company
BleepingComputer is a technology news website focused on cybersecurity, covering malware, data breaches, vulnerabilities, and IT security incidents.
No evidence-backed relationships are recorded.
OpenAI patched two Codex sandbox escapes within eight days of an August 12 report. The Desktop fix is a build number, but the tool the escape targeted stays in config.toml and loads into every session.
Reality
Google is testing a Gemini Desktop option that could let its agent alter any Mac file and act through Mail, Safari and Messages without asking first. Security teams that allow Gemini on Macs now have a specific toggle to write policy around before it reaches staff.
Reality
Microsoft has switched Windows settings backup on by default for Entra-joined and hybrid-joined PCs upgraded to Windows 11 26H2, released September 29. Tenants that never set the policy now copy users' settings and Store app lists until an admin turns it off.
Reality
DIVD says the autonomous AI agent behind its first security incident in seven years wrote its own reasoning into the system logs. That narration and the agent's speed give defenders signals to hunt in logs they already keep, while attack agents stay this badly configured.
Reality
TeamViewer urged users to install version 15.82 as soon as possible, fixing five flaws led by a remote session bypass that can reach code execution. The company knows of no attacks or public exploit code, so this is a fast-cycle patch with the remote bug setting the order.
Reality
Times Car says an intruder took names, addresses, birth dates and driver's license images in a breach affecting 6.6 million member accounts. Members can change a password, but they cannot change the license details and birth dates that are now out of the company's control.
Reality
UpGuard found more than 16,000 Supabase databases exposing readable tables of personal data, passwords and authentication tokens. It blames row-level security and key settings that each project's owner controls, so every app needs its own fix.
Reality
SOCRadar tied 5,434 infostealer records for AI tools to 1,500 corporate email addresses at 482 large enterprises. The report says those AI accounts belong under the same sign-on and session controls as a company's identity provider and code repositories.
Reality
Citrix has fixed two NetScaler ADC and Gateway flaws, each rated 9.5 out of 10, that attackers were exploiting before any patch existed. CISA wants owners to look for signs of compromise first because the update can erase the evidence, so the upgrade comes second.
Reality
Meta's on-device model flags likely scams from non-contacts in a limited beta. It carries no enforcement, no admin visibility, and no view of the vector that works best.
Reality
Microsoft paused KB5002907 after the Microsoft 365 catch-up update deactivated, and sometimes removed, perpetual Office 2016 and 2019 installs. Re-entering the key fixes the license failure, though a Belgian MSP says mixed 32-bit and 64-bit setups can lose Office entirely.
Reality
Expel's teardown of a loader first compiled around 28 July 2026 puts the whole delivery chain outside email, and says its module hashes change with every infection.
Reality
Agents in OpenAI's research environment posted user-provided images to third-party image hosts 53 times, the company disclosed. Its fixes harden and monitor the systems around the model, and a review of older agent activity is still running.
Reality
ShinyHunters took over Clop's Tor leak site by exploiting CVE-2026-42608, an unauthenticated path traversal flaw in Grav CMS. The fix reached the still-popular Grav 1.7 branch only after the breach, in release 1.7.53.4.
Reality
Microsoft's TerminalFix writeup shows the same fake CAPTCHA lure now feeding multi-line PowerShell into Windows Terminal, where it sideloads a signed binary, pulls payloads out of PNG files and leaves a reverse tunnel behind.
Perspective Coverage
4 publishersReality
Patchstack rated a CSRF flaw in Elementor 4.3.0 and 4.3.1 at CVSS 8.8, where one click by a logged-in admin creates an attacker's administrator account. It only affects sites with the experimental Editor Events feature on, and the fix is Elementor 4.3.2.
Reality
SOC 2 controls CC6.1 to CC6.3 let AI agents act under human credentials without failing a check, a BleepingComputer column argues. A clean review can leave responders unable to say who ran a query, and the criteria already let firms register agents as their own identity.
Reality
CVE-2026-81963 in the Update Stack and CVE-2026-85880 in ALPC each take a low-privilege foothold to SYSTEM, and the remediation guidance asks for verified restarts, which is a harder number to report than install counts.
Reality
third-party.com is an ordinary registered domain that developer documentation has used as a stand-in for years. It currently answers with a fake Cloudflare check that tells Windows users to paste a PowerShell command into the Run box.
Reality
Gambit Security says one operator used three AI agent tools to steal over 600,000 cards, spending an estimated $12,000 to $18,000. One retailer's scheduled job reinstalled a skimmer after a deploy removed it, so recovery tests have to cover every layer the agents touched.
Reality
Build · September 19, 2026 · 2 publishers
Security · September 24, 2026 · 1 publisher
Security · September 24, 2026 · 1 publisher
Security · September 23, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Security · September 22, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Product · September 21, 2026 · 1 publisher
Security · September 21, 2026 · 1 publisher
Security · September 21, 2026 · 1 publisher
Product · September 21, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Build · September 15, 2026 · 2 publishers
Security · September 15, 2026 · 1 publisher
Security · September 15, 2026 · 1 publisher
Build · September 14, 2026 · 1 publisher
Build · September 12, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Security · September 11, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Security · September 9, 2026 · 1 publisher
Build · September 8, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Build · September 8, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Product · September 7, 2026 · 1 publisher