Technology

On September 17, 2026, the FDA approved Fayuvi, a one-time gene therapy from Ultragenyx, as the first treatment designed to alter the course of Sanfilippo syndrome type A in pediatric patients who previously had no options beyond symptom management. Clinical evidence supporting approval came from 17 patients in an open-label, single-arm study compared against an external natural-history cohort, not a randomized controlled trial. The therapy carries a U.S. list price of $3.95 million and comes with postmarketing requirements including a companion diagnostic study due by 2029.

On September 14, 2026, an attacker used a hardcoded, full-permission Cloudflare API key found in Brevo's source code to deploy a malicious Cloudflare Worker that modified scripts served to Brevo's own pages and an estimated 100,000-plus customer sites for roughly four hours. The Worker delivered two payloads: a ClickFix overlay that tricked visitors into running a malicious command, and a hidden WordPress plugin designed to backdoor sites run by administrator-level users. Brevo removed the Worker and revoked the key within the same day, but operators using Brevo's embedded components are advised to audit their WordPress installations for unauthorized plugins, as Brevo's remediation does not confirm whether customer sites were successfully backdoored.

A Dragon spacecraft oxidizer leak detected in late August pushed the four-person Crew-13 ISS mission from a September 12 target to an early October window, with NASA confirming a valve replacement and crew quarantine underway as of September 17. No exact launch date has been set, and final testing and readiness reviews have not yet been confirmed complete. Crew-12, aboard the station since February 14, is scheduled to depart only after Crew-13 arrives and completes a handover period.

Rocket Lab launched its 96th Electron mission on September 19, 2026, placing Synspective's 12th StriX synthetic aperture radar satellite into a 572-kilometre low Earth orbit. The deployment brings Synspective to 12 of its planned 30-satellite constellation, intended for disaster response, defense, and environmental monitoring applications. A 13th Synspective launch aboard Electron is scheduled for no earlier than September 26, 2026, targeting a 559-kilometre orbit.

Multiple actors have been chaining CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory instances since mid-August 2026, gaining unauthenticated administrator access and deploying backdoors including a custom Rust implant. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on September 11, setting a September 25 remediation deadline for federal agencies. Wiz Research estimates that roughly 59 to 62 percent of Artifactory deployments remained unpatched weeks after initial disclosure, and self-hosted users should upgrade to the fixed builds specified in JFrog's advisory.