Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Mastercard and Trip.com have joined forces to showcase AI-powered booking experiences for the travel sector. Powered by Mastercard's Agent Suite for Merchants and in partnership with Network International, the organizations are showcasing how consumers will be able to search, book, and complete purchases through Trip.com's AI agent TripGenie.
Primary Venture Partners argues that the strongest enterprise AI companies will win not by owning the best models, but by turning real-world workflow experience into compounding expertise. Their framework centers on “scorebooks” and continual learning loops that capture context, decision traces, expert feedback, and business outcomes, allowing domain-specific applications to improve across customers and build defensibility through workflow ownership, implementation depth, and accountability.
AI will erode many traditional software moats by making products cheaper to replicate, migrations easier, and integrations more automated, pushing the industry toward a barbell structure. A smaller number of dominant platforms will try to own entire buying centers through relentless product expansion and scale, while an explosion of tiny, niche software businesses emerges at the other end, leaving mid-sized point solutions increasingly squeezed out.
The venture arm of Nasdaq announced it is investing $100M into Payward, the parent company behind crypto exchange Kraken, at a $21B valuation. The deal strives to make Kraken a major distribution platform for Nasdaq's tokenized equities, which are set to go live in 2027. This comes as the asset class hit a record $6B in monthly on-chain trading volumes in August.
Sponsored
Payment and banking infrastructure compliance mandates least-privileged access restricted to the minimum per job function. Siloed audit logs lack the identity context to provide an audit trail without manual work across systems. Teleport [15] offers a guide that explains how certificate-based authentication solves these challenges,
American Express is expanding beyond cards with a new high-yield Business Savings account, grouping it with Business Checking under a broader “Business Banking” offering. Amex also plans to add Gusto-powered payroll, AI-driven payroll insights, and direct redemption of card rewards into checking, pushing toward a more complete operating account for small businesses rather than just a payments relationship.
Radical Ventures launched its multi-billion-dollar Radical Breakouts Fund with a first close of more than $1 billion, backed by major Canadian pension funds and banks including CPP Investments, PSP Investments, HOOPP, TD, and BMO. The fund will target late-stage AI companies in Canada and globally, reflecting a push to give Canadian scaleups access to the kind of large private-growth capital that has historically been concentrated in the US.
Klarna is powering Apple's new US device leasing program, including financing for the $1,999 foldable iPhone Duo and $1,199 iPhone 18 Pro, with 12- or 24-month terms that let customers upgrade, buy out the device, or return it. The partnership gives Klarna a major distribution win after failing to land Apple more than a decade ago, while helping Apple push hardware toward a subscription-style model that could encourage more frequent upgrades.
Saudi Arabia-based Tabby raised $233 million in a Series F led by Blue Pool Capital, valuing the BNPL fintech at $6.5 billion, up from $4.5 billion last year. Tabby plans to use the capital to deepen its presence in Saudi Arabia and the UAE, where it is expanding beyond BNPL into larger consumer financing, working capital and cash-account products, while processing more than $18 billion in annualized transaction volume across 25 million registered users.
Robinhood plans to add one-for-one share redemptions and voting rights to its Stock Tokens, addressing criticism that the products currently provide only economic exposure without actual shareholder rights. The shift follows backlash from AMC CEO Adam Aron and comes as Coinbase and other tokenization platforms push toward structures that more closely replicate traditional equity ownership, including redemption, dividends, and voting.
Grab agreed to acquire a 60% stake in Atome Financial for $1.49 billion in cash, giving it control of the SoftBank-backed consumer finance company.
Wells Fargo announced the nationwide launch of ExpressSend Mobile, bringing its international money transfer service into the Wells Fargo Mobile app.
A human attacker exploited CVE-2026-39987 to achieve pre-authentication remote code execution and harvest cloud credentials from Marimo notebooks. The Sysdig Threat Research Team observed the operator pivot from the vulnerable terminal WebSocket endpoint to an SSH bastion host in eight seconds to access an AWS Secrets Manager SSH key without using large language models. Defenders must focus detection efforts on the shape of the attack chain rather than specific operator fingerprints, because prompt injection traps designed for AI agents failed to identify the human actor.
China-linked UNC3569 used a single crafted link to gain system-level code execution through Sogou Input Method, Tencent's Chinese-language keyboard app used by hundreds of millions of Windows users, and deployed its GrayRabbit backdoor. Gen Threat Labs found that CVE-2026-51990 chained argument injection in the sgbiz protocol handler with a bundled Chromium 80 browser that was six years out of date, ran without a sandbox, and dropped same-origin protections. Tencent patched the injection bug in version 16.3.0.3498, but the outdated Chromium engine behind the chain remained unchanged as of September 10.
CenterPoint Energy confirmed an attacker pulled customer data through an external-facing API on September 12. A hacker using the alias "4d722e4d656f77" claims 7.49 million records, including names, phone numbers, billing addresses, account numbers, payment status, and partial Social Security numbers. The attacker says the API lacked WAF protection, rate limiting, and JWT/auth tokens, and stopped only after a CAPTCHA was added.
