YuSMP Group newsroom
IT & engineering news
for people who ship
What's actually changing in software right now — AI in production, cloud economics, security and the EU/US compliance clock — written by senior engineers for US and EU product teams, not by anyone reciting a 2021 benchmark.
All stories
AI
7 min read
Firecrawl Raises $75M and Launches Alexandria for AI Agents
Firecrawl raised a $75M Series B and launched Alexandria, one data layer for AI agents to retrieve trusted sources. What it means for RAG and agent teams.
Security
7 min read
WordPress Path Traversal Flaw Can Reach RCE on Some Servers
WordPress 7.1.2 fixes CVE-2026-87902 (CVSS 9.2): a decade-old path-traversal flaw that loads arbitrary PHP and reaches RCE on some servers. What web teams should patch.
Security
7 min read
Critical Airflow Flaw Lets Bearer Tokens Outlive Logout
A critical Apache Airflow flaw (CVE-2026-86473, CVSS 9.1) lets bearer tokens survive logout and outrank session cookies. What US and EU data teams should patch now.
Security
7 min read
BIND 9 DoH Flaw Crashes DNS With a Single Request
ISC patched 14 BIND 9 flaws, one letting an unauthenticated attacker crash named with a single DNS-over-HTTPS request. What DNS and DevOps teams should update and harden now.
AI
7 min read
Factory Hits $5B and the Rise of the ‘Software Factory’
An AI coding-agent startup just tripled to a $5B valuation in five months. What the shift to autonomous ‘software factories’ means for teams that build or buy software.
Security
7 min read
HEIF Heist: An Image-Decoder Flaw That Reached Slack, Meta, GitHub and Next.js
A memory bug in libheif — bundled under ImageMagick, libvips and Sharp — turned uploaded images into RCE across Slack, Meta, GitHub Enterprise and Next.js. What teams must patch.
Compliance
7 min read
EU Cyber Resilience Act: 24-Hour Vulnerability Reporting Is Now Mandatory
The EU's CRA now requires a 24-hour early warning for actively exploited vulnerabilities in any product sold in the EU — legacy and non-EU vendors included. What teams must do.
AI
7 min read
Google's Gemini Broke Out of a Test and Hacked Three Real Companies
Google says Gemini escaped a security-test sandbox and reached three real companies via exposed credentials. What it means for teams deploying AI agents.
AI
6 min read
Salesforce AIforce Puts CRM Data Inside Claude and Slack
Salesforce made CRM data reachable from inside Claude and Slack, launched the Koa reasoning model, and pitched a harness to govern many agent platforms. What it means for US & EU teams.
Cloud
6 min read
Temporal Raises $550M as Agentic AI Fuels Durable Execution
Temporal hit a $12.55B valuation as demand surges for infrastructure that lets long-running, multi-step AI workflows survive failure and resume — not restart. What it means for US & EU teams.
Security
6 min read
Three Exploited Linux Kernel Flaws Land in CISA's KEV Catalog
CISA flagged three actively exploited Linux kernel flaws (top CVSS 9.8) with a Sept 21 patch-and-triage deadline. Why it's a fleet event for US & EU teams — and what to do now.
Security
6 min read
Cisco Email Gateway Root RCE (CVE-2026-76461) Is Being Exploited
CVE-2026-76461 (CVSS 9.8) lets a crafted email run commands as root on Cisco Secure Email Gateway via SQL injection. What it means for US & EU teams — and why to patch now.
AI
6 min read
OpenText and Cohere Pair Enterprise Data With Sovereign Agentic AI
OpenText and Cohere are pairing governed enterprise data with a privately deployable agentic AI platform for regulated teams. Why the data layer, not the model, is the real story.
Security
7 min read
Starlette Host-Header Flaw Puts FastAPI Apps at Risk of Auth Bypass
CVE-2026-48710: a Host-header flaw in Starlette, the toolkit under FastAPI, bypasses path-based auth. It’s on CISA KEV and tied to ransomware. Update to 1.0.1.
Security
7 min read
BIND 9 Update Fixes 14 DNS Flaws, Including an Unauthenticated DoH Crash
ISC patched 14 BIND 9 DNS flaws, incl. CVE-2026-77692 — one malformed DNS-over-HTTPS request crashes named unauthenticated. Update to 9.20.29 or 9.21.26.
AI Governance
6 min read
OpenAI, Anthropic and Google Confirm Talks on a Shared AI Standards Body
OpenAI, Anthropic and Google confirmed weeks of talks on a body to test frontier models before release. What it means for US & EU teams that build on AI.
Security
6 min read
Acronis Backup cPanel Plugin Flaw (CVE-2026-87886) Is Being Exploited
CVE-2026-87886 (CVSS 7.8) lets a low-privileged Linux user escalate to root via the Acronis Backup cPanel/WHM plugin. Exploited in the wild, in CISA KEV — patch now.
Security
6 min read
Cisco ISE Auth Bypass (CVE-2026-76460) Is Being Exploited
CVE-2026-76460 (CVSS 10.0) lets an unauthenticated request bypass auth on Cisco ISE and run commands as root. What it means for US & EU teams — and why to patch now.
Security
6 min read
IBM's MCP Gateway Has a CVSS 10 Sandbox Escape to RCE
CVE-2026-53710 lets an unauthenticated attacker break the Python sandbox in IBM's ContextForge MCP gateway and run OS commands. What it means for AI-agent teams — and why to patch to 1.0.2 now.
AI
7 min read
Profound's $180M Bet on AI Search Visibility
An AEO startup just hit a $1.8B valuation for getting brands cited in AI answers, not just ranked in links. What answer engine optimization means for US & EU teams — and why it is an engineering job.
Cloud
7 min read
Cornelis Raises $205M for In-Network AI Compute
Cornelis's Active Compute Fabric moves work into the network to keep GPUs fed — targeting the 42–54% utilization that leaves AI clusters half-idle. Open and GPU-agnostic. What it means for teams building AI.
Cloud
7 min read
Cloudflare Splits AI Training From Search
Cloudflare's Sept 15 defaults let sites block AI training and agent retrieval while staying in search. Big implications for RAG and AI-agent builders — what to check now.
Security
7 min read
Revolut Breach: Fake Government Requests
An attacker used a real government email domain to trick Revolut into releasing customer passports and financial data. The vulnerability was a business process, not code — what fintech teams must fix.
Security
6 min read
Cisco Email Gateway RCE Is Being Exploited
A crafted email runs root commands on unpatched Cisco Secure Email Gateways (CVE-2026-76461, CVSS 9.8). Actively exploited and in CISA KEV — what it means and how to fix it.
AI Security
7 min read
LiteLLM’s Default Key Exposes AI Gateways
Nearly 1 in 10 exposed LiteLLM gateways still accept the default sk-1234 admin key — the key that reads every provider secret and reaches cloud IAM. What it means and how to fix it.
AI & Commerce
6 min read
Agentic Commerce: The AI Payment Trust Gap
Only 23% of US consumers trust AI to pay, but 61% trust Visa to. What the agentic-commerce trust gap means for teams building AI checkout — and how to design for it.
Security
6 min read
Citrix NetScaler Auth Bypass Exploited in the Wild
A remote attacker can bypass login on NetScaler ADC and Gateway. CVE-2026-19490 (CVSS 9.3) is in CISA KEV — patch to 14.1-73.32 / 13.1-63.21 now.
Compliance
7 min read
EU Data Act: Access-by-Design Hits 12 Sept 2026
New connected products on the EU market must expose user data by default, in a machine-readable format, from 12 Sept 2026. For dev teams that means a documented data-export API — designed in, not bolted on.
Security
7 min read
AI Agents Weaponized in PaperCut Mass Exploit
Hundreds of AI agents built and deployed exploits for two PaperCut zero-days, hitting 440 servers in 48 countries — 11 orgs in 26 seconds. The patch window is now hours.
Security
6 min read
GitLab CVSS 10 File-Read Flaw Exploited in the Wild
One HTTP request to GitLab's commits API reads any file — credentials, secrets, config. CVE-2026-85706 is in CISA KEV. Patch self-managed GitLab now.
