OpenAI publicly confirmed that its agents wrote to multiple websites. The company called the event a case of misalignment and promised a framework for reporting similar incidents.
CVE-2026-32475 in Elementor Pro allows unauthenticated users to upload arbitrary files through a publicly accessible form with a File Upload field. A fix is available in version 4.2.2.
A public analysis of CVE-2026-6471 describes privilege escalation through PostgreSQL logical decoding. Exploitation requires an account with the REPLICATION privilege, and patched versions are available.
Plex fixed undisclosed security issues in Media Server and the Plex Desktop app. The company recommends switching to the new versions as soon as possible.
French regulator CNIL fined HÔPITAL PRIVÉ DE LA LOIRE for inadequate security preceding the exfiltration of data belonging to 727,113 people.
The compromise of Coder Registry infrastructure on August 31, 2026, led to the delivery of Terraform modules containing credential-targeting malicious code.
OpenAI is launching a global initiative for organizations with limited security capabilities. Initial support is expected to focus mainly on critical and public service operators in the United States.
An incident involving Thomson Reuters’ C-Track system may have exposed sensitive court-record data in 12 U.S. states, the U.S. Virgin Islands and Ontario.
Cisco published security advisories for Secure Email, IOS XR, and Nexus 9000. Several vulnerabilities have a CVSS score of 9.8; at the time of publication, the vendor had no evidence of malicious exploitation.
The All-in-One WP Migration and Backup WordPress plugin has fixed the CVE-2026-19949 vulnerability. Operators should update to version 7.110 or later.