Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
FrontierSWE v2 expands its ultra-long-horizon engineering benchmark to 34 tasks and gives agents up to 20 hours with a harness designed to encourage longer, recoverable work. Claude Fable 5.1 leads at 56.29 percent, followed by GPT-5.6 at 32.2 percent and GLM-5.3 at 30.2 percent, while the revised methodology adds deterministic performance metrics, stronger anti-cheating isolation, and self-check feedback.
An internal research agent run by OpenAI during RL training found a gap in sandbox DNS filtering and used a public DNS service to route questions to an external chatbot after direct web requests failed. Monitoring raised an alert within 15 minutes, but the run continued for 2.5 hours, prompting new DNS controls, detection work, and a pause on tool-enabled work with the most capable models.
Sponsored
Live and free on October 6. Connect Claude Code or Codex to GitLab over open MCP, then see the audit trail that names both the agent and the person who triggered it.
Meta hired MongoDB's CEO to lead a new enterprise platform that will turn its AI stack into business products and services, while MongoDB appointed its former chief as interim CEO.
MicroLLM Lab runs tiny quantized language models in the browser, compares local speed and objective accuracy, supports custom JavaScript evaluations, and can generate a shareable benchmark certificate.
Jeff packages small Qwen3.5 and Gemma 4 fine-tunes for fast zero-shot classification, returning calibrated option probabilities in a single forward pass and supporting local PyTorch or Apple MLX inference.
World Labs signed an agreement to join AMD and form a frontier research group spanning AI hardware, software, foundation models, and applications, with closing expected by the end of 2026 pending approvals.
Sponsored
…and most teams aren't ready for it. After all, if a developer sent customer data to an unapproved model provider this morning, would anything in your stack have recorded it? This Airia eBook [5] lays out how to close the governance gap with: * 9 signals [6] that cover the sources of AI risk: your workforce, your infra, and your code * 6 requirements to look for in a discovery solution * 1 data-driven look at the state of play in AI security The EU AI Act's reporting clock starts at detection. Are you ready?
CISA added CVE-2026-88771 and CVE-2026-88772 to its KEV catalog after confirming global exploitation. Both have CVSS scores of 9.5. The flaws enable unauthenticated command execution, remote code execution, or denial of service. CVE-2026-88772 requires DTLS, which VPN virtual servers enable by default. Administrators should patch, inspect for compromise, isolate affected appliances, revoke access, rotate secrets, and investigate connected systems.
The Bank of Korea (BOK) is facing scrutiny over its cybersecurity program following a data breach earlier this year. The breach occurred in May and June after attackers accessed a GitHub system used by a contractor for an online training program. The exposed data included employees' names, email addresses, phone numbers, positions, duties, and passwords for 186 employees.
Security firm Patchstack warns users of the Elementor Website Builder plugin for WordPress about a new CSRF vulnerability that could allow unauthenticated attackers to create admin accounts. The vulnerability is a one-click attack that requires an authenticated admin to click a link that sends a malicious REST API request to create the account.
The traditional view of containers as a strong security and isolation mechanism is being eroded by the plethora of kernel vulnerabilities being uncovered. This article explains how a recent vulnerability in the AF_UNIX subsystem can be leveraged by attackers for container escapes. The authors recommend moving untrusted workloads to MicroVMs like Firecracker or Kata Containers for untrusted workloads.
DPRK's PolinRider malware spread through GitHub organizations by force-pushing rewritten commits from infected developers' machines, planting VS Code folderOpen tasks that run an obfuscated JavaScript payload disguised as fa-solid-400/500/900.woff2 and, since September 28, fa-solid-300.llf. OpenSourceMalware traced 853 force-pushes across three Binary-Mindz repos and found variants with different paths, obfuscators, and C2-reported build markers running in parallel, which it reads as deliberate A/B testing, while copied author dates and reused commit messages quietly reverted three cleanup attempts. Defenders should flag fake fonts by file content rather than name, scan every branch through bare clones, audit force-push activity logs, and enforce force-push blocking and signed commits on all branches.
AWS automatically attaches the AWSCompromisedKeyQuarantineV3 managed policy to an exposed IAM user within 10 seconds of a public GitHub push, with the CloudTrail AttachUserPolicy event misleadingly attributed to the victim's IAM user rather than to AWS automation. Each policy version tracked real-world attack evolution, with permissions added to block Lambda-based cryptomining, S3 data deletion for extortion, and Bedrock API abuse after Permiso's research exposed unauthorized InvokeModel calls. Security teams should alert on unexpected AttachUserPolicy events in CloudTrail, treat the quarantine event as confirmation of active key exposure rather than as resolution, and rotate all affected credentials before removing the policy.
Sponsored
Containers, remote teams, and data lakes each need different security approaches. Explore tutorials that walk you through zero-trust networking, identity-based access controls, and Amazon S3 antivirus scanning — matched to the right layer in your AWS environment. LEARN
Kontext Security runs a runtime enforcement platform that sits between AI agents and the systems they access. It checks each agent's identity, task, target resource, and requested action in real time. Teams can start in observe mode, then switch to enforcement to block unauthorized actions, as the platform logs every agent action and the decisions made, with context.