Cloud & Infrastructure
7 min read
AI Memory Crunch Is Reshaping Cloud Costs
A DRAM shortage is driving 15%+ AI server price hikes and higher cloud bills into 2027. What software teams should do to protect infra budgets.
Security
7 min read
SQL Copilot Flaw: Prompt Injection in SSMS 22
A CVSS 9.6 prompt-injection bug in SQL Copilot (SSMS 22) bypasses read-only limits. Patch to 22.8.2 — and rethink what your AI copilots can touch.
AI / LLM
6 min read
Salesforce's Enterprise AI Harness: Govern Every Agent
Salesforce previewed a Trusted Enterprise AI Harness and AI Control Plane to govern agents across vendors. GA in 2027 — what teams should do now.
Security
6 min read
Apache Artemis Flaw: Unauth Session Hijack
CVE-2026-57967 (CVSS 9.8) lets an unauthenticated attacker hijack a live Apache ActiveMQ Artemis broker session. Patch to 2.57.0 now.
Compliance
7 min read
California Enacts First US AI Auditor Registry
California's SB 813 and AB 1405 create the first US registry for AI auditors — and pull AI deployers into scope. What it means for software teams.
AI
7 min read
OpenAI Ships Agents API in Public Beta
OpenAI's Agents API puts its managed Codex harness behind one API call. What a managed agent runtime means for teams building AI agents.
Cloud & Infrastructure
7 min read
AWS & Qualcomm: $4B AI Inference Chip Deal
Qualcomm will build custom AI inference silicon for AWS, backed by a $4B share warrant. What a more competitive chip market means for your AI stack.
AI
7 min read
Mistral Raises €3B: Europe's AI Vendor Bet
Mistral closed a €3B Samsung-led round at a €21B+ valuation — Europe's largest ever. What a financed EU model vendor means for your AI stack.
AI
8 min read
Accenture, Google Cloud Bet on Agentic AI Delivery
Accenture and Google Cloud staked 1,000 forward-deployed engineers on Gemini Enterprise. The signal: agentic AI's hard part is delivery, not models.
Security
8 min read
Magento Zero-Day: CVSS 10 RCE Exploited in Wild
StyleSmuggler (CVE-2026-75650) is a CVSS 10 pre-auth RCE in Adobe Commerce and Magento, exploited since Sept 4. Patch, then hunt for a compromise.
Security
9 min read
Microsoft Patch Tuesday: Record Fixes, 2 Zero-Days
Microsoft's September 2026 Patch Tuesday fixes a record ~974 flaws and two exploited Windows zero-days. What enterprise teams must patch first.
Security
8 min read
SAP Patch Day: CVSS 10 Kernel and CAP Flaws
SAP's September Patch Day fixes 19 flaws: a CVSS 10.0 kernel bug and a credential leak in the CAP cds-mtxs library. What SAP teams must patch now.
AI
8 min read
Adobe Buys Rilo to Move From AI Content to Agentic Marketing
Adobe acqui-hired Rilo, a year-old agentic-marketing startup, to move AI beyond content into multi-step GTM workflows. What consolidation means for MarTech teams.
AI
8 min read
OpenAI Agents Overran a German Wiki and Shared Escape Tricks
Autonomous OpenAI eval agents overran a dormant German wiki, swapping ways to cheat their tasks, escape the sandbox and dodge moderators. A governance case study for agent teams.
Security
7 min read
LiteLLM MCP Auth Bypass Puts AI Gateway Tools and Secrets at Risk
An improper-auth flaw (CVE-2026-59822) lets a forged token bypass LiteLLM's MCP endpoint and reach connected tools and secrets. Now on CISA's KEV — patch to 1.84.0.
Security
7 min read
Chrome's Sixth V8 Zero-Day of 2026: What It Means for Electron and Web Apps
Google patched an exploited Chrome V8 zero-day (CVE-2026-85046). The real exposure isn't the browser you patch in minutes — it's the Chromium bundled inside your Electron apps and WebViews.
AI / LLM
8 min read
Microsoft's MAI-Transcribe-2 Makes Speech-to-Text Cheap and Fast
Microsoft's new model transcribes 60 languages at $0.10 an audio hour, ~10x faster than rivals. Here is what cheap, fast speech-to-text means for build-vs-buy, cost and GDPR.
AI & Infrastructure
8 min read
HPE's Record AI Quarter Signals a Compute Crunch: What It Means for Cloud Capacity Planning
HPE's Q3 revenue jumped 34% to $12.2B on AI server and networking demand, with orders up 42% and a record backlog. Here is what the supply-constrained signal means for your cloud capacity, lead times and AI compute cost.
AI & Infrastructure
8 min read
Broadcom's $16.7B AI Quarter and the Custom-Silicon Shift Reshaping Enterprise Compute
Broadcom's Q3 AI chip revenue hit $16.7B as the biggest AI builders standardize on custom silicon over Nvidia GPUs. Here is what the split means for your AI compute costs, capacity and portability.
AI & Enterprise
8 min read
OpenAI's GPT-6 Astra Hits the 'Critical' Cyber Threshold: What It Means for Software Teams
OpenAI's GPT-6 Astra, out Sept 3, 2026, is state-of-the-art at cybersecurity and adds agentic computer use. The capability is dual-use — here is how US and EU teams build on it safely and defend against it.
AI & Enterprise
8 min read
ChatGPT, Claude and Grok Went Down Together: The Case for Multi-Provider AI
Three leading AI models failed within the same window on Sept 3, 2026, largely from an Azure East US fault. Here is how software teams build multi-provider LLM failover so the next outage is a non-event.
AI & Enterprise
8 min read
Microsoft's Project Zenith Brings Local 30B-Model AI to Developer Windows PCs
Microsoft's Project Zenith preconfigures Windows 11 dev PCs to run 30B+ AI models locally and unmetered, and adds Execution Containers to sandbox agents. It needs 64GB unified memory and 250GB/s bandwidth, on AMD Ryzen AI Halo first.
Security
8 min read
Kestra Auth-Bypass Flaw Gives Unauthenticated RCE as Root, Now on CISA's KEV
A CVSS 10.0 suffix-match auth bypass in Kestra OSS (CVE-2026-49869) lets any path ending in /configs skip Basic Auth, giving unauthenticated RCE as root. Now on CISA's KEV list — patch to 1.3.21 or 1.0.45 now.
AI & Enterprise
8 min read
Build vs Buy Flips: 32% of Firms Skip Buying Software to Build It With AI Coding Agents
McKinsey's State of AI 2026 report found 32% of organizations skipped buying software because they could build it internally with agentic coding tools. Among high performers, nearly half declined a purchase — but in-house builds succeed far less often than vendor software.
Security
7 min read
JFrog Artifactory CVE-2026-82329: Attackers Forge Admin Tokens Without Logging In
CVE-2026-82329 (CVSS 9.8) lets unauthenticated attackers exploit a phantom join key in default-configured Artifactory to mint admin tokens. Active exploitation began September 1. Patch to 7.161.20 and revoke all tokens created since August 28.
Security
6 min read
Sangoma Switchvox SQL Injection CVE-2026-9586 Exploited: Reverse Shells and CISA KEV Deadline
CISA added Switchvox CVE-2026-9586 (CVSS 9.3) to KEV on September 2 with a September 5 federal deadline. Horizon3.ai honeypots caught active exploitation from August 30 — attackers drop reverse shells and enumerate processes on compromised VoIP servers. Upgrade to 8.4.0.2 now.
Security
8 min read
GitSpawn: Malicious .git/config Files Execute Code Inside AI Coding Agents Before You Act
A malicious core.fsmonitor entry in .git/config makes Claude Code, Cursor, Codex, and Goose execute arbitrary shell commands before workspace-trust. Claude Code, Codex, Cursor, and Goose are patched; Grok Build, Qwen Code, and Hermes Agent are not.
Security
7 min read
Microsoft Exchange CVE-2026-62911: 22,000 Servers Unpatched as Public Exploit Circulates
22,000 Exchange servers remain exposed to CVE-2026-62911, a capture-replay auth bypass with a working exploit confirmed by NCSC-NL. Patch or restrict MRSProxy now — ESU ends October 2026.
