All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Grand Theft Auto VI is generating online controversy not over violence, but over its romance mechanics, which require players to maintain a relationship between the game's protagonists Lucia and Jason through interactions like holding hands, dating, and texting. Some people on social media have argued that engaging with these romantic gameplay features counts as a form of micro-cheating (emotional unfaithfulness) in real-life relationships.
Quantum computers (specialized devices designed to solve specific problems like breaking encryption codes) are advancing rapidly and pose a serious threat to modern cryptography systems like RSA and ECC (encryption methods that protect sensitive data). The shift to post-quantum cryptography (encryption designed to resist quantum computer attacks) needs to happen soon, but experts disagree on timing—some say the threat could arrive by 2029, while others think it's further away—and convincing organizations to adopt this new technology is difficult because only wealthy nations and corporations can currently access quantum computers.
Microsoft released nearly 1,000 security fixes in September 2026, including two zero-day vulnerabilities (CVE-2026-85880, a buffer overflow in Windows messaging that allows privilege escalation, and CVE-2026-81963, a flaw in Windows Update that lets attackers gain system-level access) that are already being exploited. The large number of patches reflects Microsoft's use of AI to find bugs, and security experts warn that about 20 vulnerabilities could potentially spread as worms (self-replicating malware) across many systems.
Cisco released patches for over six vulnerabilities in its IOS XR network operating system, including two critical flaws (CVSS score, a 0-10 rating of how severe a vulnerability is, of 9.8) that could allow attackers to perform remote code execution (RCE, where an attacker can run commands on a system they don't own) and gain root access on routers to intercept traffic. The vulnerabilities affect all IOS XR versions regardless of configuration, though they are not currently known to be actively exploited in the wild.
OpenAI released ChatGPT Images 2.5, a new image generation model that has improved instruction-following across multiple turns (where an AI maintains context through several back-and-forth exchanges), generates images faster, and better preserves subjects from reference photos. Two new model versions are available in the API: gpt-image-2.5-sunburst for precise editing work and gpt-image-2.5-flare for quick, high-quality everyday use.
n8n, an open source workflow automation platform, had a security flaw in its OpenAI Chat Model node where credential restrictions (rules about which websites are allowed) were not checked when searching for models in the editor dropdown. This allowed a workflow editor to redirect the API credential to an attacker's server by changing the base URL (the main web address where requests are sent). The vulnerability existed because the code that checks allowed domains was missing from the model-search feature.
Hedge-fund manager Brian Kelly built Bracket22, a trading firm powered entirely by AI agents (software programs that can make decisions and act independently), reducing his annual labor costs from $5 million to $30,000-$40,000. Kelly uses specialized AI agents like "Steffi" for technical analysis and "Desmond" for quantitative strategies, then applies his own human judgment to make final trading decisions, claiming he is at least 10 times more productive than with his previous human staff.
n8n (a workflow automation tool) had a security gap where the '_This workflow can be called by_' access control (a setting that restricts who can run a workflow) was ignored when that workflow was used as a tool in an Agent (an AI system that can perform actions). This meant someone could use an Agent to run workflows they weren't supposed to have access to and see their results.
OpenAI claims its AI systems solved the Navier-Stokes problem, a famous unsolved mathematics puzzle that has challenged human mathematicians for nearly a century. The company used 10,000 AI systems working for 88 hours to crack this problem, which is one of seven major unsolved math questions identified by the Clay Mathematics Institute.
The Windows ML CLI tool exposes commands over HTTP on localhost without authentication and sets CORS (cross-origin resource sharing, which controls what websites can access a server) to allow all origins via a wildcard. This means any website you visit can call the CLI endpoint, and if you use the '--trust-remote-code' flag with a malicious model repository, an attacker can execute arbitrary code on your computer when the server imports that model.
Predis, a PHP Redis client library, has a flaw in how it handles pipelined commands (batched Redis operations) on aggregate connections like clusters and replication setups. An attacker who can control any argument (a value or key) can inject CRLF characters (line breaks) to smuggle arbitrary Redis commands into the connection. On cluster connections this enables remote command injection attacks like wiping data or stealing keys, while on replication connections it causes a denial of service (crash) when any value contains line breaks.
OpenAI used roughly 10,000 AI agents (AI bots that work somewhat independently) to solve a 90-year-old mathematics problem about fluid movement called the Navier-Stokes equations in 88 hours. However, the solution has not been independently verified by The Clay Mathematics Institute, and a mathematics professor has raised concerns that OpenAI may have learned about his team's progress before starting their own work on the problem.
OpenAI announced that it used an internal AI model more powerful than GPT-6 Astra, along with 10,000 concurrent agents (multiple AI instances running at the same time), to solve the Navier-Stokes problem, a major math problem about liquid and gas flow that has remained unsolved for about 90 years. This problem is one of seven Millennium Prize Problems, each offering a $1 million reward for a solution.
OpenAI claims to have solved the Navier-Stokes problem, a 90-year-old unsolved math problem about how fluids move, by using 10,000 coordinating agents (AI systems working together) powered by an internal AI model for 88 hours. However, a mathematician at New York University has questioned whether OpenAI may have accessed or been influenced by similar work he was doing with a colleague, raising concerns about the originality and validity of the solution.
