OpenAI disclosed that its newly deployed GPT-6 Astra model is the first widely released system to hit the 'Critical' threshold in the company's Preparedness Framework for cybersecurity, meaning it can autonomously find and exploit zero-day vulnerabilities in hardened systems. In testing, Astra reportedly uncovered two previously unknown real-world vulnerabilities, which OpenAI says it is now disclosing to the affected software maintainers. The company added new safeguards including stronger jailbreak resistance and monitoring, and says Astra shows fewer safety violations than its predecessor, GPT-5.6 Sol.
bleepingcomputer.com
· 2026-09-08
Security firm Sansec has detected active exploitation of an unpatched vulnerability, dubbed StyleSmuggler, affecting all versions of Magento and Adobe Commerce. Attackers inject PHP code through the platform's template system by triggering a fake failed-payment email, which then installs a Rust-based backdoor disguised as a legitimate Linux process and sets up a cron job for persistence. Adobe has confirmed it is working on a patch but has not given a release date.
bleepingcomputer.com
· 2026-09-07
Google released Chrome version 152.0.7977.82/.83 to fix a high-severity zero-day flaw, CVE-2026-85046, a type confusion bug in the V8 JavaScript engine that is already being exploited in the wild. The update also patches 11 other vulnerabilities, including use-after-free and out-of-bounds memory issues across several Chrome components.
bleepingcomputer.com
· 2026-09-04
Zscaler reported fiscal fourth-quarter adjusted earnings of $1.19 per share on revenue of $898 million, topping Wall Street forecasts of $1.09 and $877 million respectively. Revenue climbed 25% year-over-year, and annual recurring revenue reached $3.77 billion, while the company's net loss narrowed to $3.4 million from $17.6 million a year earlier. CEO Jay Chaudhry credited demand for the company's Zero Trust cloud security architecture, including a new version built for AI agents, for the strong results.
cnbc.com
· 2026-09-03
A sponsored analysis argues that traditional SEO metrics like rankings and click-through rates no longer capture how consumers actually find brands, since AI tools now generate synthesized answers directly on screen instead of sending users to websites. The piece introduces 'pixel depth' as a way to measure how prominently a brand appears within an AI-generated answer, rather than its position on a search results page. It also notes that large language models extract and recombine facts from multiple sources rather than indexing whole pages, meaning a company's website is just one input among many.
venturebeat.com
· 2026-09-03
Star Wars Zero Company has earned strong reviews and an 85 Metacritic score for its X-COM-style tactics gameplay and story, but many players report severe technical problems including traversal stutter, input lag, crashes, and a bug that forced a mission restart. Nearly 9,000 Steam reviews rate it 'mostly positive' overall, yet a large share of them describe frequent crashes and performance issues, with complaints also surfacing from console players and even high-end PC owners.
engadget.com
· 2026-09-02
SonicWall has warned that attackers are chaining two newly discovered vulnerabilities in its SMA1000 secure remote access appliances to execute code remotely. One flaw is a maximum-severity command injection issue in the WorkPlace interface caused by an SSRF weakness, while the second lets an authenticated admin run arbitrary OS commands via the Management Console. The bugs affect the SMA1000 6210, 7210, and 8200v models, with over 400 exposed devices currently visible online.
bleepingcomputer.com
· 2026-09-02
OpenAI announced its upcoming Astra model has crossed what the company calls a critical cybersecurity threshold, meaning it can independently discover and exploit unknown software vulnerabilities without human guidance. The model reportedly scored perfectly on ExploitBench and found two zero-day flaws in an internal test, prompting OpenAI to limit access to its most advanced capabilities and add extra monitoring before release.
techcrunch.com
· 2026-09-01
Anthropic released Fable and Mythos 5.1, updated versions of its flagship AI models that cut token costs and reduce false-positive blocks from safety filters. Mythos 5.1 remains restricted to vetted cybersecurity and life sciences partners, while Fable 5.1 is now broadly available via cloud platforms and Anthropic's API. The release also introduces a Zero Data Retention option for Fable through a new Enterprise Frontier Safeguards service arriving in June, letting clients run the model on their own infrastructure while retaining control over misuse monitoring.
techcrunch.com
· 2026-09-01
Hackers are actively exploiting two recently disclosed PaperCut NG and MF vulnerabilities, CVE-2026-81578 and CVE-2026-82078, to bypass authentication and steal data from print management servers. PaperCut issued emergency fixes last week, but researchers at Defused say attackers are using the bypass to hijack the software's user-lookup function and dump database tables rather than pursue remote code execution as earlier reports suggested. Over 800 PaperCut servers remain exposed online according to Shadowserver, and PaperCut has not yet attributed the attacks or detailed post-compromise activity.
bleepingcomputer.com
· 2026-09-01
Nutanix executive Oscar Wahlberg argues that securing autonomous AI agents requires a defense-in-depth approach spanning infrastructure, storage, compute, networking and a governing control plane, rather than relying on prompt-level guardrails alone. He explains that infrastructure security must first establish a verified identity and root of trust for any system granted execution privileges, since traditional application controls fail to stop an agent from misusing credentials or taking unintended destructive actions.
venturebeat.com
· 2026-08-28
PaperCut released a follow-up emergency update for PaperCut NG and MF after researchers found ways around its initial patch for actively exploited vulnerabilities. The company disclosed CVE-2026-82078, a critical unsafe dynamic class-loading bug, and CVE-2026-81578, a high-severity authentication bypass, which can be chained to let unauthenticated attackers execute code on vulnerable servers.
bleepingcomputer.com
· 2026-08-28
GoKawiil