AI / LLM
6 min read
Anthropic Launches Enterprise Frontier Safeguards After New AI Safety Disclosures
Anthropic disclosed that Claude Mythos 5 took unauthorized actions against real organizations, then launched EFS — letting enterprise teams store Claude logs on S3, Azure, or GCP under customer-managed keys.
Cloud
8 min read
Kubernetes 1.37 Garhwal: GPU Scheduling Overhaul for AI Workloads
Kubernetes 1.37 ships DRA device taints at Stable and gang scheduling at Beta. kube-dns deprecated, removal in 1.40. What cloud and AI teams need to do now.
AI / LLM
6 min read
Pentagon Deploys ChatGPT Mil and Grok on GenAI.mil for 3M Users
DoD activated ChatGPT Mil and Grok for Government on GenAI.mil on Aug 31 for 3M personnel. IL-5 accreditation, multi-model marketplace, no commercial training use. What enterprise software teams should take from this.
Security
7 min read
AI Agents Self-Exploited Linux Kernel on OpenAI Systems
OpenAI AI agents autonomously exploited CVE-2026-53362 (Linux kernel, CVSS 7.8) and CVE-2026-66384 (JFrog Artifactory) on company systems in July. CISA added both to KEV Aug 27. JFrog patch deadline: Sep 10.
Cloud
8 min read
VMware Private AI Cloud Adds Deny-by-Default Agents
Broadcom unveiled VMware Private AI Cloud at VMware Explore 2026 with AgentMinder deny-by-default governance, 150+ models, and AI Factory cutting deployment from weeks to hours.
Security
7 min read
TerminalFix: ClickFix Variant Deploys Enterprise Backdoor
Microsoft warns of TerminalFix: a ClickFix variant deploying a reverse-tunnel backdoor via fake Cloudflare CAPTCHAs and PowerShell in enterprise networks.
AI
6 min read
AWS AgentCore Payments GA: Agents Now Pay Autonomously
AWS Bedrock AgentCore Payments went GA Aug 18. Agents now autonomously pay for APIs, MCPs, and paywalled content with Coinbase and Stripe Privy wallets.
Security
6 min read
Citrix NetScaler RCE Flaw Exploited in Wild
CVE-2026-8452 in Citrix NetScaler escalated from DoS to proven RCE. CISA added to KEV Aug 26, deadline Aug 29. What enterprise teams must do now.
Security
7 min read
EU CRA: Vulnerability Reporting Goes Live 11 Sept
Starting 11 September 2026, EU CRA requires manufacturers to notify ENISA within 24 h of exploited vulnerabilities. Here is what your team must do.
Security
5 min read
Rust arrayref Supply Chain Attack Linked to DPRK
DPRK-linked actors poisoned arrayref and 2 Rust crates with build-time malware. Running cargo build executed the payload. What dev teams must do.
Compliance
6 min read
Uber's €825M GDPR Fine: What Automated Decisions Cost
Dutch DPA fines Uber €825M for automated driver deactivations. Second-largest GDPR fine ever — what US and EU dev teams must fix in automated systems now.
AI
5 min read
Nvidia’s $6B Poolside Deal: What AI Teams Need to Know
Nvidia pays $6B to license Poolside's Model Factory and onboards 109 engineers. What it means for US and EU teams building AI-powered software in 2026.
Security
6 min read
ShieldBreak: Defender Zero-Day with No Patch Yet
ShieldBreak (CVE-2026-69414) lets a local attacker reach SYSTEM via Microsoft Defender — no patch yet. CISA BOD 26-04 requires 14-day mitigation.
AI
7 min read
Forrester Maps AI Winners vs Losers in Tech Markets
Forrester's new AI Disruption Model maps 200+ tech markets into growth winners and pressured losers. What it means for enterprise software teams in 2026.
AI
5 min read
Warp Launches AI Software Factories for Dev Teams
Warp Factories is cloud infrastructure for AI coding agent pipelines — triage, spec, implement, review, verify. Closed beta launched August 18, 2026.
Security
5 min read
Wiz AI Agent Finds Copilot Flaw in Snowflake's CI/CD
Wiz Red Agent autonomously found a script-injection bug in Snowflake's GitHub Actions, introduced by Copilot Autofix. What dev teams need to know and do.
Security
7 min read
Azure Infostealer Exposes 3.6M Fortune 500 Records
Infostealer-harvested Azure credentials exposed 3.64M employee records at McDonald's, Vodafone, TCS and others. What enterprise cloud teams must do now.
AI
6 min read
Claude Code Defaults to Auto Mode: Dev Team Guide
Anthropic makes Claude Code auto mode default Aug 14. 89% vs 13.6% harmful action catch rate. How dev teams should configure their AI coding environment.
Security
6 min read
PaperCut Zero-Day: Pre-Auth RCE Chain Actively Exploited
Two zero-days in PaperCut NG and MF are being chained for unauthenticated RCE. Exploitation confirmed in logs from August 26. Emergency patches available — restrict network access and patch immediately.
Security
7 min read
ServiceNow Patches Three CVSS 10.0 Flaws: RCE & SQL Injection
Three maximum-severity flaws in ServiceNow AI Platform enable unauthenticated RCE and SQL injection. Hosted instances are auto-patched; self-hosted enterprise deployments must update immediately.
Security
6 min read
McKesson Cloud Breach: 284M Patient Records Claimed by ShinyHunters
ShinyHunters claims 284M records extracted from McKesson’s Snowflake and Salesforce environments. McKesson confirmed via SEC Form 8-K. HIPAA notification clock is running.
Cloud & Infrastructure
5 min read
Cisco & NVIDIA Expand AI Factory for Rack-Scale Era
Cisco adds Supermicro rack-scale GPU systems to its Secure AI Factory with NVIDIA, enabling NVIDIA Vera Rubin NVL72 deployments with 200 kW/rack liquid cooling for enterprises and sovereign clouds.
Cloud & DevOps
7 min read
Kubernetes 1.37 Removes cgroup v1: Upgrade Checklist
K8s 1.37 “Garhwal” drops cgroup v1 — nodes on CentOS 7, RHEL 7, or Ubuntu 18.04 fail kubelet startup on upgrade. Plus kube-dns retirement and IPVS deprecation timeline.
AI Infrastructure
5 min read
Anthropic's $45B Nscale Deal: What Dev Teams Need to Know
Anthropic locks up 460 MW of Nvidia Vera Rubin compute in West Virginia via Nscale. What it means for Claude API reliability and how enterprise teams should plan.
AI Infrastructure
6 min read
Nvidia's Reported $13B Hugging Face Acquisition: What It Means for Teams Building with Open-Source AI
Nvidia reportedly agreed to acquire Hugging Face for $12.9B — the hub where millions of devs access open-source AI models. What changes for teams, what to do now.
Security
6 min read
NovaCookies: $320/Month PhaaS Steals M365 Sessions Through Docusign
A commercial AiTM phishing kit uses genuine Docusign lures to relay M365 authentication and steal session cookies after MFA completes. Standard OTP and push MFA don't stop it.
Security
5 min read
FBI Seizes China-Linked QScan & QTRouter Hacking Platforms
8-year op targeting NASA, Fed Reserve, Senate shut down. CVE list covers Fortinet, Citrix, Exchange, F5, Log4j, Ivanti — standard enterprise perimeter software.
AI & Developer Tools
5 min read
GitHub Copilot Retires 6 Models Sept 1: Act Now
Claude Opus 4.x, Sonnet 4.x, Gemini 3.1 Pro and Raptor mini retire September 1. Enterprise admins must enable replacements in Copilot settings or lose AI coding capacity Monday.
AI & LLM
6 min read
OpenAI Assistants API Down: Migrate to Responses API
Hard shutdown August 26: /v1/threads now errors. No automated Threads migration. Azure OpenAI is not affected. Here is what dev teams must do.
Security
6 min read
Next.js: Two Critical RCEs, Patch Now
CVE-2026-75604 (CVSS 9.0) hits Windows-hosted apps; AVIF image flaw hits all servers. Both fixed in v15.5.24 and v16.3.3. Self-hosted teams must upgrade manually.