JA4 is a TLS fingerprint that shows how a client connects, not just where it connects to. Unlike JA3, part of it is readable, so hunters can see the TLS version, SNI, cipher count, and ALPN at a glance. The post includes KQL queries to pull these values from Entra ID sign-ins and Defender network logs, so teams can learn what normal looks like and spot clients that don't match.
A £3 Z05L WiFi extender uses an MT7620 chip and a four-megabyte Winbond flash. Its firmware starts Telnet on every boot with root password 198277tt@, and the web API accepts requests without session checks, so a mac parameter can reach system() without validation, allowing root command injection. Firmware updates verify CRC32 values only, allowing forged images, and the firewall leaves inbound services exposed on bridged networks as the config partition stores WiFi credentials in plaintext.
CVE-2026-90894 lets a non-admin macOS user gain root through Parallels Desktop's appliance installer. JFrog tested Desktop 26.4.0 build 57513 on Apple Silicon. The root daemon exposes a world-writable Unix socket where an unsigned local process can authenticate through PrlSrv_LoginLocal. A quote in sVmParentPath injects tar's --use-compress-program option, and tar then launches an attacker script as root. Parallels released version 27.0.0 on September 1 to fix this issue.
Sponsored
If you're reading this ad, you know they work. TLDR subscribers make a deliberate choice to open their inbox every weekday. You reach security engineers, CISOs, and infosec leaders at the precise moment they're most receptive to new information shaping their work. Become a TLDR sponsor. [10]
Entrust added Cryptographic Bill of Materials (CBOM) import and export to its Cryptographic Security Platform, so teams can map which systems depend on weak or noncompliant keys and certificates and fix the riskiest first. The update also brings Ansible-based certificate automation, composite algorithms for phased post-quantum migration, and SPIRE support for AI agent and workload identities. The platform now runs as a service or on-premises, which matters as DORA, NIS2, and the recent US Executive Order push for CBOM-based inventories.
Hackuity consolidates vulnerability and asset data from 130+ security products and ranks flaws by severity, exploitability, asset criticality, threat activity, and business impact. Teams can assign and coordinate remediation across security, IT, cloud, and engineering.
vol-rs is a port of the Volatility 3 memory forensics framework from Python to Rust.
WSO2 API Manager CVE-2026-5430 is under active attack. Forged JWTs using unsupported signing algorithms can bypass authentication and grant administrator access in affected deployments, including API Manager 4.1.0–4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Captured tokens carried admin privileges, and attackers may access backend endpoints, credentials, consumer keys, application secrets, and internal services.
An in-depth guide to how the author decided to reverse-engineer Apple's Find My system to register a Linux device and (consensually) track a friend. The author first started by attempting to use the iCloud web API but quickly discovered that it didn't support Find My. After reversing and fuzzing the flow, the author was able to reproduce the process by: authenticating to Apple's private service, registering the Linux machine as an IDS client, receiving the existing Find My share key, and using it to fetch and decrypt the friend's latest location.
A new AI regulatory framework, the FRONTIER Act, includes a provision that would require third parties to audit the safety of new frontier models. Rep. Josh Gottheimer pushed back and stated that frontier models should instead need to be submitted to the federal government for a short-clocked review cycle before release.
Oracle's September 2026 patch update fixed over 800 vulnerabilities across 17 product families, including more than 100 critical flaws and over 240 exploitable remotely without authentication.
Attackers are exploiting CVE-2026-76461, a 9.8 flaw in Cisco Secure Email Gateway appliances.
Sponsored
Ungoverned AI does not wait for your risk program to catch up. It is embedded in software you already license, deployed by teams that never routed it through review, and operating without an audit trail. The State of Enterprise AI Risk covers the five sources of enterprise AI risk, the frameworks that actually matter, and what to fix before your board or regulators ask the accountability question.
A Deloitte study found 63% of UK workers have used generative AI for work, while 31% are using it without their employer's knowledge and 17% are personally paying for at least one AI tool. For IT teams, the takeaway is less about stopping AI adoption and more about getting approved tools, training, data controls, and governance in place before shadow AI becomes the default.
Salesforce suffered a widespread service disruption on September 16 that caused severe delays, intermittent errors, and access problems across regions, with Salesforce attributing the issue to increased load on a core system component. Google Drive separately experienced a 37-minute disruption the same day — a useful reminder of how much employee productivity now depends on a small number of SaaS platforms and why IT still needs outage communications and fallback processes even for highly resilient cloud services.
Google is rolling out MCP-based integrations that let Gemini interact directly with Salesforce, HubSpot, Asana, Monday, QuickBooks, Mailchimp, and Atlassian Rovo from Gmail, Docs, Drive, Sheets, Chat, and other Workspace apps. The important admin detail: third-party connectors are enabled by default for users with Gemini access, although IT can control them by domain, OU, or group, making this something Workspace admins should review rather than simply treat as another end-user AI feature.