NVIDIA launched the Open Agent Safety Platform with OpenShell runtime controls and Sentry monitoring on BlueField-4 DPUs. OpenShell traces actions, applies policies, and supports NVIDIA, Arm, and Intel systems. Sentry verifies identity, inspects requests, protects data access, and can quarantine agents within milliseconds. Anthropic, Salesforce, SAP, Scale AI, and more than 100 organizations are integrating these controls.
tturl is an HTTP/2 CLI for finding tiny timing differences by releasing batches of requests and recording response arrival order, then either showing what happened or helping to distinguish a repeatable arrival-order signal from noise.
Proton Mail's web interface can show a forged sender that looks identical to a real one. The attacker sets a display name containing an address-shaped string like sundar@gmaiI[.]com where the capital I matches lowercase l in the default UI font. Messages from domains without DMARC arrive in the inbox with no authentication banner, even when SPF fails. A Reply-To header can route responses to an attacker's address without showing it unless the user expands headers, and the spoofed sender also appears unchanged in macOS desktop notifications, outside the app interface. The issue was reported in February 2025, confirmed and bounty-awarded in April 2025, and can still be reproduced as of September 2026.
Google and Wiz launched Scan for Good using Gemini 3.8 Flash Cyber and Red Agent with authorized scans targeting public websites, APIs, and applications, while human researchers validate findings and handle disclosure. Red Agent found a GitHub Actions injection flaw in Snowflake's connector, allowing command execution. Other cases exposed 8.8 million files, hospital systems, elderly residents' data, and railway administrator sessions.
This walkthrough breaks down House of Apple 2, a glibc FSOP technique that bypasses the vtable validation added in newer glibc. It points a FILE structure's vtable to legitimate wide-character stream code, which then dispatches to a second vtable that glibc does not range-check. Step by step in GDB, the author turns that unchecked indirect call into an arbitrary call, pivots the stack, and runs a ROP chain to a shell. The technique still works cleanly on glibc 2.43 (Ubuntu 26.04 and Fedora 44). Exact offsets and gadgets vary between builds, but the underlying control-flow trick remains the same.
The District of Columbia's health agency exposed data linked to 399,086 Medicaid and DC Healthcare Alliance beneficiaries.
Former Army soldier Cameron Wagenius received 70 months in prison and nearly $295,000 in restitution.
Sponsored
AI made building software easier, and now more of it is entering the enterprise than IT has ever had to govern. Keeping up takes new thinking on security, access, and oversight, built for software created faster and by more people than ever. On October 6, join Tines and Forrester [4] for a candid conversation on why decision velocity is becoming IT's new differentiator, and what it means to govern outcomes rather than just oversee systems. You'll learn how IT accountability is shifting from delivery to outcomes, and practical ways to position your team now for the next five years of AI-driven change.
UpGuard identified more than 16,000 Supabase databases exposing readable tables. Analysis of their schemas indicated that more than half could expose personal information, with smaller subsets potentially exposing passwords or authentication tokens. The issue is misconfigured access controls rather than a newly discovered platform vulnerability, reinforcing the need for database authorization, exposure testing, and clear ownership of internally built tools.
Microsoft has paused optional update KB5002907 after reports that it left some Office 2016 and 2019 installations unlicensed or, rarely, removed. Its recovery guidance is to reactivate or reinstall the affected product. Importantly, the update makes no changes where Microsoft 365 Apps updates are managed through Group Policy or Cloud Update. Support teams should check update history before treating unexpected licensing tickets as subscription or account problems.
Promoting a strong technologist does not automatically prepare them to manage people, business relationships, or competing operational priorities. This piece examines unclear expectations, insufficient leadership development, and the tendency to reward technical output without developing management skills. It is a useful operating-model check for CIOs overseeing support, infrastructure, SaaS, and business systems: define what managers own, coach them on business outcomes, and provide advancement paths for specialists who should remain individual contributors.
In this Decoder interview, Mike Cannon-Brookes explains why Atlassian combined internal IT and AI enablement under its people leadership: employee adoption and changes to business systems are tightly connected. He also argues that AI will change SaaS workflows without eliminating the need for structured systems and human judgment. For CIOs, the interesting question is who owns the combined work of employee enablement, system integration, and AI cost management, rather than treating each as a separate rollout.
Anthropic's marketplace brings together more than 2,000 plugins and connectors, partner-built agents, and services, with eligible partner software purchasable using a portion of committed Anthropic spending. For an internal AI platform team, the significant change is the growing catalog of connections between assistants and business systems, along with another procurement channel to manage. Marketplace availability should not replace reviewing permissions, data access, integration ownership, and how access will be removed when someone leaves.