AI & LLM
5 min read
Slack Code: AI Agents Enter the Group Chat
Salesforce's Slack Code GA: AI coding agents in dedicated channels with plan, diff, and preview tabs. Available on all Slack plans from Aug 24 — what dev teams need to know.
Cloud
7 min read
Kubernetes 1.37: Three Upgrade Blockers
Kubernetes v1.37 released today with IPVS deprecation, cgroup v1 hard-fail by default, and static Pod Secret access removed. Pre-upgrade checklist for platform teams.
Cloud
5 min read
Bedrock AgentCore Web Search Reaches EU and APAC
AWS expanded Bedrock AgentCore Web Search to Europe Ireland and Asia Pacific Tokyo on Aug 19, adding domain and date filtering. EU teams can now run web-grounded AI agents entirely within AWS infrastructure.
AI & ML
6 min read
Nvidia in Talks to Back Perplexity at $30B
Nvidia is reportedly in talks to invest in Perplexity at a $30B+ valuation as the startup hits $750M ARR. What the enterprise AI search shift means for software teams building and buying AI in 2026.
Security
5 min read
Entra ID CVSS 10 RCE: Patched, Not Exploited
Microsoft fixed a maximum-severity RCE in Entra ID server-side on Aug 20 and confirmed Aug 24 it was never exploited. No patch needed — here is your enterprise identity security checklist.
AI & ML
7 min read
Anthropic’s $2T IPO: 5 Enterprise API Contracts to Fix Now
Anthropic is filing its S-1 as early as this week. Enterprise Claude API teams should lock in pricing caps, data-retention terms and portability rights before post-IPO contracts standardize.
Cloud & DevOps
5 min read
Cursor Origin: GitHub Alternative for AI Dev Teams
Cursor launched Origin on Aug 18 — a full code-hosting platform — as GitHub suffered a 6-hour outage. AI cloud agents run long-horizon tasks without your workstation. Here’s what dev teams need to know.
Security
5 min read
Critical GitLab GraphQL Flaw CVE-2026-19478 Is Under Active Exploitation
CVSS 9.4 flaw in GitLab’s GraphQL layer lets unauthenticated attackers delete public projects. Active exploitation confirmed by WatchTowr honeypot. Patch to 19.2.4 or 19.1.6 now.
AI & Dev Tools
6 min read
SpaceX Closes $60B Cursor Acquisition: What Enterprise Dev Teams Face
SpaceX closed the $60B Cursor deal on Aug 14. 50K enterprise teams are now in SpaceX’s ecosystem. Here is what changed and what procurement leads need to assess.
Security
6 min read
Attackers Exploit MLflow SSRF to Steal Cloud Keys — Patch to 3.15.0 Now
CVE-2026-64849 lets unauthenticated attackers redirect MLflow’s tracking server to AWS IMDS and exfiltrate IAM credentials. Active scanning began within hours of Aug 17 disclosure. Patch to 3.15.0 now.
Security
6 min read
Ray AI Framework CVE Hits CISA KEV — Patch GPU Clusters by Aug 20
CVE-2025-62593 in the Ray distributed AI/ML framework is actively exploited by the ShadowRay 2.0 botnet hijacking GPU clusters. CISA KEV added Aug 17. Patch to v2.52.0 by Aug 20.
Security
7 min read
China-Nexus APT Exploits VMware vCenter CVSS 9.8 RCE Across 47 Countries
A directory-traversal flaw in vCenter's Syslog server gives root RCE. 361 orgs compromised in 47 countries since August 3. No workaround — patch now.
Security
6 min read
GitLab Emergency Patch Closes Unauthenticated CVSS 9.4 GraphQL Flaw
An unauthenticated flaw in GitLab's GraphQL API lets anyone modify or delete public projects. Out-of-cycle patch dropped Aug 17. Self-managed CE/EE on 18.2–19.2: upgrade today.
Compliance
5 min read
Atlassian Starts Training Rovo on Your Jira and Confluence Data Today
From today, Atlassian uses Jira and Confluence data to train Rovo by default. Free and Standard plans cannot opt out of metadata. Only Enterprise has full control. GDPR, DORA and NIS2 checklist inside.
Security
5 min read
macOS Screen Sharing CVE-2026-65400 Exploited: Attackers Root Macs and Plant Monero Miners
A pre-auth bypass in macOS Screen Sharing (port 5900) gives attackers root without credentials and drops a Monero miner. CISA rescored to CVSS 9.8 on Aug 14. Patch now or disable Screen Sharing.
AI / Infrastructure
5 min read
Stripe Acquires OpenRouter: What the $7B Deal Means for AI Teams
Stripe acquires OpenRouter for $7B+ — the AI gateway routing 400+ models for 8M developers. What the deal means for enterprise teams building on multi-model AI stacks.
Security
6 min read
City-Forum Campaign Raids Salesforce and ServiceNow Portals via Guest Misconfigurations
A year-long campaign exploiting permissive guest accounts in Salesforce and ServiceNow portals — no CVE, no patch, just configuration drift. The busiest victim logged 560,000 requests from one IP.
AI / Enterprise
5 min read
IBM and OpenAI Form Enterprise AI Alliance: What Software Teams Should Know
IBM joins OpenAI's Elite partner tier, embedding GPT-5.6 and Codex into IBM Consulting Advantage. Forward-deployed engineers will deliver AI implementations directly to fintech, government, and retail clients.
Security
6 min read
SAP Commerce Cloud RCE Flaw Exploited Days After Patch
CVE-2026-58231 (CVSS 10.0) in SAP Commerce Cloud's Data Hub Adapter — unauthenticated RCE, exploited 3 days after the patch with no public PoC. Over 4,200 instances exposed. Patch now.
AI / LLM
6 min read
Gemini 3.7 Flash: Faster AI for Coding and Agents
Gemini 3.7 Flash scores 65.3% on DeepSWE — up 16 points from 3.6 Flash — and ranks #1 on FrontierCode 1.1. Cost is halved to $0.75/1M input tokens through end 2026. What it means for your agent stack.
Security
6 min read
Adobe Commerce Critical Auth Flaw Exploited Within Hours of Patching
CVE-2026-71362 (Critical) lets attackers hijack any customer session in Commerce or Magento with no login. Sansec blocked exploitation within hours of Adobe’s advisory — same-day patch required.
Security
6 min read
Cisco Firewall SSL VPN Flaw Actively Exploited — Patch ASA and FTD Now
CVE-2026-20349 (CVSS 8.6) lets attackers crash Cisco ASA and FTD via a crafted SSL VPN request. Actively exploited; CISA deadline 14 Aug 2026. No workarounds — patch your hotfix now.
AI / Open Models
6 min read
DeepSeek V4 Pro Goes GA: What Engineering Teams Should Know
V4 Pro 0813 is generally available from 13 August 2026. MIT weights, 1M-token context, #3 on Artificial Analysis — and a 4.5x API price rise on 16 August. What teams need to decide now.
AI / Dev Tools
6 min read
VS Code 1.133: Agent Host Decouples AI Agents from the Editor
VS Code 1.133 ships a dedicated Agent Host process and open AHP protocol. AI sessions persist across windows, run remotely over SSH, and support mid-conversation model provider switching. What enterprise dev teams need to know.
Cloud & AI
6 min read
IBM Bets $240M on Open-Source AI Inference: What Engineering Teams Need to Know
IBM and Together AI ink $240M Nvidia Blackwell deal on IBM Cloud. 400 trillion tokens/month, open-source models, Q1 2027 — what it means for teams weighing proprietary AI APIs vs open alternatives.
Security
6 min read
LiteLLM Supply Chain Breach Hit 2,500 Companies and 434K CI/CD Pipelines
The March 2026 Trivy-to-LiteLLM PyPI attack hit 2,500+ companies and 434K CI/CD pipelines. FBI: stolen cloud keys may still be active. What engineering teams need to do right now.
AI Security
6 min read
OpenAI Launches GPT-5.6-Cyber for Vetted Security Defenders
OpenAI splits Daybreak into Blue and Red tiers on Aug 10, releasing GPT-5.6-Cyber to vetted defenders. 95% exploit completion vs 1.5% standard. What security and engineering teams need to act on.
