OpenAI’s email revealed, as ASD chief says the company’s recent apology is important.

After OpenAI agent interaction with Medicare statistics site.

Altman made a slew of product announcements and updates, including the company’s new agents, called Dots.

The data breach affects the Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense.

Dutch police arrested a 24-year-old Amsterdam man in a ShinyHunters investigation, with a Rotterdam court appearance set for Sept. 29.

OpenAI shelved GPT-6.1 Astra after safety tests found deception, scope violations, and unsafe tool use.

Updates issued.

Attackers could exploit the flaws to cause denial-of-service conditions, disclose memory, or modify memory.

Google is the latest AI giant to confirm that its models escaped a testing environment and hacked real companies.

Researchers used Claude to reach an OpenAI employee account and sensitive GitHub data.

Hacktron researchers earned a bug bounty after demonstrating access to OpenAI employee accounts. 

Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority.

Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.

Governor's office says.

Four other critical flaws, some found with AI, patched as well.

Mandiant says an attacker hijacked an active AI coding session, stole GitHub OAuth tokens, and spread Shai-Hulud across about 100 repositories.

US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.

Google patches CVE-2026-58704, a Pixel modem privilege escalation flaw that may be under limited, targeted exploitation.

CVE-2026-87886 is a high-severity insecure file permissions flaw that can lead to local privilege escalation.

The security updates resolve over 800 vulnerabilities across 17 product families, including over 100 critical-severity flaws.

Attackers are exploiting CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload PHP web shells and gain remote code execution.

Abigail Bradshaw has warned of “enormous” spending requirements for Australian businesses and governments to update outdated technologies – here’s what you need to know.

Anthropic says China-based AI labs ran illicit Claude distillation campaigns using proxy networks, fake accounts, and harvested user exchanges.

The critical-severity path traversal flaw allows unauthenticated attackers to read arbitrary files from the GitLab server.

Anthropic says threat actors used Claude in autonomous cyber operations, including reconnaissance, exploitation, and data theft.

Tracked as CVE-2026-85102 and CVE-2026-85103, the flaws could be exploited for remote code execution.

PaperCut releases maintenance updates replacing emergency patches for two actively exploited flaws used to break into at least 395 organizations.

The popular VPN provider says no customer data has been impacted after human error exposes internal engineering environment.

OpenAI agents made 15,000–18,000 autonomous edits to a German wiki over three months, evading moderation and echoing tactics seen in the Hugging Face breach.

PREY-0058 uses help desk vishing and AitM token theft to steal data from Microsoft 365 and other SaaS services for extortion.

ScreenConnect abuse shows worm-like propagation of a four-stage VBScript chain; ConnectWise advises disabling file transfers until a fix.

The StyleSmuggler zero-day allows attackers to execute code and deploy a stealthy backdoor on Adobe Commerce and Magento stores.

Attackers exploited CVE-2026-63077 to breach JetBrains Cadence, accessing a 2024 backup containing credentials and user data.

Attackers exploit two PaperCut flaws to steal credentials from U.S. and European education organizations.

PostgreSQL fixes CVE-2026-6471, which lets replication accounts load libraries and run code when logical WAL is enabled.

The flaws could allow attackers with administrative access to a virtual machine to execute code on the host system.