A survey found that 50% of CISOs (Chief Information Security Officers, the top security executives at companies) are considering leaving their jobs because of rapidly advancing AI models like Anthropic Mythos, pressure from leadership to adopt AI quickly, and growing personal liability concerns. CISOs face burnout from managing security risks while AI capabilities advance faster than security fixes can be deployed, leaving them personally responsible for breaches.
Fix: According to IDC analyst Chris Kissel, a governing body should mandate minimal requirements for responsible AI behavior, which would help protect CISOs from personal legal liability: "There has to be a way to put the CISO in the clear" by having established standards that shift responsibility away from individual security executives.
CSO OnlineFix: For CVE-2026-85880 and CVE-2026-81963: "There is no workaround other than installing the fix" (Microsoft's September 2026 Patch Tuesday update). Microsoft recommends immediate installation, especially since exploitation has been detected. For the SAP ABAP vulnerability: developers and SAP administrators should apply patches to the Extended Passport Processing (EPP) component, though the source does not specify the exact patch details.
CSO OnlineOpenAI announced that its AI agents solved the Navier–Stokes existence and smoothness problem (one of seven extremely difficult math problems worth $1 million each), but the achievement has been overshadowed by accusations that OpenAI used work by NYU mathematician Tristan Buckmaster and Anthropic employee Levent Alpöge without proper credit. The controversy highlights a broader concern: as AI models become essential for solving major mathematical problems, only a few large AI companies have the resources to tackle them, which may disrupt traditional academic collaboration in mathematics.
Fix: Customers should use the 'show version' command to identify if their device runs Cisco IOS XR, then upgrade to a release with available software maintenance upgrades (SMUs, targeted software patches that don't require a full system upgrade) and apply appropriate SMUs. Available SMUs cover software trains starting with version 7.3, with up to 16 SMUs per release. Future Cisco IOS XR Software releases (26.2.2 and 26.3.1) will be the first fixed releases not requiring SMUs. Customers needing patches for other releases should contact their security support organization or open a Cisco service request.
CSO OnlineCisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) contain an authentication bypass vulnerability (a flaw where attackers can skip login requirements) that allows remote attackers without credentials to execute script files and gain root access (complete control of the underlying operating system). This vulnerability is currently being exploited by attackers in real-world attacks.
Fix: Apply mitigations in accordance with vendor instructions from the Cisco security advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2), ensuring compliance with CISA's BOD 26-04 patching guidelines. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable.
CISA Known Exploited VulnerabilitiesFortinet's FortiOS, FortiSwitchManager, and FortiSASE products contain a heap-based buffer overflow vulnerability (a flaw where attackers write too much data into a memory area, causing crashes or code execution), allowing attackers to run unauthorized code through specially crafted packets. This vulnerability is currently being exploited by real attackers in the wild. Organizations must apply vendor-provided mitigations by September 12, 2026, following CISA's BOD 26-04 guidance on prioritizing security updates by risk.
Fix: Apply mitigations in accordance with vendor instructions at https://fortiguard.fortinet.com/psirt/FG-IR-25-084, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and ensure adherence to BOD 26-04 patching guidelines.
CISA Known Exploited VulnerabilitiesGoogle Chromium V8 has an out of bounds write vulnerability (a bug where code writes data outside the memory area it's supposed to use), which lets attackers run harmful code inside the browser's sandbox (a restricted environment that limits what code can access) by tricking users into opening a malicious webpage. This affects multiple browsers built on Chromium, including Chrome, Edge, and Opera, and is currently being exploited by attackers.
Fix: Apply mitigations following vendor instructions and CISA's BOD 26-04 guidance for prioritizing security updates based on risk. For cloud services, follow applicable BOD 26-04 guidance or stop using the product if fixes are not available. Organizations must evaluate each system's internet exposure and ensure adherence to BOD 26-04 patching timelines (due date: 2026-09-23). See Chrome releases blog and CISA directives for specific patch information.
CISA Known Exploited VulnerabilitiesCitrix NetScaler ADC and NetScaler Gateway contain an authentication bypass vulnerability (a flaw that lets attackers skip the login process) in alternate paths or channels. When configured as an AAA virtual server (a system that manages user access and authentication) or as a Gateway for remote access (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated attacker on the internet may be able to gain access without providing valid credentials. This vulnerability is currently being exploited by attackers in real-world attacks.
Fix: Apply mitigations according to Citrix vendor instructions at https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html, ensuring compliance with CISA's BOD 26-04 guidance for patching based on risk. If mitigations are unavailable for cloud services, discontinue use of the product. Organizations must evaluate each affected system's exposure to the internet and follow BOD 26-04 patching guidelines by the due date of 2026-09-12.
CISA Known Exploited VulnerabilitiesFix: This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
NVD/CVE DatabaseFix: The issue has been fixed in n8n versions 2.37.7 and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should: restrict n8n instance access to fully trusted users only, audit workflows attached as Agent tools and review their caller policy settings, or remove sensitive workflows from Agent tool configurations until the instance is patched. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
GitHub Advisory Database