Patch Now, Plan Later: JFrog RCE in the Wild, Arista Advisories Incoming, and the Homelab Projects You Keep Skipping

A critical JFrog Artifactory exploit is already being weaponized, Arista is giving customers a rare heads-up before dropping a wave of CVEs, and your homelab's boring infrastructure debt isn't going to fix itself.

JFrog Artifactory CVE-2026-82329 Is Being Actively Exploited — Patch It Today

Stop reading and go check your Artifactory version right now. CVE-2026-82329 is confirmed exploited in the wild, and given that Artifactory sits at the heart of build and artifact workflows for a huge swath of dev and DevOps shops, the blast radius here is significant.

SOCRadar's writeup flags that the affected version range straddles a branch boundary, which means administrators running builds that look like they're on a safe minor version may still be exposed if they haven't pulled the specific patched build. That's the kind of detail that gets people burned. Don't assume your version string is clean, verify against JFrog's official advisory directly.

The attack surface is your artifact repository. A foothold there means an attacker isn't just reading files; they're potentially poisoning your build artifacts and everything downstream of them. Supply chain compromise via a compromised Artifactory instance is a realistic, documented threat pattern.

What to do: Pull the exact build number from your Artifactory instance, cross-reference it with JFrog's current advisory, and patch immediately. Can't patch right now? Restrict network access to your Artifactory instance to trusted internal hosts only until you can.

Arista Is Warning You Before the Advisories Drop, Take the Hint

Arista Networks did something unusual this week: they proactively told customers that multiple security advisories for Arista EOS and VeloCloud are coming next week. No embargo-busting, no surprise Friday afternoon dump, just a heads-up so you can prepare.

That's actually good vendor behavior, and you should reward it by actually preparing. Running Arista EOS in your environment, and plenty of Upstate SC enterprise and campus networks are, means now is the time to get your change management tickets drafted, your maintenance windows identified, and your upgrade paths validated in a lab or staging environment before the advisories go public.

The VeloCloud callout matters too. SD-WAN deployments have a way of being "set and forget" in a lot of shops, which means patch cadence slips. Dig up your current version and make sure you have a path to upgrade on short notice.

AI-generated code is cited as a driver of the elevated advisory volume. More code shipped faster means more vulnerabilities discovered faster. That trend isn't reversing, so if your patching process for network OS is still ad hoc, this is a good week to fix that process too.

What to do: Subscribe to Arista's security advisories directly if you haven't already, and block time next week to review and act on whatever drops.

Your Homelab's Infrastructure Debt Is Costing You More Than You Think

How to Geek dropped a timely reminder this weekend about the unglamorous infrastructure projects that keep a homelab actually useful versus just impressive-looking in a rack diagram. The framing is a September push to knock out the stuff that's been on the list since spring.

These projects tend to fall into a few buckets: proper network segmentation and VLAN cleanup, backup verification (not just "I have backups" but "I have tested, working backups"), and documentation that reflects what your lab actually looks like today rather than what you built two years ago.

One from personal experience: a homelab that doubles as a security research or Ubiquiti testing environment carries real risk to your production home network when segmentation is sloppy. A misconfigured UniFi policy or a forgotten firewall rule in a lab VLAN has a way of becoming a problem at the worst possible moment.

The documentation piece is underrated. When something breaks at 11pm, having accurate network diagrams and a current inventory of what's running where is the difference between a 20-minute fix and a two-hour archaeology project.

What to do: Pick one of the three, segmentation, backup verification, or documentation, and commit to finishing it before Sunday night. One done beats three planned.

Tencent Drops a 770B Open-Source Model, And It's Actually Aimed at Productivity

Tencent released the Hy4 preview this week, a 770-billion-parameter open-source LLM targeting coding assistance, office productivity, and scientific research tasks. At 770B parameters, this is a serious model, not a lightweight local inference toy, but the open-source release means the research community and well-resourced self-hosters can get their hands on it.

For most readers here, running Hy4 locally is out of reach without serious GPU infrastructure. The release still matters, though. It's another data point in the ongoing compression of the gap between frontier closed models and what's available open-source. Tencent's explicit focus on coding and productivity tasks rather than general chat also makes this interesting for developer tooling, expect fine-tuned derivatives to start appearing quickly.

Running a local AI stack, Ollama, LM Studio, or a custom inference setup? Keep an eye on quantized versions of Hy4 derivatives over the next few weeks. The 770B base won't run on consumer hardware, but Q4 or Q5 quantizations of smaller fine-tunes built on this architecture might.

What to do: Bookmark the Hugging Face organization page for Tencent's Hy4 releases and watch for community quantizations if local inference is your thing.

HPE Networking Investor Day on September 30, Here's What to Actually Watch For

HPE has scheduled a Networking Investor Day webcast for September 30. Investor days are usually financial theater, but this one has a technical angle worth tracking. The timing follows HPE and Oracle announcing a deeper networking collaboration aimed at gigawatt-scale AI infrastructure, a signal that HPE is positioning its networking portfolio squarely in the AI data center buildout narrative.

For network engineers, investor days occasionally surface product roadmap direction that doesn't make it into official documentation for months. HPE dropping specifics about where Aruba and their campus/data center switching lines are heading, particularly around AI fabric architectures or automation tooling, is worth knowing before it shows up in a sales pitch.

The Oracle collaboration angle is interesting for anyone running hybrid environments. Gigawatt-scale AI infrastructure requires rethinking spine-leaf topologies, power delivery, and east-west traffic patterns at a scale most of us won't operate, but the architectural patterns that emerge there tend to trickle down into enterprise design guidance within 18 months.

What to do: Register for the webcast if HPE gear is in your current or future stack. Skip it if you're Ubiquiti-only, there's nothing here that changes your week.