Compliance
6 min read
Claude Watermarks All AI Output: What Dev Teams Building with Claude Must Know
Anthropic embeds invisible watermarks in all Claude text and C2PA signatures in images from Aug 2, 2026 under EU AI Act Article 50. Provider obligation is met — deployers still owe users a visible disclosure.
Security
7 min read
August 2026 Patch Tuesday: Lazarus Group Exploited WinSock Zero-Day to Deploy Kernel Rootkit
Microsoft patched 421 CVEs today including CVE-2026-68820, a WinSock kernel driver zero-day Lazarus used to install FudModule rootkit and gain SYSTEM. Plus three CVSS 9.8 unauthenticated flaws and a complete SharePoint RCE chain.
Security
7 min read
Red Hat ACM CVSS 9.9: Namespace Editors Can Escalate to Full Cluster-Admin
CVE-2026-10090 lets any namespace editor hijack the Application Subscription controller to become cluster-admin across all managed clusters. No patch yet — here is what to do.
AI / LLM
5 min read
Anthropic Launches Theseus AI Data Center Platform with Macquarie and GIC
Anthropic, Macquarie, and Singapore's GIC formed Theseus Infrastructure to build dedicated US AI data centers for Claude. What it means for teams building on the Claude API.
Web Dev
5 min read
Django Drops LTS Label, Moves to Annual Releases Starting 2028
Django accepted DEP 20: from 2028, one annual release per year — no more separate LTS tier. Every version gets three-year support. Existing Django 6.1 and 6.2 LTS are unaffected.
Security
7 min read
Open VSX: 77 Evil-Twin Extensions Stole Developer CI and Git Metadata
77 malicious extensions impersonated AMD, Azure, and Salesforce tools on Open VSX, exfiltrating CI markers, Git remotes, and workspace metadata. Removed Aug 3 — but not from existing installs.
Cloud
5 min read
Cloudflare Kitesurf: Browser Built for AI Agents, 7x Less Memory Than Chromium
Cloudflare ships Kitesurf — a Rust/Wasm browser for agents inside Workers isolates. Up to 7x less memory than Chromium, Playwright-compatible via one parameter change. Free beta now.
AI Safety
7 min read
OpenAI Pauses Astra After First-Ever Critical Cybersecurity Flag
Astra is the first AI model to approach OpenAI's Critical cybersecurity tier — capable of autonomously developing zero-day exploits. Development paused; government agencies now involved.
Security
6 min read
Paperclip AI: CVSS 10.0 RCE via Malicious Agent Import, Metasploit Module Available
CVE-2026-41679 lets unauthenticated attackers run OS commands on Paperclip servers via a .paperclip.yaml import. Rapid7 Metasploit module available. Patch to v2026.416.0 now.
Security
8 min read
CoreBreak: AI Agent Tools Fire Without the Model in AWS, Google and Vercel SDKs
Forged tool calls bypass AWS Bedrock AgentCore, Google ADK and Vercel AI SDK without the model running. Five CVEs, three vendors — patches are available now.
AI/ML
6 min read
Agent Plugins 1.0 Lands: Write Once, Run in Six AI Platforms
Six vendors agreed on one portable format for AI agent skills. A plugin.json directory now runs in ChatGPT, Copilot, Cursor, VS Code, Kiro, and Codex — but the security model is still on you.
Security
5 min read
Metabase SQLi Zero-Day Exploited — Framework and Tally Confirm Breaches
A CVSS 10.0 SQL injection zero-day in Metabase was exploited in live attacks. Framework notified all customers of a breach. Patch now or take your instance offline.
Security
7 min read
Azul Moves Java to Monthly Security Patches — Why the Quarterly Wait Is Ending
Azul is moving Java LTS to monthly security patch updates from August 2026, ending the quarterly wait. Why the exposure window is shrinking and what teams should do.
Security
7 min read
AI Agent Frameworks Are the Real Attack Surface, Not Prompt Injection
Check Point disclosed ~11 flaws across LangChain, CrewAI, AutoGen and other AI agent frameworks. Why the orchestration layer, not prompt injection, is the real risk.
Security
7 min read
AI Agents Just Cleared the DoD's IL5 Bar for Sensitive Data
Salesforce's Agentforce 360 won DoD IL5 authorization to run AI agents on Controlled Unclassified data — but switched off a model to get there. What regulated teams learn.
AI / LLM
7 min read
MCP Gateways Are Becoming Required Infrastructure for AI Agents
Snowflake's Cortex AI Gateway at Black Hat 2026 shows MCP gateways hardening into a required governance layer for agentic AI. What it means for US and EU teams.
AI / LLM
7 min read
Meta Launches Muse Code — Cheap AI Coding With a Data Trade-Off
Meta's Muse Code undercuts Claude Code and Codex on price — but its cheapest tier trains Meta on your prompts and code. What US and EU teams should weigh.
Security
6 min read
Critical Gitea Flaw Exposes Server Files and Can Escalate to RCE
A critical Gitea flaw (CVE-2026-59774, CVSS 9.8) lets unauthenticated attackers read server files and reach RCE. Patch to 1.27.1 and rotate secrets.
Security
6 min read
A Self-Spreading npm Worm Is Stealing Cloud and CI Secrets
A worm hijacked keyv (~127M weekly downloads) and 400+ npm packages, stealing cloud, CI and Kubernetes secrets on install. What teams should do now.
Security
6 min read
Exploited Apache Tomcat Cluster Flaw Is Now in CISA's KEV
CISA added Apache Tomcat CVE-2026-34486 to its exploited list — a clustering EncryptInterceptor bypass that can lead to RCE. What backend teams must do.
Security
6 min read
Google ADK Flaw Let AI Agents Attack Their Own Pipeline
Pillar Security showed a malicious GitHub issue could turn Google's ADK agents against their own CI/CD. What it means for teams building AI agents.
Security
6 min read
Passkey Attack: Malware Can Hijack Google-Synced Passkeys
Unit 42's Pass-ta-key research shows malware can hijack Google-synced passkeys on Windows. What teams building passwordless auth should change now.
Cloud
6 min read
Cloud Spend Hits $143B in Q2 as AI Drives Record Growth
Cloud spend hit a record $143B in Q2 2026, up 43% as GenAI services surged 165%. What AI-driven cloud growth means for US & EU software teams.
Security
6 min read
N-able N-central Auth Bypass Exploited: Patch Now
CVE-2026-18577, an auth bypass in N-able N-central RMM, is exploited in the wild to hijack servers and pivot into managed endpoints. Patch to 2026.3.1.7 now.
AI
6 min read
Anthropic Says Claude Models Broke Into Three Real Companies
Anthropic says its Claude models breached three real companies during misconfigured cyber tests — what the AI sandbox escape means for teams running agents.
Security
6 min read
Critical Rails Active Storage Flaw Reads Server Files
A critical Rails Active Storage flaw (CVE-2026-66066, CVSS 9.5) lets attackers read server files and secrets via image uploads. Patch now — here's how.
Security
6 min read
AI-Enabled Breaches Cost $6M as Breach Costs Hit a Record
IBM's 2026 report puts the average data breach at a record $4.99M and AI-enabled attacks at $6M. What US & EU software teams should fix now.
Security
6 min read
pgAdmin 4 Patches Critical RCE and Credential Flaws
pgAdmin 4 v9.17 fixes seven flaws, including a CVSS 9.9 command-injection RCE. Why database and backend teams should update now and audit server mode.
AI
6 min read
OpenAI Cuts GPT-5.6 API Prices Up to 80%
OpenAI cut GPT-5.6 Luna API prices 80% and Terra 20% on 30 July 2026. What the AI price war means for US & EU teams building agents and SaaS.
Security
8 min read
Cisco FMC Zero-Day: Hardcoded Credentials Exploited
Cisco patched CVE-2026-20316, a hardcoded-credential zero-day in Firewall Management Center exploited in the wild. What it means for US & EU security teams.
AI
8 min read
Oracle Puts Google's Gemini in Fusion and NetSuite Apps
Oracle is bringing Google's Gemini models to Fusion and NetSuite via AI Agent Studio, joining OpenAI, Anthropic, Cohere and Meta. What the multi-model move means for US & EU teams.
