Apache

NVIDIA has introduced the Open Agent Safety Platform, pairing the Apache 2.0-licensed OpenShell with Sentry running on BlueField-4 hardware, aiming to isolate AI agents at the kernel level and provide a hardware-based kill switch. More than 100 partners are on the launch list. Security commentators are debating whether such containment can stop agents capable of faking their own logs.

Poland is set to become a servicing hub for Apache helicopter engines, with an agreement now ready and reported as signed or near-final. The move supports Poland's broader military modernisation and its large planned fleet of US-made Apache attack helicopters. Commenters note it deepens defence cooperation between Poland and the United States.

Columnar Tech has published a blog post asking what it would look like if Java worked natively with Apache Arrow, the columnar in-memory data format widely used in analytics. The piece explores how tighter integration between the JVM ecosystem and Arrow's memory model could change data engineering, and it is drawing attention from developers interested in faster data processing.

ChooseALicense.com, a reference site for picking an open source license, is being shared among Linux and open source enthusiasts. The site walks developers through license options such as MIT, GPL and Apache, helping them choose terms for releasing code. It is being passed around in free software communities as a handy resource for projects deciding how to license their work.

A vulnerability tracked as EUVD-2026-91568 has been disclosed in Apache Thrift, the Apache Software Foundation's cross-language RPC framework. The flaw, an infinite loop with an unreachable exit condition in the Python bindings, carries a CVSS v3.1 score of 8.2. Details on affected versions remain incomplete pending an update from the vendor.

A high-severity vulnerability, EUVD-2026-91569, has been catalogued affecting the Lua bindings of Apache Thrift, the cross-language RPC framework maintained by the Apache Software Foundation. The flaw, scored 8.2 out of 10 under CVSS v3.1, involves allocation of resources without limits or throttling combined with inefficient algorithmic complexity, which could allow denial-of-service conditions. The advisory was updated on 2 October 2026.

Tencent has open-sourced its large Hy4 770B-parameter AI model under the permissive Apache 2.0 license, while also introducing IQuest-Q1, a much smaller 15B-parameter model aimed at more accessible use. Thai-language tech commentary is highlighting the release, noting the combination of a very large open model and a lightweight companion option for developers.

Las Vegas Metropolitan Police are searching for a suspect in an armed robbery of a business on South Fort Apache Road. Officers responded to the report and are working to identify and locate the person responsible. No further details about injuries, the business involved, or the suspect's description have been released.

The Apache Software Foundation has released HTTP Server 2.4.69, a maintenance update that fixes 20 security vulnerabilities in the widely used open-source web server. Admins are being urged to update their installations promptly, as the web server powers a large share of websites worldwide and unpatched flaws can expose servers to attack.

A vulnerability tracked as EUVD-2026-90762 has been recorded for Apache Camel Quarkus, the Apache Software Foundation's Quarkus extensions for Camel. The flaw, rated 8.6 out of 10 under CVSS v3.1, involves improper restriction of XML external entity references in the XSLT support extension (camel-quarkus-support-xalan). Such issues can allow attackers to read files or make requests from affected systems. The record was updated on 1 October 2026, and security teams are being urged to check whether their deployments use the affected extension.

A vulnerability tracked as EUVD-2026-91330 has been catalogued affecting the Lua component of Apache Thrift, the open-source RPC framework maintained by the Apache Software Foundation. The flaw, scored 8.7 out of 10 under CVSS v3.1, involves allocation of resources without limits or throttling and improper handling of length parameter inconsistency, which could enable denial-of-service conditions.

Eleven judges from the Ninth Circuit Court of Appeals have urged the US Supreme Court to take up the Oak Flat case, backing protection for the sacred Apache site in Arizona threatened by a copper mining project. The rare show of judicial support adds pressure on the high court to hear Apache Stronghold's challenge after lower courts refused to block the land transfer.

A new vulnerability, EUVD-2026-90892, has been recorded for the Apache HTTP Server, maintained by the Apache Software Foundation. The flaw involves missing authentication checks in the mod_auth_digest module in versions before 2.4.69, potentially allowing unauthenticated access. Users are advised to update to a patched release. The entry was updated on 1 October 2026.

A medium-severity vulnerability, EUVD-2026-90763, has been catalogued in Apache APISIX, the open-source API gateway maintained by the Apache Software Foundation. Rated 5.7 out of 10 under CVSS v3.1, the flaw involves the insertion of sensitive information into log files, with unmasked header values potentially being written in cleartext.

Security researchers have disclosed eight vulnerabilities in Apache MINA SSHD, the Java library for SSH connections, that together can allow authentication bypass. The flaws, tracked under CVE identifiers including CVE-2026-94052, CVE-2026-94053 and CVE-2026-77185, affect applications embedding the library. Administrators are urged to upgrade their Java applications promptly to patched versions.

A weather observation from Apache Junction, Arizona, recorded at 05:00, shows 68°F with a high of 72°F and low of 68°F, humidity at 91%, light northeast winds easing to calm, and a waning moon at 92%. Conditions are mild and humid for the Arizona desert, with no solar radiation or UV before dawn.

A cybersecurity observer has published a profile of IP address 103.63.101.24, hosted on Indonesian network AS150273 in Jakarta, dubbing it 'the CVE broker of Jakarta'. The address is said to have launched five attacks targeting known flaws in ThinkPHP, PHPUnit's eval-stdin, and Apache path traversal vulnerabilities CVE-2021-41773 and CVE-2021-42013, using the libredtail-http user agent and encoded traversal sequences seeking a shell.