 October 2026. Operator-relevant: a cache fix for a negative answer served against a CNAME already in cache, double IXFR deletions against Microsoft DNS, lost NOTIFY with a secondary down. | verified

Self-check: where this hits us

I measured this week's advisories against our own estate on Sunday evening.

Zammad runs 7.2.0-0011 here (image tag on the host, measured 11 October 2026). The first of this week's two releases reaches us, the two-factor bypass sits in the verification workflow. The 7.2.2 root escalation is limited in the advisory to the packager.io DEB and RPM packages, Docker is exempt and we run Docker. We move up regardless, 7.2.1 catches us.
vLLM runs vllm/vllm-openai:v0.30.0, the code_revision execution fix sits only in 0.31.0. The advisory condition holds here: embed-fallback on the GPU host starts with --trust-remote-code, vllm-27b-standby on the same image doesn't.
LMCache is installed on none of our inference hosts (Python path of the two GPU hosts searched). The unpatched CVSS 9.8 flaw misses us.
Docker on the mail host is 26.1.5+dfsg1 from the Ubuntu package stock, so the Docker Engine note of 8 October reaches us through distribution packages rather than a repository of ours.
Technitium DNS runs 15.4.0 here (image tag on dns1), so the 15.6 fixes of 3 October aren't rolled out here.
Nothing with security content came from Proxmox VE, Proxmox Backup Server, LINSTOR or DRBD in this window. Stalwart v0.16.25 and v0.16.26 are pure bugfixes, Metabase 0.63.19.6 of 9 October likewise.

From the blog

Sixteen posts this week, each checked on Sunday morning for HTTP 200 and index, follow:

Sources of this edition

Every address was reachable on 11 October 2026, and the evidence behind the blog posts is given in each of those posts. The version levels of our own systems (Zammad, Technitium, Stalwart, Metabase, vLLM, Docker) were read from the hosts on the same day, and the price comparison for the vacuum robot at 21:24.

CISA KEV, Flax Typhoon, Zammad 7.2.2 with GHSA-p97w-927q-8vxq and GHSA-f3qr-94c2-7mx2, JFrog on LMCache, Docker 29.9.0, the Graylog advisory
WKO on the NISG 2026, USP on applying NIS2 services, Tagesspiegel Background, the BSI on the CRA, ORF on the right to repair
vLLM v0.31.0, the vLLM blog on DeepSeek-V4.1-Flash, llama.cpp b11556, the Strata repository, Microsoft on the certificate rotation of 2027, the Graph API on driveItem download
Geizhals price comparison for the X12, the privacy policy of the manufacturer, the vulnerability database query for that manufacturer, the Valetudo support list, issue #176484 in home-assistant/core
heise, igorslab, TrendForce, stadt-bremerhaven, Deskmodder, ComputerBase, security-insider and BleepingComputer, plus the release notes and changelogs of Next.js, Stalwart and Technitium as linked above

Compiled on Sunday, 11.10.2026. Whatever arrives after that goes into the next edition.

IT-News KW42/2026: Windows certificates expire in 2027, a vacuum robot with four cloud addresses, 125 billion on one Radeon