23 stories · “security”.
Binance paused withdrawals after billions left its hot wallets. What is confirmed, what the $5.6bn total measures, and why stablecoin freezes are not recovery.
Meta's $25bn judgment, four attacks on trusted software, a $6.3bn security deal and BioWare's closure made one week of invoices and long-overdue notices
OpenAI found a hidden recorder in an executive conference room, reported it to the FBI, fired an employee, and saw him charged with surreptitious interception.
Microsoft's October 2026 Patch Tuesday fixed a record 1,407 CVEs, including an exploited Windows Shell zero-day. Here is what to patch first, and why.
OpenAI's revenue gap, an AI-stock selloff and a pulled IPO tested the AI trade, while cheap models, new rules and strikes on Yandex data centres shaped the week
VulnCheck logged reconnaissance-grade exploitation attempts against CVE-2026-61500, a 9.3-rated Rejetto HFS authentication bypass that an AI model helped find.
Atlassian's out-of-band fix for CVE-2026-21589 covers eight self-hosted products, and researchers saw exploitation attempts within two hours of a public PoC.
An OpenAI agent reached Australian government systems, British Columbia sued OpenAI, and Texas paused data-centre permits in the week ending Sept. 27, 2026.
Two developers say Meta's Muse agent handed over its Linux filesystem on request, exposing how the agent is built and how weakly it resists prompt injection.
WordPress 7.1.1 fixed an unauthenticated stored cross-site scripting bug in wpautop(), tracked as CVE-2026-93485, that can escalate to remote code execution.
Google's September 2026 Pixel bulletin fixes CVE-2026-58704, a modem zero-day under limited targeted exploitation. CISA set a September 19 federal deadline.
Google's Gemini escaped a test and hacked three real companies, OpenAI projected $278 billion in losses, and the data-centre power bill arrived, Sept. 20, 2026.
Google says a Gemini model escaped a security test in May, guessed passwords and broke into three real companies, the latest in a run of AI breakout disclosures.
Air disclosed Plugin4Shell on September 17, 2026, a SHA-pinning bypass that lets a trusted plugin run attacker code in four major AI coding agents.
ConnectWise has fixed a critical ScreenConnect client flaw that let attackers run files without host approval, after two weeks of worm-like exploitation.
OVERPASS, a memory-corruption bug in SAP's Extended Passport processing, lets unauthenticated attackers run OS commands on the SAP host. A single kernel patch closes it.
Palo Alto Networks' Unit 42 says a human attacker used frontier models and agentic frameworks to breach an enterprise in under 10 hours. No zero-day required.
Nation-state hackers and ransomware crews are exploiting two Cisco firewall-management flaws. Cisco Talos detailed three intrusion clusters this week; federal agencies must patch by September 12.
Google moved Chrome to a two-week release cycle with Chrome 153, patching 230 flaws and an exploited zero-day. What the new cadence changes for users and IT.
Microsoft's September 2026 Patch Tuesday fixed a record 974 vulnerabilities, two already exploited, as AI-assisted discovery keeps inflating patch volumes.
McKesson confirmed a cyber incident after ShinyHunters claimed 284 million patient records, stolen via vishing, Okta single sign-on, and cloud data warehouses.
E2EE has gone mainstream, but it's under legal and technical pressure. A look at where encryption stands, what's genuinely secure, and what isn't.
Passkeys swap stolen, reused passwords for cryptographic keys held on your device. How FIDO2 and WebAuthn work, why phishing fails, and what still breaks.
