Adobe issued an emergency hotfix for a maximum-severity flaw in Magento and Adobe Commerce that attackers have exploited since at least September 4 to install a hidden backdoor. Security firm Sansec found the malware disguised its command server as an NTP time server, though compromised sites still leaked telltale fake 'Payment Transaction Failed' emails. Adobe's fix, labeled VULN-39341, covers Adobe Commerce, Commerce B2B, and Magento Open Source across multiple version branches.
Enterprise software firms including Salesforce and Workday reported resilient financial performance even as investors sold off their shares over fears that AI would erode their business models. The disconnect suggests markets are pricing in disruption faster than it is actually materializing in company earnings.
A new Emacs package, maak.el, lets developers discover, inspect and run Maak tasks directly from the editor's minibuffer. Maak is a build and automation tool that replaces traditional Makefiles with GNU Guile Scheme, and the plugin adds completion support, argument prompting, and asynchronous execution through Emacs's native compile system.
Vivo executives confirmed the X500 series will debut in China on September 21, following the acclaimed X300 Pro and X300 Ultra. The lineup will add 4K/240fps recording, 4K HDR portrait video, and new preset and custom video color styles that can be shared between users, an upgrade over the X300 Ultra's photo-only sharing.
Grass Valley Police Department ended its contract with Flock Safety and removed the company's license plate cameras, but Flock reinstalled at least two of them without authorization weeks later. Flock says its automated maintenance system misread the city's early camera removal as an equipment failure, triggering repair crews to dispatch and replace units. GVPD says it continues to monitor for and remove any cameras Flock puts back up.
Google has rolled out Play Services version 26.35, which lets Android users tap their physical transit cards against an NFC-enabled phone to import the card and its balance into Google Wallet. The update also adds a redesigned 'Add a card' success screen and various account management and location-sharing improvements. Separately, Google Play Store version 53.1 introduces a new navigation bar and short feature descriptions in the 'Similar Apps' section.
Cleveland.com reporter Kaitlin Durbin says the outlet's AI-driven 'Express Desk' published a story about a Cuyahoga County official under her byline while she was on her honeymoon, though she never wrote or reviewed it. The story, unrelated to her prior work, was later corrected to remove her name after she publicly objected on X.
CipherCue analyzed 44,143 European companies with an identifiable content delivery network and found 39,547 of them, or 89.6%, run behind Cloudflare. Amazon's CloudFront trails far behind at 3,112 companies, followed by Fastly with 1,299 and Akamai with 396. The figures only cover firms that use a CDN at all, excluding those serving sites directly from their own servers.
BleepingComputer will host a live webinar on September 23, 2026, in partnership with Material Security, examining real, documented breaches of Google Workspace caused by forgotten third-party app permissions. Speakers Rajan Kapoor of Material Security and Rick Fitzgerald of Fireside Consulting will walk through case studies and outline which security controls matter most for fast-growing companies with limited resources.
George Lucas's long-delayed Museum of Narrative Art has opened after being shopped to three different cities over 16 years and costing roughly $1 billion to build. Early reviews of the museum, which houses Lucas's personal collection of illustration and film art, are decidedly mixed.
Samsung and TSMC, the world's two largest chipmakers, have confirmed plans to deploy ASML's High NA extreme ultraviolet lithography systems, machines that can cost roughly $400 million each and etch finer circuit patterns onto silicon wafers. Samsung plans to use the tools for DRAM production starting in 2028 and expand its scaling roadmap by 2030, while TSMC expects broader adoption driven by increasingly complex transistor designs needed for AI chips. Both companies join Intel as customers of the technology.
Google's Threat Intelligence Group reports that attackers are moving from simple AI-assisted coding to fully autonomous, multi-agent systems that plan and execute entire attacks with little human input. In one case, a financially motivated actor compromised cloud infrastructure and used an AI coding chatbot with markdown-based agent instructions to build and run a mass credential-harvesting operation in under six hours. Separately, researchers found an exposed command-and-control server running a framework called 'Recon' that autonomously managed reconnaissance and tens of thousands of harvested credentials.
GoKawiil