An application becomes an enterprise app based on business dependency rather than its technology, development speed, or where it is used. As AI coding agents enable employees to build software quickly, organizations must recognize that apps transition into enterprise software when the business relies on them to operate, requiring appropriate governance, support, and security as risks and user counts grow.
Gartner expects companies to face new operational problems ranging from AI “cost exhaustion” attacks to a flood of disposable AI-generated applications. One especially relevant prediction for IT: organizations will increasingly need real-time AI cost controls, while CIOs take greater responsibility for proving that governance and guardrails around AI actually exist and work.
Starting with Chrome 155, extensions that use Chrome's powerful chrome.debugger API will be blocked from attaching when enterprise policies restrict host access, screenshots, or DLP-protected content. The change only affects managed browsers with those policies configured, but IT teams with internally developed or approved extensions should test ahead of the October 6 stable rollout because some extensions may stop working unless they move to more limited Chrome APIs.
Rivet has announced the release of Rivet BYOC (Bring Your Own Cloud), a control plane deployed inside a customer's AWS or Google Cloud VPC and managed by Rivet. The offering allows data and compute to remain in the user's account while Rivet handles deployments, updates, and maintenance via an operator running in a Kubernetes cluster.
Google introduced reusable Workspace skills that package an organization's prompts, rules, templates, and reference material so Gemini can repeatedly follow the same process across Gmail, Docs, Drive, Chat, and Workspace Studio. Teams can collaborate on skills like documents, while centralized governance and Admin console distribution are coming, effectively turning internal procedures into reusable AI automations.
Salesforce has evolved its Well-Architected Framework to address the complexities of the Agentic Enterprise and interconnected autonomous systems. The updated framework is organized around five pillars: Trust, Reliability, Operational Excellence, Resource and Cost Optimization, and Fairness, each featuring a dedicated Agentic Enterprise lens.
Tracking Model Context Protocol (MCP) servers on employee devices is an endpoint inventory problem rather than an identity or network issue, because servers are launched locally via hand-edited configuration files without admin consoles or SSO logs. To maintain a complete inventory, security teams must read per-client configuration files across the fleet to resolve the actual entrypoints, package versions, and environment variables in use.
Dreamforce put a growing disagreement among AI leaders on display, with Anthropic's Dario Amodei calling for stronger guardrails and a slower pace at the frontier while Nvidia's Jensen Huang argued against broadly slowing development. Regardless of which approach wins out, enterprises deploying agents will increasingly need their own standards for what models and capabilities they are willing to allow.
AIUC raised $40 million to expand a third-party testing and certification standard for enterprise AI agents, evaluating risks including prompt injection, jailbreaks, data leakage, hallucinations, and unauthorized actions. The interesting part for IT and security teams is the emerging idea of a SOC 2-like independent assurance layer specifically for the agents companies are being asked to approve.
This guide outlines the best knowledge engine platforms in 2026 and differentiates them from underlying components like vector databases and metadata catalogs.
Microsoft's KB5002914 update can cause paste operations to silently fail in Excel 2016, 2019, 2021, and 2024.
Sponsored
Don't be sloppy. When others choose AI overload, put people back into every stage of your pipeline. Vidyard's _Video in Motion_ report [5] shows you how the marketing teams that still engage buyers are using video to drive human connection. These 8 plays [6] are driving: * 300% higher click-through rates * 27% higher engagement * 38% higher win rates
Google is reducing publishers' opportunities to earn search traffic as AI features take up more space. New sports features bring play-by-play updates and fantasy recommendations directly into Search. OpenAI is reportedly restricting some competitor ads in ChatGPT. Meanwhile, 41 of the 50 biggest US news sites saw traffic decline year over year. Several publishers have linked traffic losses to AI Overviews and AI Mode, while some are responding by investing more in direct audiences and reducing reliance on search.
Traditional ads are losing attention as consumers tune out repetitive, sales-heavy formats. 88% of Gen Z and millennials ignore most ads, while 85% stay loyal to brands that feel genuine. Activity-based campaigns offer a different approach by motivating people to participate rather than simply buy. 65% of consumers say they're more likely to engage with or purchase from brands that motivate people to get active.
Test 1700×1080 landscape for larger covers, 1200×1500 portrait with bolder text, or two-slide carousels that display at full width. Focus on formats that maximize in-feed visibility and drive engagement with your audience.
Instead of chasing high-volume keywords, map prompt journeys around the final recommendation a buyer wants, then create content around the decision factors that inform it. LLMs can route users from broad questions to specific recommendations, so owning the highest-volume prompt matters less than being cited for the factors behind the purchase decision. Start with bottom-funnel prompts, map adjacent questions, and build content that answers them.