OpenAI's wandering AI agents earn it a California subpoena
Plus: Attorneys-general say investigators should have direct access to AI companies' records when things go wrong
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats
Noteworthy stories that might have slipped under the radar: Kiteworks patches over 100 vulnerabilities, Microsoft publishes 2026 Digital Defense Report, AI finds 24 Android app fla…
The EDR blind spot: 3 ways browser attacks evade endpoint telemetry
Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways att…
Vulnerability Backlogs Are an Ownership Problem
Organizations don't need better vulnerability scanners; they need to know who owns their assets, and who has the authority and capacity to actually fix them.
Power approval set to delay Oracle's Wisconsin AI datacenter
Grid connection awaits regulatory approval, putting planned 2027 customer delivery at risk
IBM’s Bob wants to move in: Agent available for on-prem deployment
Bob, IBM’s agentic software development platform is now available to run on premises and in private clouds, sovereign clouds, and air-gapped environments to give users more control…
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
The dropper “carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime. The post macOS Users Targeted by Fake Zoom Inst…
OpenAI shows three staff the door over alleged information misuse
Two safety researchers and a program manager dismissed, company denies retaliation for raising concerns
Nvidia debuts $4,999 DGX Spark with half the RAM and storage, amid memory crunch
Meanwhile 128 GB version jumps to $6,950, nearly 75% above its launch price
Malicious Linux Implants Mimic Asian Mail Security Products
A trio of newly discovered backdoors walk and quack like legitimate edge solutions, so it's hard to tell they're not.
Dell asks admins to patch max severity CSM flaws as soon as possible
Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. [...]
Excel Canvas offers to turn your workbook into the boss's next report
Copilot builds charts and metrics from spreadsheet data, with automatic refreshes when the numbers change
OpenAI Parts Ways With Three Safety Researchers Over Sensitive Information Mishandling
OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street Journal reported. "We have par…
Crypto Scammers Hijack Microsoft’s Official X Account
Hackers used the account, which has 13 million followers, to amplify a Clippy-themed cryptocurrency account. The post Crypto Scammers Hijack Microsoft’s Official X Account appeared…
Teen suspected of running KillSec ransomware group as cops seize servers, arrest three
Operation KillSwitch takes over leak site holding at least 110 TB of stolen data
Why CISOs Struggle to Answer the Board's Three Hardest Questions, and How to Fix the Report
The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the E…
Once a $35 computer, the 2 GB Raspberry Pi 4 now costs $67.50
Pi 5 also gets a $12.50 bump as customers urged to consider older models or less RAM
In Rare Move, Alleged Iranian State Hacker Extradited to US
Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad. The post In Rar…
How American Political Campaigns Are Using AI—and What They’re Spending on the Tools
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian. New campaign finance disclosure data shines a light on which US political campaigns are usin…
Fortinet sounds the alarm over actively exploited FortiMail zero-day
No login required, exploitation underway, and some admins are still waiting for patches
UK spending watchdog opens investigation into Capita's pension fiasco
Outsourcer admits service remains below expectations after missed recovery deadline
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025. The post Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks ap…
Microsoft’s X account hacked in crypto pump-and-dump scheme
On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto t…
Met Police suspends use of phone-hacking software over Russian links
Scotland Yard hits pause after US prosecutors trace supposedly American tech back to Moscow
$6T in annual AI revenue needed to pay off data center investments
Hyperscalers are rushing to build more data centers to run AI workloads — but will the AI industry ever generate enough revenue to pay for that infrastructure? Researchers at B…
AI Agents Aimed SQL Injection at US and Canadian Government Sites
The attacks targeted the US Department of Education and Library and Archives Canada, and researchers linked some agents to OpenAI. The post AI Agents Aimed SQL Injection at US and …
Flight delayed? So are these codec updates
A slice of Bolivian bork at Alcantarí International Airport
Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system. The post Exploited Fortinet FortiMail Zero-Da…
Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools
Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protecti…
Techie was stung by a wasp, held overnight by Chinese police, then trapped in a 13-hour meeting
Sales calls can be even nastier than support calls