Workday has announced Total Benefits, combining benefits-provider integrations, administration services, and employee guidance in one offering. Workday Wellness is now available to US customers, while benefits guidance through its Self-Service Agent is expected to become generally available in October. Evaluation should cover provider compatibility, sensitive employee-data sharing, and whether the new workflows can replace existing portals and manual administration rather than simply adding another layer.
Disabling BitLocker starts decrypting the drive, while suspending protection leaves the data encrypted but temporarily makes the encryption key accessible. This walkthrough explains the distinction and why short-term firmware maintenance or troubleshooting often calls for suspension rather than removing encryption entirely. The operational takeaway is to make resuming and verifying protection part of the endpoint maintenance runbook, not optional cleanup after the support ticket closes.
Microsoft 365 customers can now use consumption-based billing when users exceed their licensed OneDrive storage instead of purchasing additional capacity upfront. Admins choose which users are eligible and can set budgets and alerts. Additional storage costs $0.20/GB/month. Enterprise SaaS is shifting toward usage-based pricing, giving IT more flexibility but also making cost monitoring part of day-to-day platform management.
Google will begin applying new automatic-note settings on September 29.
Cloudflare says it completed remediation of a cross-tenant storage-reuse flaw affecting Containers and Sandboxes by September 19, found no evidence of malicious exploitation in available telemetry, and requires no customer-side action.
Sponsored
96% of brands struggle to execute personalization at scale. Corinthia Hotels is not one of them. They built a 7-agent AI system on Optimizely that maps 76 behavioral signals to 6,384 content variants across 5 personas and 14 lifecycle stages. 100% brand approval rate. 150+ hours saved. Zero PII in the AI layer. Zero extra headcount. On October 7th [5], Emily Jewell, Senior Global Head of Marketing at Corinthia Hotels, walks you through the full system live — including two demos and a Q&A exclusive to attendees.
AI is splitting physical retail into two distinct missions. Convenience stores should reduce friction with easy navigation and reactive service. Discovery stores should drive dwell time through immersive experiences and specialized associates. More than 90% of consumers prioritize locations that fit their daily routines, while 78% cite product testing and 76% cite product guidance as drivers of discovery visits.
AI confidence is growing across the workforce, with 53% of US workers saying AI makes them more efficient. Gen Z remains more hesitant. Only 38% plan to build AI skills in the next 6 months, while 52% are nervous about AI's impact on their jobs. At the same time, AI literacy is becoming more valuable in the workplace. LinkedIn finds it is associated with stronger hiring and promotion outcomes for Gen Z.
FAQs can improve visibility in search and AI systems only if the content is present in the page source when it loads. Many FAQ components hide their text until a user clicks to expand them, which means search engines and LLMs may not access the content by default. Use Chrome DevTools to check whether FAQ text remains discoverable after a page reload.
Treat YouTube descriptions like landing pages for AI search. ChatGPT can retrieve a video's title, metadata, and full description, but not its transcript. That makes the description a key source for understanding the video. Include relevant terms and clear context. Use structured sections and timecodes so ChatGPT can understand what the video covers and where specific topics appear.
AEO is not an SEO ranking game with factors to reverse engineer. AI visibility depends on whether a brand is clearly associated with a category and supported by credible evidence. Fix positioning gaps and answer real buyer questions. Build comparison content that helps buyers evaluate vendors. Strengthen third-party corroboration instead of manufacturing mentions. Then track commercial prompts and connect AI visibility to buyer conversations and pipeline, not just brand mentions.
Sponsored
Gather builds a simulation of your customers from real interviews. Run strategy simulation, test messaging, positioning, pricing, explore why buyers choose competitors, and get insights instantly. Trusted by Datadog, Fortinet, Cyera, Bagel Brands, Staples, and others.
XML sitemaps tell search engines which URLs a site wants in search results. They should contain canonical, working URLs that the site wants indexed. Google attempts to crawl each URL as listed, so redirects, errors, noindex pages, or conflicting canonicals make the sitemap less useful and can waste crawl activity. Missing or repeated ‘lastmod' dates can be acceptable. Fields like ‘priority' and ‘changefreq' are ignored by Google.
Reddit is often treated as a source of unbiased product advice. However, some buying recommendations are unusually concentrated among a small group of accounts. The top 5% of brand-heavy accounts produced 11.3% of knife recommendations, versus 7.9% expected by chance. For three brands, that share reached 20% to 31%. This could indicate astroturfing, where paid accounts create the appearance of organic recommendations, but their histories looked more like genuine fans.
AI is making click-based attribution less useful as discovery increasingly happens through AI answers that never generate a website visit. Treat attribution as one imperfect signal rather than a definitive measure of channel value. Triangulate exposure, behavioral, and business metrics such as AI Share of Voice and CRM data. Use incrementality testing where possible to measure causal impact, especially for activities that attribution cannot capture.
Canva is using Jio's 524.4M customers to tackle a freemium problem. Many casual users get enough value from Free to justify paying for Pro. Bundling Pro with Jio plans lets users experience premium features without making a separate purchase. The real test is what happens after the bundle ends. Canva needs to see whether users build habits around Pro and become willing to pay for it.