Three numbers from this issue, and the one we would act on first:

3 lines of bash. Enough for a container to read and write your whole Mac filesystem through Docker VMM (CVE-2026-77179). Docker Desktop 4.88.0 fixes it, before VMM becomes the default at the end of October.

Under 100 MB/s. What a single S3 request delivers, says Viktor Leis, and every S3-based system you run is built around that ceiling.

7.5 hours. Salesforce's outage during Dreamforce, which started at a legacy login server.

Also inside: RustFS 1.0 as an Apache 2.0 option next to MinIO, one EventBridge bus for every AWS account, and a GitHub Actions quiz.

RustFS 1.0.0, an object store written in Rust that speaks the Amazon S3 API, became generally available on 16 September 2026 under Apache 2.0. It covers erasure coding, replication, IAM with OIDC, KMS encryption and an Iceberg REST catalog, and its maker says the core engine is ready for production. The quick start ships with rustfsadmin as both keys, which must be changed before real use. It lands while the open source MinIO repository is archived and marked as no longer maintained.

AWS added an enhanced custom event bus to Amazon EventBridge on 24 September 2026, shared across every account of an AWS organization through Resource Access Manager. Events with the same EventGroupId arrive in order for subscribers that ask for it, and a new Subscriber resource bundles filter, target, retries and dead-letter queue. Billing moves to per GB ingested and delivered, with each event rounded up to 1 KB. Existing buses keep working, and CloudFormation manages the new one under a separate AWS::EventsV2 namespace.