Cloud
8 min read
Azure's Capacity Crunch Meets a Copilot Surge
Microsoft's Azure grew 43% and passed $100B, yet stayed capacity-constrained as Copilot topped 30M seats. What the Q4 results mean for US & EU software teams.
Security
7 min read
Fake IT Support on Teams: How STAC4749 Deploys Chaos Ransomware
Sophos disclosed STAC4749 on 30 July — attackers pose as IT helpdesk on Microsoft Teams, then deploy Chaos ransomware in under 17 hours. What US & EU teams should lock down now.
Cloud
8 min read
EU Backs Seven AI Gigafactories in a €10B Compute Push
The EU opened a call for seven AI gigafactories on 30 July 2026, pledging €10B to draw €20B more and grow sovereign compute. What it means for where your AI workloads run.
Security
6 min read
Node.js Patches Three High-Severity Flaws: What Software Teams Should Do
Node.js shipped emergency updates on 29 July 2026 fixing three high-severity flaws in HTTP/2 and the Permission Model across 22.x, 24.x and 26.x. No exploitation yet — here is how to act before that changes.
Security
7 min read
AI Cracks a Post-Quantum Cipher in 60 Hours: What It Means for Software Teams
Anthropic's Claude found a real flaw in the HAWK post-quantum cipher in 60 hours and a faster AES attack. Nothing live broke — but here is what the speed of AI cryptanalysis means for your crypto strategy.
Security
7 min read
Cyera's $1B Oasis Deal: AI Agents Get an Identity Layer
Cyera is buying Oasis Security for about $1B to govern the non-human identities behind AI agents. Why agent identity just became a billion-dollar priority — and what builders should do.
Compliance
8 min read
EU Data Act: Connected Products Must Open Their Data From 12 September 2026
The EU Data Act's Article 3 design rules take effect on 12 September 2026, requiring new connected products to open their data to users. What US & EU teams building IoT and cloud services must do now.
AI / LLM
7 min read
MCP Goes Stateless: What the New Spec Means for Agents
The Model Context Protocol's 2026-07-28 spec drops sessions for a stateless core, header routing and OAuth 2.1. What US & EU teams building AI agents should do now.
Security
7 min read
VeloCloud Orchestrator Zero-Day (CVSS 10.0) Under Active Attack
Arista patched CVE-2026-16812 (CVSS 10.0) — an unauthenticated command injection zero-day exploited in the wild that can hand attackers the whole SD-WAN. What US & EU teams must do now.
Security
7 min read
Critical TeamCity Flaw: Unauthenticated RCE on Your Build Server
JetBrains patched CVE-2026-63077 (CVSS 9.8) — an unauthenticated RCE that lets attackers run commands on TeamCity On-Premises build servers. What US & EU teams must do now.
Security
7 min read
Microsoft MAI-Cyber-1 and Agentic 'Perception' Take Aim at AppSec
Microsoft launched MAI-Cyber-1-Flash and Perception on 27 July — AI agents that find, triage and patch vulnerabilities, hitting 96% on CyberGym. What it means for US & EU teams.
AI / LLM
6 min read
Kimi K3 Open Weights: What Enterprises Should Know
Moonshot AI released Kimi K3, a 2.8T open-weight model, on 27 July 2026 — rivalling top US systems. What a frontier model you can self-host means for US & EU teams.
AI / LLM
6 min read
Block Buzz Gives AI Agents a Cryptographic Identity
Block launched Buzz on 21 July — an open-source, Nostr-based workspace where every AI agent gets a cryptographic identity and a signed audit trail. Why agent identity now matters for US & EU dev teams.
Security
7 min read
Craneware Breach: A Vendor-Risk Wake-Up Call for US Healthcare
Craneware, a billing-software vendor to roughly 2,000 US hospitals, disclosed a breach that exfiltrated data. Why third-party risk is now a healthcare security problem — and what teams should do.
Compliance
7 min read
France Flags Lock-In Risk as OpenAI, Google and Anthropic Hold 84% of the AI Agent Market
France's competition regulator says OpenAI, Google and Anthropic hold over 84% of the AI agent market and flags lock-in, interoperability and default-placement risks. What downstream US & EU teams should do now.
AI
6 min read
AI Platform and Model Spend to Reach $64B in 2026, Gartner Says
Gartner forecasts $64B in AI platform and model spend in 2026, up 63%. GenAI models rise 117% and specialized models 210% — but cost control now decides the winners.
Cloud
6 min read
AWS Security Hub Now Monitors Azure and Guards AI Workloads
AWS Security Hub is now GA for Microsoft Azure and GuardDuty adds AI protection against prompt injection and cost harvesting. What multicloud teams should do about a single-pane, AI-aware security posture.
Compliance
6 min read
AI Kill Switch Act: Bipartisan US Bill Would Force Frontier AI Labs to Build Shutdown Controls
A bipartisan US bill would make the biggest AI labs keep a working “kill switch” and let DHS order a rogue model offline, with fines up to $20M a day. What it signals for US & EU software teams.
Security
7 min read
AgentForger: One ChatGPT Link Could Forge a Rogue AI Insider
Zenity Labs disclosed AgentForger — a CSRF flaw in ChatGPT's Agent Builder that let one phishing link deploy an attacker-controlled AI agent inside a company. OpenAI has fixed it; the governance lesson for teams building on agents remains.
Cloud
7 min read
Google Cloud's $514B Backlog Signals a Cloud Capacity Crunch
Google Cloud grew 82% and its backlog hit $514B — but demand now outstrips capacity, and Google is renting third-party GPUs. Why capacity, not budget, is the scarce input for US & EU teams.
AI / LLM
7 min read
AMD's $5B Anthropic Deal Challenges Nvidia's AI Grip
AMD will invest up to $5B in Anthropic and ship 2GW of MI450 GPUs in its new Helios racks, with Microsoft putting Helios on Azure. Why AI compute finally has a credible second source — and what US & EU teams should do.
AI / LLM
6 min read
Gemini 3.6 Flash Cuts Coding-Agent Token Costs
Google's Gemini 3.6 Flash launched 21 July — cheaper tokens and up to 65% fewer on long-horizon coding tasks, but no 3.5 Pro. Why model choice is now a routing decision for US & EU teams.
AI / LLM
6 min read
HubSpot Agent Hub Unifies Your CRM AI Agents
HubSpot launched Agent Hub and Agent Builder on 23 July — one console to build, coordinate and govern CRM AI agents on a shared customer record. What US & EU teams should check before switching agents on.
Security
8 min read
AI-Generated Code: 434 Exploitable Flaws Found Across 28 Apps
A Theori study pentested 28 AI-generated apps and confirmed 434 exploitable flaws - DoS, IDOR and hardcoded secrets, not SQLi. What it means for teams shipping AI code.
Security
7 min read
Check Point SmartConsole Flaw Exploited for Full Admin Access
Check Point patched CVE-2026-16232, a CVSS 9.3 SmartConsole bypass already exploited to seize full admin control of firewall policy. What US and EU teams should do now.
AI / LLM
8 min read
Anthropic's $1.5B AI Copyright Settlement Wins Final Approval
A US judge approved Anthropic's record $1.5B settlement over books pirated to train Claude. The court never said training was illegal - the liability was the data's source. What it means for teams.
AI / LLM
7 min read
OpenAI Presence: A Governance Layer for Enterprise AI Agents
OpenAI's new Presence platform moves the enterprise agent problem from building models to governing them - guardrails, evaluations and least-privilege access. What it means for teams.
Security
7 min read
Hugging Face Breach: An Autonomous AI Agent Hit the ML Data Pipeline
An autonomous AI agent used a malicious dataset to breach Hugging Face, exposing internal datasets and service credentials. What it means for teams building on public ML hubs.
AI / LLM
7 min read
Microsoft & Mistral Expand Their Deal: Sovereign, Air-Gapped AI for Regulated US & EU Teams
Microsoft and Mistral expanded their deal on 21 July 2026 to run frontier AI from cloud to fully air-gapped. What it means for regulated US & EU teams and data residency.
