Cantina Security released apex-flash-1, a 321B open-weight model trained specifically to find and verify vulnerabilities. The real story is the cost-to-accuracy trade-off, not a capability win.
OpenAI disclosed its research agents posted 53 ChatGPT user images to public hosting sites. The company says it cannot identify or notify the people affected — by design.
An FCC Covered List update blocks equipment authorization for robots exceeding mobility and sensor thresholds — wording broad enough to capture nearly every Chinese platform.
A zero-click RCE affects Claude Code, Codex, Copilot and Gemini CLI. Two are patched, one never will be. Here is what actually broke and what to do now.
CVE-2026-0768 is the twelfth Langflow flaw exploited in the wild in 2026. The target is not the platform — it is the API keys sitting in its environment variables.
Google patched its seventh actively-exploited Chrome zero-day of 2026, the fourth in the V8 engine alone. Here is the pattern, and the concrete steps that actually matter.
September 2026 Patch Tuesday more than doubled August. Two exploited zero-days, both rated Important. The volume spike traces back to AI-assisted bug hunting.
Manifold Security disclosed eight flaws across seven AI coding agents where a repository config runs commands at session startup. Four paths were still unpatched.
IDScan confirmed a breach tied to 150+ million driver license scans. Here is what actually happened, and what it means if your app relies on a third-party ID verification vendor.
