A multi-institution research effort combined brain tissue samples from the Mount Sinai NIH Neurobiobank, the NIMH-IRP Human Brain Collection Core, and the Rush Alzheimer's Disease Center to create a harmonized dataset spanning over 1,400 samples. The team standardized clinical measures such as neuritic plaque density (CERAD scores) and cognitive impairment ratings across the different cohorts, alongside demographic and technical variables like age, sex, ancestry and postmortem interval, to enable consistent single-cell transcriptomic analysis of brain disorders.
nature.com
· 2026-09-23
Security researchers have identified a high-severity vulnerability in WordPress that carries a CVSS score of 9.2 out of 10, indicating it can be exploited with relatively low complexity and minimal attacker privileges. The flaw has reportedly existed in every version of the platform released since 2016, meaning it has gone undetected or unpatched for nearly a decade.
github.com
· 2026-09-22
Meta has patched a serious security vulnerability found in its Muse AI assistant. The flaw could have let attackers seize control of Muse and exploit its permissions to access a user's connected apps and devices.
gizmodo.com
· 2026-09-22
Security researcher Patrick Wardle discovered that any app or Terminal command running on a Mac could silently alter undocumented settings in Meta's new Muse AI agent without requiring special macOS permissions. One affected setting, endo_voyager_dictation_endpoint, determines where a user's dictated voice prompts are transmitted, meaning an attacker could reroute that data elsewhere. The flaw surfaced just weeks after Meta heavily promoted Muse's security architecture, including a dedicated Secure VM, a monitoring system called Sentinel, and bug bounties up to $300,000.
9to5mac.com
· 2026-09-22
Security researcher Patrick Wardle found an unpatched setting in Meta's Muse macOS app that let local attackers reroute the app's cloud-based dictation to their own server, effectively seizing control of the AI agent. Wardle demonstrated the flaw by using Muse's own privileges to snap photos and write files to disk, often without alerting the user. Meta issued a hotfix within hours of the report, though it maintains the exploit required existing local access and posed low real-world risk.
theverge.com
· 2026-09-22
Security researchers discovered that Meta's new macOS AI assistant Muse contains a vulnerability allowing any locally installed app or terminal command to access the authentication token tied to a user's Muse account, bypassing Apple's built-in permission protections. The flaw also lets outside processes alter numerous undocumented settings, some of which could grant deeper control over connected accounts like WhatsApp, email and calendars. Separately, Amazon has begun blocking Muse from its platform.
arstechnica.com
· 2026-09-21
Researcher Paulos Yibelo of pwn.ai disclosed a WordPress Core vulnerability, called Click2Shell, that chains a cross-site request forgery bug with the theme Customizer preview to achieve remote PHP execution. The flaw lets an attacker trick a logged-in administrator into visiting a malicious link, silently installing a theme from the WordPress.org catalog and running arbitrary PHP through the Customizer preview even before activation. WordPress fixed the issue in version 7.1.1 after it was reported in late August.
bleepingcomputer.com
· 2026-09-21
The FBI published CJIS Security Policy version 6.1 on June 25, 2026, refining the modernized control-based framework introduced in v6.0 last December. The update raises required encryption key strength from 128-bit to 256-bit for CJI both in transit and at rest, and increases mandatory vulnerability scanning frequency from quarterly to monthly.
bleepingcomputer.com
· 2026-09-21
Security researchers at Hacktron identified a class of vulnerabilities, dubbed HEIF Heist, affecting native decoders like libheif and libde265 that process HEIF, HEIC, and AVIF image formats. These libraries are widely bundled inside popular tools such as ImageMagick, libvips, and Sharp, meaning the flaw can reach production systems through indirect dependencies rather than direct use.
heif-heist.com
· 2026-09-18
Helpfeel-operated screenshot service Gyazo confirmed that attackers exploited a server flaw on September 11, 2026 to access its database and steal roughly 23.62 million user records. The company detected the intrusion the following day, patched the vulnerability, and has taken the platform offline for maintenance while investigating. Exposed data varies by account but can include names, emails, password hashes, session and device IDs, SSO tokens, billing details, and usage statistics, alongside 490 million image metadata records.
bleepingcomputer.com
· 2026-09-18
Security researchers at HacktronAI combined a flaw in the libheif image decoder used by ImageMagick with an SSO identity issue on OpenAI's Discourse-based community forum to gain remote code execution and admin access on community.openai.com. Using that foothold, they took over multiple OpenAI employees' ChatGPT and Codex accounts and, to prove access without touching sensitive data, opened a pull request in OpenAI's internal monorepo. The whole process from discovery to internal repo access took under 72 hours.
hacktron.ai
· 2026-09-18
CISA announced it will stop publishing its weekly vulnerability summary bulletins starting Sept. 28, directing organizations instead to its Known Exploited Vulnerabilities catalog, security advisories, and vendor alerts. The agency says the change reflects its push for risk-based vulnerability prioritization rather than relying on severity scores alone, amid a surge in disclosed vulnerabilities partly driven by AI-assisted flaw hunting.
darkreading.com
· 2026-09-17
GoKawiil