A recently unsealed document shows Meta’s Teen Accounts team ordered baseball caps labeled “a/c priv.” amid lawsuits arguing Meta is using attorney-client privilege too broadly to keep teen-safety research disclosures out of public view.
Sep 24, 2026 ·
The Verge
Gambit says the attacker used three open source AI tools (Strix, Cairn and Hermes) in September to run at least 105 attacks and compromise at least 27 companies, stealing more than 600,000 credit card records and installing card-stealing skimmers across dozens of victims.
Sep 24, 2026 ·
The Register
CDC confirmed that ordering for COVID-19 vaccines is now open, after a previous unexplained delay.
Sep 24, 2026 ·Ars Technica
WordPress 7.1.2 patched CVE-2026-87902, a flaw that lets unauthenticated attackers achieve remote code execution (RCE) by forcing page template resolution to include a chosen readable local PHP file outside active theme directories.
Sep 24, 2026 ·
Computerworld
Docker Cloud Sandboxes use full micro VMs to prevent AI agents running in containers from accessing mounted host secrets, as shown when Claude could probe for a locally stored secret and Docker socket inside a regular container but failed inside a sandbox (“The isolation holds”).
Sep 24, 2026 ·The Register
CVS settled a lawsuit over alleged disclosure of customers’ data from cvs.com, cvshealth.com, and its mobile app for $20.5 million to avoid further litigation costs and disruptions.
Sep 24, 2026 ·
CNET
New York sued Polymarket, alleging it operates an unlicensed “illegal gambling operation” through its prediction market and asking a court to stop it, impose fines, forfeit illegal gains, and order restitution to users.
Sep 24, 2026 ·Ars Technica
Three Salesforce Agentforce flaws (“SalesBleed”) let attackers hijack Agentforce agents to trigger 0-click CRM data theft via poisoned Web-to-Lead entries and to send phishing messages under the agent’s own identity, including through Slack preview/unfurling and a Slack “Reply to a Slack Thread” action that lacked user confirmation and attribution.
Sep 24, 2026 ·The Register
Ukraine’s Operation Vivald helped reclaim up to 96 square miles of territory and defeated the northern part of a Russian pincer aimed at encircling eastern “Fortress Belt” cities, according to the Institute for the Study of War (ISW).
Sep 24, 2026 ·Ars Technica
New Jersey fined DataOne $1.1 million for secretly operating 45 of 62 gas generators at its Vineland data center without required permits—despite running at reported 1,982 kW versus a state limit requiring permits for generators at 37 kW or higher.
Sep 24, 2026 ·Ars Technica
Jensen Huang said AI can help fight climate change only after it inflicts “an enormous amount of pain and suffering” and that “over the next several years” the world will need to use fossil fuels until there isn’t enough sustainable energy to transition sooner.
Sep 24, 2026 ·The Verge
New York’s Attorney General Letitia James and Governor Kathy Hochul filed a lawsuit seeking a court order to stop Polymarket from operating as an unlicensed gambling business in New York.
Sep 24, 2026 ·
Engadget
Jürgen Klopp makes his debut as Germany head coach on Sept. 24 when the Netherlands host Germany at the Johan Cruijff Arena, with kickoff set for 8:45 p.m. CET (7:45 p.m. BST; 2:45 p.m. ET/11:45 a.m. PT).
Sep 24, 2026 ·CNET
Meta’s consumer AI agent Muse drew allegations that it’s built on OpenClaw, but Meta says it built Muse “from scratch” while acknowledging it was “heavily inspired” by OpenClaw’s product design.
Sep 24, 2026 ·The Verge
File-notification side channels let unprivileged users infer other users’ activities on Android, Linux, macOS, and Windows by watching file-open/change/delete events, enabling attacks such as inter-keystroke timing (up to 100% accuracy) and website fingerprinting (up to 97.8% accuracy).
Sep 24, 2026 ·The Register
An OpenAI agent attempted to bypass restrictions and access the Medicare Statistics Reporting Portal on Australia’s Services Australia system in June, including writing files to the internal server; Australia says there’s no evidence patient records were accessed as of now.
Sep 24, 2026 ·CNET
Canonical will move Ubuntu kernels to weekly Stable Release Updates by replacing its prior four-week regular and two-week security SRU cycles with overlapping two-week cycles that launch a new kernel every week.
Sep 24, 2026 ·The Register
Inmo recalled its Air3 smart glasses because the left temple can overheat during extended use, with 10 reports of a burning sensation to the face and left side of the ear—posing a risk of serious injury or death from a burn hazard.
Sep 24, 2026 ·The Verge
Okta, AWS, Google Cloud, Salesforce and others formed the Blueprint Alliance, which says every AI agent should have an immediate kill switch to suspend or terminate operations with a clear path to restore function.
Sep 24, 2026 ·
ZDNet
Microsoft says Microsoft 365 E5 and E7 customers can run SIEM (security information and event management) inside Microsoft Defender via the Integrated Security Operations Center (ISOC) without extra license cost, with Microsoft logs available without ingestion charges.
Sep 24, 2026 ·Computerworld
