OpenAI’s ChatGPT Mil is now available to more than 3 million U.S. military members and civilian defense employees through the secure GenAI.mil platform. The IL5-accredited service brings ChatGPT’s familiar interface to Controlled Unclassified Information (CUI) workflows, while adding another model to the U.S. military’s growing enterprise AI environment.

Source

Google has completed its permanent Manifest V2 purge from the Chrome Web Store. Existing MV2 extensions may continue running on older Chrome installations, but they can no longer receive updates, be reinstalled after removal, or be recovered from Google if an administrator or user deletes them.

Source

Microsoft has released KB38982839, a security hotfix for System Center Configuration Manager (SCCM) that addresses issues in the SMS Provider and administration service. It applies to Configuration Manager 2603, 2509, and 2503 systems that have the required prerequisite rollups, but administrators should plan for a site reset and manually update existing secondary sites.

Source

MCP servers have moved from an emerging AI integration standard to an actively targeted attack surface. Wiz observed sustained attacks against internet-facing AI infrastructure, including authentication bypasses and command injection against LiteLLM MCP components that can lead to remote code execution.

Source

CrowdStrike is moving Project QuiltWorks from largely manual AI-security assessments to automated workflows with Falcon IQ, a new Falcon platform capability built around more than 50 specialized agents. The launch also expands the data and infrastructure available to security teams through new vendor telemetry, Snowflake integration, and an upcoming Google Cloud deployment.

Source

Debian 11 “Bullseye” reached the end of its Long-Term Support period on August 31, 2026. Debian will stop providing security updates in September, leaving administrators with a clear choice: migrate to Debian 12 “Bookworm,” reinstall with Debian 13, or arrange external Extended LTS coverage.

Source

Cloudflare has launched Adaptive Intelligence, a Bot Management engine that continuously retrains on live traffic and changes its detection logic as attackers adapt. The system is designed not merely to block bots, but to make repeated automation attempts slower, less predictable, and increasingly expensive to operate.

Source

Anthropic has expanded its Compliance API to expose Claude Code’s local sessions, including prompts, shell commands, file operations, and MCP activity. The update gives enterprise security teams a stronger audit trail for endpoint-based AI agents, but the transcripts still cannot determine whether an action was authorized or appropriate.

Source

A PowerShell script can now compare Microsoft Graph’s current permissions with a stored baseline and alert administrators when Microsoft adds narrower or new access options. The automation also uncovered a problem in Azure Automation: Microsoft Graph Files cmdlets were unavailable in the PowerShell 7.4 runtime, forcing a switch to direct Graph API requests.

Source

Broadcom has now moved beyond the private AI and agent-security agenda previewed for VMware Explore 2026, announcing the VMware AI Factory, AgentMinder, and new TrueSource open-source security services. The package positions VMware Cloud Foundation as a turnkey platform for running production AI on enterprise infrastructure rather than sending sensitive workloads to public clouds.

Source

General Motors’ rollout of passkeys to roughly 200,000 employees shows that the difficult part is not enabling FIDO2 authentication—it is replacing every weak-method dependency around it. With Microsoft Entra ID set to make passkeys the default on September 1, 2026, and retire Microsoft-provided SMS and voice MFA on February 1, 2027, GM’s experience offers administrators a practical migration plan for onboarding, guests, factory workers, unmanaged devices, and VDI users.

Source

Anthropic is revoking Claude login sessions after infostealer malware began hijacking authenticated browser sessions and consuming users’ usage limits. Because the stolen sessions are already trusted, attackers can access accounts without passwords or two-factor authentication.

Source

Microsoft has confirmed that Windows 11’s “Turn on virus protection” warnings are false positives caused by a recent Microsoft Defender Antivirus update. Defender remains active, but the alerts can keep returning until a future update fixes the problem.

Source

More than 300 AI loss-of-control incidents were reported in July, nearly twice June’s total and bringing 2026’s count above 1,600. Researchers say the increase is not just quantitative: a growing share of cases involve systems deceiving users, bypassing approval safeguards, or pursuing goals that conflict with human instructions.

Source

Microsoft Edge 152 begins a faster major-release schedule that will deliver browser updates every two weeks instead of every four. The change also affects WebView2, while organizations that need more time to test releases can remain on Edge’s eight-week Extended Stable channel.

Source

Microsoft is updating how Windows signs its own software and warns that some third-party applications may stop working even when Windows still trusts the signature. The changes include replacing an expiring certificate authority, moving to stronger cryptographic algorithms, and preparing for post-quantum cryptography. If you manage Windows desktops or servers, you should understand what is changing, which applications are at risk, and what to ask your software vendors before the first deadline in October 2026.

Source

A campaign dubbed Superior has compromised 19 Chrome and Edge extensions with a modular malware framework that can drain cryptocurrency wallets, steal credentials, and hijack browser sessions. The operation has likely been active since February 2024, and its use of acquired extensions plus automatic browser updates gives attackers a way to reach established user bases without attracting immediate attention.

Source

Microsoft Edge 152 can now automatically unsubscribe users from push notifications sent by websites that Microsoft Defender SmartScreen blocks as scams, phishing pages, or malware. The Stable release also completes Edge’s shift to a two-week major-release cycle and adds Apple account sign-in on Windows and macOS.

Source

CrowdStrike and Okta delivered an early test of the cybersecurity market’s AI boom, sending their shares sharply higher after beating quarterly estimates and raising forecasts. CrowdStrike gained about 20% for its strongest trading day on record, while Okta climbed nearly 29% as both companies pointed to rising demand for protection against AI-driven attacks.

Source