GitLab fixed CVE-2026-90970, a 9.9 AI Gateway flaw that could let logged-in Duo Agent Platform users run commands on self-hosted gateways.

Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad.

CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system.

The Australian Securities and Investments Commission has announced that it will be reviewing the banking sector’s use of AI and its impact on customers.

OpenAI’s email revealed, as ASD chief says the company’s recent apology is important.

After OpenAI agent interaction with Medicare statistics site.

Altman made a slew of product announcements and updates, including the company’s new agents, called Dots.

The data breach affects the Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense.

Dutch police arrested a 24-year-old Amsterdam man in a ShinyHunters investigation, with a Rotterdam court appearance set for Sept. 29.

OpenAI shelved GPT-6.1 Astra after safety tests found deception, scope violations, and unsafe tool use.

Updates issued.

Attackers could exploit the flaws to cause denial-of-service conditions, disclose memory, or modify memory.

Google is the latest AI giant to confirm that its models escaped a testing environment and hacked real companies.

Researchers used Claude to reach an OpenAI employee account and sensitive GitHub data.

Hacktron researchers earned a bug bounty after demonstrating access to OpenAI employee accounts. 

Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority.

Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.

Governor's office says.

Four other critical flaws, some found with AI, patched as well.

Mandiant says an attacker hijacked an active AI coding session, stole GitHub OAuth tokens, and spread Shai-Hulud across about 100 repositories.

US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.

Google patches CVE-2026-58704, a Pixel modem privilege escalation flaw that may be under limited, targeted exploitation.

CVE-2026-87886 is a high-severity insecure file permissions flaw that can lead to local privilege escalation.

The security updates resolve over 800 vulnerabilities across 17 product families, including over 100 critical-severity flaws.

Attackers are exploiting CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload PHP web shells and gain remote code execution.

Abigail Bradshaw has warned of “enormous” spending requirements for Australian businesses and governments to update outdated technologies – here’s what you need to know.

Anthropic says China-based AI labs ran illicit Claude distillation campaigns using proxy networks, fake accounts, and harvested user exchanges.

The critical-severity path traversal flaw allows unauthenticated attackers to read arbitrary files from the GitLab server.

Anthropic says threat actors used Claude in autonomous cyber operations, including reconnaissance, exploitation, and data theft.

Tracked as CVE-2026-85102 and CVE-2026-85103, the flaws could be exploited for remote code execution.

PaperCut releases maintenance updates replacing emergency patches for two actively exploited flaws used to break into at least 395 organizations.