curl 8.21.0 Fixes 25-Year-Old libcurl mTLS Bug
curl 8.21.0 fixes 18 security flaws, including CVE-2026-8932, a 25-year-old libcurl mTLS connection-reuse bug. The practical risk is in applications that embed libcurl and change client certificate settings while reusing connection pools.
Citizen Lab Says Russia Used Cellebrite on Activist’s iPhone After Cutoff
Citizen Lab says Russian authorities used Cellebrite forensic tools on activist Andrey Pivovarov’s iPhone months after Cellebrite said it had stopped selling to Russia and Belarus. The case turns phone forensics into a control problem: what happens when extraction tools keep working after a vendor cuts off a customer?
OpenAI’s Codex Data Shows AI Agents Are Becoming Workflow Systems
OpenAI’s new Codex research shows AI agents moving from coding assistants toward workflow systems that run long, parallel, delegated tasks. The strongest signal is not just developer use, but rapid growth among non-developers and organizational users.
Facebook Creator Studio Returns as an AI App for Creator Workflows
Meta is bringing back Facebook Creator Studio as a standalone AI companion app for creators. The test turns audience analytics, comment triage, and posting advice into a conversational workflow instead of another dashboard.
Mandiant Details Cisco SD-WAN Attack That Turned a Malicious CSV Into Root Access
Mandiant says an attacker used rogue Cisco Catalyst SD-WAN peering, admin password manipulation, and CVE-2026-20245 to gain root access through a malicious CSV upload. The new details make the June SD-WAN advisories an incident-response problem, not just a patching task.
Microsoft’s StealC and Amadey Takedown Hits the Credential-Theft Supply Chain
Microsoft, Europol, and security partners disrupted infrastructure used by StealC and Amadey, two malware-as-a-service tools tied to credential theft, ransomware access, and financial fraud. The operation matters because it targeted the supply chain behind intrusions, not just one malware family.
Dragos EmberAI Puts AI Security Workflows Inside the Control Room
Dragos launched EmberAI, an OT-native AI assistant for industrial cybersecurity teams. The product matters because critical infrastructure defenders need AI that understands plant assets, threat groups, vulnerable equipment, and operational impact rather than treating OT security like ordinary IT alert triage.
Meta Pauses Employee-Tracking Program After AI Training Data Exposure
Meta paused its Model Capability Initiative after reports that employee activity data collected for AI training was exposed internally. The episode shows why training AI agents on real workplace behavior needs security controls as strict as the systems those agents may eventually operate.
NASA’s Space Medical AI Test Moves Care From Cloud to Edge
NASA researchers are testing the Crew Medical Officer Digital Assistant with Red Hat’s RamaLama so astronaut medical guidance can run locally when a spacecraft cannot depend on Earth or the cloud. The work turns space medicine into a serious edge AI test case.
OpenAI’s Jalapeño Chip Puts Inference Costs at the Center of the AI Race
OpenAI and Broadcom unveiled Jalapeño, OpenAI’s first custom inference accelerator for large language models. The chip is less about replacing Nvidia overnight than controlling the cost, latency, and supply of the compute that runs products like ChatGPT, Codex, and the API.