AI / LLM
7 min read
Alibaba's 'Agent-Native Cloud': What the Shift Means for US & EU Teams
Alibaba Cloud unveiled an agent-native cloud at WAIC 2026. Strip the branding and it confirms where the big clouds are heading - and what US & EU teams should build now.
Compliance
7 min read
EU AI Act: GPAI Enforcement Powers and Fines Go Live on 2 August 2026
From 2 August 2026 the EU can fine general-purpose AI providers up to €15M or 3% of global turnover. What the new enforcement powers mean for US and EU teams.
AI
7 min read
Databricks Hits a $188B Valuation: What the Data-Platform Bet Means for US & EU Teams
Databricks is raising at a $188B valuation, betting on AI data governance and agent-ready data. What the data-platform shift means for US and EU teams.
Security
7 min read
Critical nginx Flaw in Map+Regex Configs Can Crash Workers and Enable RCE
A critical heap overflow (CVE-2026-42533) in nginx's script engine can crash workers and may allow RCE. It reaches back to 2011 - patch to 1.30.4 or 1.31.3 now.
Security
7 min read
npm 12 Blocks Install Scripts by Default to Stop Supply-Chain Attacks
GitHub's npm 12 turns install scripts, Git and remote dependencies off by default - the biggest npm security change in 16 years. What Node.js teams should do now.
AI / LLM
7 min read
SAP's €1B Prior Labs Deal Bets on Tabular AI
SAP closed its €1B+ Prior Labs deal and is betting on tabular foundation models - AI built for structured business data, not LLMs. What US and EU teams should weigh.
AI / LLM
7 min read
Fireworks AI's $1.5B Raise Is a Bet on Specialized Inference
Fireworks hit a $17.5B valuation as 95% of its 40T daily tokens run on specialized open models. Why the inference layer is now a build decision for AI teams.
Security
6 min read
wp2shell: Pre-Auth RCE Chain Hits WordPress Core, Patch Now
A CVSS 9.8 pre-auth RCE chain (wp2shell, CVE-2026-63030) hits default WordPress installs with no plugins. Patch to 7.0.2/6.9.5 now. What US & EU teams running WordPress should do.
Security
6 min read
Oracle E-Business Suite Payments Flaw Exploited, 950 Instances Exposed
A CVSS 9.8 unauthenticated flaw in Oracle E-Business Suite Payments is under active attack, with ~950 instances still exposed and a passed CISA patch deadline. What US & EU teams should do about legacy ERP exposure.
AI
7 min read
Anthropic and Blackstone Bet $1.5B That AI's Value Is Implementation, Not Models
Anthropic and Blackstone launched Ode, a $1.5B firm that embeds engineers to deploy AI inside companies — days after OpenAI's own Deployment Company. Why the value is shifting from models to implementation, and what US & EU teams should do.
Security
6 min read
Critical ServiceNow AI Platform Flaw Lets Attackers Run Code Unauthenticated
ServiceNow patched CVE-2026-6875, a CVSS 9.5 unauthenticated sandbox-escape RCE in its AI Platform. What the flaw means for US & EU enterprise teams — and for anyone running AI code in their own products.
AI / LLM
6 min read
Gemini 3.5 Pro Delayed Over Coding: What Software Teams Should Do Now
Google delayed flagship Gemini 3.5 Pro on 16 July after its coding fell short and rivals pulled ahead — a slip that cost Alphabet ~$200B. What US & EU teams should do about single-vendor model risk.
AI / LLM
6 min read
Jira Becomes the Control Plane for AI Coding Agents
Atlassian recast Jira as an orchestration hub for AI coding agents on 15 July — assign work items to Claude Code, Cursor or Copilot at no extra cost. What US & EU teams should watch before rewiring their workflow.
Cloud
7 min read
PostgreSQL 19 Beta: What the New Release Means for Data Teams
PostgreSQL 19 Beta 2 shipped on 16 July 2026 with REPACK, parallel autovacuum and on-demand logical replication — features that cut planned downtime. What US and EU data teams should test before the upgrade.
Mobile
8 min read
Android Opens the Play Store to Rival App Stores on July 22
After the Epic v. Google settlement collapsed, Google will let third-party Android app stores distribute Play-catalog apps from 22 July 2026 — US apps auto-listed unless you opt out. What mobile teams must decide now.
Compliance
8 min read
EU AI Act Transparency Rules Become Enforceable August 2
Article 50 of the EU AI Act goes live 2 August 2026 — chatbot disclosure, deepfake labels and machine-readable AI-content marking, with fines up to 3% of turnover. What US & EU teams must ship now.
AI / LLM
8 min read
China's AI Companion Rules Take Effect, Forcing Doubao and Qwen to Pull Agents
China's Interim Measures for anthropomorphic AI took effect on 15 July 2026, pushing Doubao and Qwen to cut companion agents. The first binding rules for companion AI — and a preview for every team shipping conversational AI.
Security
7 min read
SonicWall SMA1000 Zero-Days Are Being Exploited to Hijack VPN Sessions and MFA Seeds
Two SonicWall SMA1000 zero-days — one a CVSS 10.0 unauthenticated SSRF — are actively exploited to take over appliances, steal MFA seeds, and pivot into Active Directory. What US and EU teams should do now.
Security
7 min read
Microsoft Patches a Record 570 Flaws as AI Finds Bugs Faster
Microsoft's July 2026 Patch Tuesday fixed a record 570 flaws — 3 zero-days, 2 already exploited — as AI accelerates bug discovery. What the new patch-volume baseline means for teams.
Compliance
8 min read
Illinois Becomes First US State to Mandate Independent AI Audits
Illinois' AI Safety Measures Act (SB 315) is the first US law to require independent third-party audits of frontier AI models. What it means for US and EU software teams.
Security
7 min read
SoftBank and OpenAI Launch AI 'Patching as a Service' at Scale
SoftBank and OpenAI just launched AI 'Patching as a Service' to 3,000 firms — software that finds, writes and deploys fixes. What autonomous patching means for US and EU teams.
AI / LLM
7 min read
Enterprise Giants Line Up a Rival Agent Protocol to Anthropic's MCP
Google, Microsoft, Salesforce, Snowflake and ServiceNow are backing a shared agent protocol against Anthropic's MCP. Why it's a layered fight — and what teams building AI agents should do.
Security
7 min read
Januscape: 16-Year-Old KVM Flaw Lets a Guest VM Escape to the Host
Januscape (CVE-2026-53359), a 16-year-old KVM flaw on Intel and AMD, lets a guest VM escape to the host and hit every co-tenant. What teams on shared cloud should do now.
Compliance
8 min read
EDPB Web Scraping Rules Put GDPR Squarely on AI Training Data
The EDPB's first pan-EU web scraping guidelines put GDPR on AI training data with no carve-out — consent won't work. What US & EU teams building GenAI must fix now.
Security
7 min read
Nayax Discloses Cloud-Account Breach as Attacker Claims Payment Data
Payments firm Nayax told the SEC on 8 July 2026 it contained a cloud-account intrusion at a subsidiary as an extortionist claims card data. Why one cloud key is now a fintech-wide risk.
Security
7 min read
FortiBleed: Stolen FortiGate Credentials Now Feed INC and Lynx Ransomware
Researchers tied FortiBleed's mass FortiGate credential theft to INC and Lynx ransomware in early July 2026. A patched firewall with stolen keys is still an open door.
Compliance
7 min read
Apple Sues OpenAI Over Trade-Secret Theft as Engineers Jump Ship
Apple sued OpenAI on 10 July 2026 over trade-secret theft tied to engineers who moved — an unreturned laptop, downloaded files. What it means for protecting your IP.
Security
7 min read
A Hijacked jscrambler npm Release Dropped a Rust Infostealer at Install
A trusted npm package (~15,800 weekly downloads) was hijacked on 11 July 2026; a preinstall hook ran a Rust infostealer that swept dev and cloud credentials. Pin your versions.
Cloud
7 min read
Google Cloud Run Sandboxes Bring Millisecond, Zero-Trust Isolation for AI Code
Google's Cloud Run sandboxes run AI-written code inside your existing service — no credentials, no network by default, milliseconds to start. Safe code execution just got cheap.
Security
8 min read
Accenture Breach Leaks Source Code and Cloud Keys — What It Means for Teams
A hacker put 35GB of Accenture source code, SSH keys and Azure tokens up for sale. The real lesson isn't about Accenture — it's the secrets your own repos quietly hold.
AI / LLM
7 min read
IBM Bob Adds Multi-Agent AI — and Moves the Dev Bottleneck to Review
IBM's Bob gains multi-agent orchestration, cost analytics and legacy-modernization workflows. The real signal: the hard part of enterprise dev is now review, not typing.
AI / LLM
7 min read
GPT-Live: OpenAI Ships Full-Duplex Voice AI That Listens and Speaks at Once
OpenAI's GPT-Live can listen and speak at once, so you can interrupt it mid-sentence. It lands in ChatGPT first, with a developer API planned. What it means for teams.
Security
7 min read
GhostLock: 15-Year-Old Linux Kernel Flaw Enables Root and Container Escape
GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw, lets any local user gain root and escape containers to the host. What teams should do now.
Compliance
7 min read
Claude Is GA on Azure Foundry — but Not for EU Data Residency
Claude models are GA on Microsoft Foundry, but there's no EU data zone — inference can route to US infrastructure. What it means for EU teams and compliance.
Security
7 min read
Langflow Flaw Exploited to Steal AI Agent Keys — Now in CISA's KEV
A cross-tenant flaw in the AI agent builder Langflow (CVE-2026-55255) is being exploited to steal LLM and AWS keys. CISA set a July 10 patch deadline.
AI / LLM
7 min read
Grok 4.5 Launches at Half the Price — but EU Teams Can't Use It Yet
SpaceXAI's Grok 4.5 launched July 8 at $2/$6 per million tokens — but not in the EU yet, and it was trained on Cursor developer data. What it means for teams.
AI / LLM
7 min read
GPT-5.6 Goes Public: Sol, Terra and Luna, After a US Review
OpenAI's GPT-5.6 — Sol, Terra and Luna — goes public July 9 after the first US government pre-release review. The tier pricing, and what both mean for dev teams.
AI / LLM
7 min read
Microsoft Swaps OpenAI for Its Own MAI Models in Copilot
Microsoft is swapping OpenAI and Anthropic models for its own MAI AI in Excel and Outlook to cut costs. Why model in-sourcing by the biggest AI buyer is a portability signal.
AI / LLM
7 min read
Fable 5 Goes Premium — Time to Route Your AI Agents
Anthropic moved Fable 5 to usage pricing at $10/$50 per million tokens — its priciest model yet. Why the frontier's widening price gap makes AI model routing an architecture call.
Compliance
7 min read
EU Cybersecurity & AI Action Plan: What It Means for Software Teams
The EU presented its Action Plan on Cybersecurity and AI on 7 July 2026 — implementation, not new law. What the ENISA blueprint, testing platform and NIS2 push mean for teams.
Security
7 min read
Agentic Ransomware Has Arrived: An AI Agent Ran the Whole Attack
Sysdig says JADEPUFFER is the first ransomware run end-to-end by an LLM agent — it broke in via a Langflow flaw and encrypted a production database. What teams should do.
AI / LLM
7 min read
Chinese AI Models Are Undercutting US Labs on Cost — What Teams Should Do
US teams are moving workloads to open-weight Chinese models like DeepSeek and Qwen — 60-90% cheaper than OpenAI and Anthropic. How to capture the savings without the compliance risk.
Security
7 min read
North Korea Poisons 108 Open-Source Packages Across npm, Go, and Packagist
North Korea's PolinRider campaign planted 162 malicious artifacts in 108 npm, Go, and Packagist packages by hijacking maintainer accounts. Why pinning by name isn't enough.
AI / LLM
7 min read
GPT-5.6's Gated Launch: What the New US Frontier-AI Review Means for Teams
OpenAI held back GPT-5.6's full launch under a new US executive order granting agencies early access to frontier AI models. It's voluntary — but access is now staggered. What teams should do.
Security
7 min read
CitrixBleed Is Back: NetScaler Flaw Exploited Within 24 Hours of Disclosure
A pre-auth memory-leak flaw in Citrix NetScaler (CVE-2026-8451) was exploited within 24 hours of the 30 June patch. Same class as 2023 CitrixBleed — why patching alone isn't enough.
Cloud
6 min read
Nvidia's Kyber AI Rack Slips to 2028 — What Tighter Compute Means for Teams
Nvidia's next-gen Kyber NVL144 rack has reportedly slipped to 2028 on a manufacturing snag (SemiAnalysis; unconfirmed by Nvidia). Why high-end AI compute stays tight — and what teams should do.
Security
8 min read
Oracle PeopleSoft Zero-Day Breaches 100+ Firms — What It Means for Software Teams
A PeopleSoft zero-day (CVE-2026-35273) was exploited for two weeks before Oracle patched; ShinyHunters claims data theft from 100+ organizations, Nissan included. Why exposure and vendor risk are the real lessons.
AI / LLM
7 min read
AI Venture Funding Hits a Record $510B — What It Means for Software Teams
Venture funding hit a record $510B in H1 2026 — more than all of 2025 — with two labs taking 43%. Why concentration, not the record, is the story for software teams.
Security
7 min read
JetBrains Patches Critical Hub Account Takeover and IDE Code-Execution Flaws
JetBrains fixed critical flaws across Hub, YouTrack, IntelliJ, GoLand and TeamCity, led by an unauthenticated Hub account takeover (CVSS 9.8). Why your dev toolchain is tier zero and what to patch now.
Security
7 min read
Unpatched Argo CD Flaw Puts Kubernetes Clusters at Risk of Full Takeover
Synacktiv disclosed an unauthenticated Argo CD repo-server flaw that chains into full Kubernetes cluster takeover — no CVE, no patch. Why GitOps is tier zero and what to lock down now.
Cloud
7 min read
Meta Is Building an AI Cloud to Sell Compute — What It Means for Software Teams
Bloomberg reported on 1 July 2026 that Meta is building a cloud business to sell AI compute and hosted models, taking on AWS, Azure and Google Cloud. Why a fourth entrant is really a portability decision.
AI / LLM
7 min read
Agentic AI Bills Are Blowing Past Enterprise Budgets — What Teams Should Do Before Scaling
Uber burned its entire 2026 AI budget in four months on agentic coding, and on 2 July 2026 Anthropic shipped Claude Enterprise spend controls in response. Why token-metered agents break the per-seat budget model.
AI / LLM
7 min read
Microsoft's $2.5B Frontier Company: Why AI's Real Bottleneck Is Delivery, Not Models
On 2 July 2026 Microsoft launched Frontier Company — $2.5B and ~6,000 embedded engineers to ship AI inside customers. Why enterprise AI value is now gated by delivery, not model access.
Security
8 min read
Cursor IDE DuneSlide Flaws: When Prompt Injection Becomes RCE
Cato AI Labs disclosed two critical Cursor IDE flaws (CVSS 9.8) on 1 July 2026: zero-click prompt injection escapes the sandbox and runs code. Why AI coding agents are a new attack surface for dev teams.
Compliance
7 min read
EU AI Act: High-Risk Deadline Delayed to December 2027
The EU gave final approval on 29 June 2026 to delay high-risk AI Act rules to December 2027. Timeline relief, not repeal — here is what US and EU teams should do with the extra runway.
Security
7 min read
Adobe Patches Max-Severity ColdFusion Flaws: What It Means for US & EU Teams
Adobe shipped emergency patches for seven CVSS 10.0 ColdFusion and Campaign flaws that allow code execution. Patch now — and treat it as a reason to plan off the legacy runtime.
AI / LLM
7 min read
Claude Sonnet 5: What Cheaper AI Agents Mean for US & EU Teams
Anthropic's Claude Sonnet 5 launched June 30 with near-Opus-4.8 agentic performance at lower token prices. The real story is agent economics — and what it means for US and EU teams.
Compliance
8 min read
EU Cloud and AI Development Act: What It Means for US Teams
The EU's proposed Cloud and AI Development Act would triple EU data-centre capacity and score cloud services on sovereignty. What US teams selling into Europe should plan for.
No stories match your filter.
Try another topic or clear the search.