Public TLS validity dropped from 398 days to 200 days on March 15, 2026, the first of three cuts on the way to 47 days in March 2029. Most CAs moved early, so certificates issued from late February onward begin expiring in September and through October. By 2029 that works out to roughly eight renewals per certificate per year.

Source

Sandworm-linked attackers are using fake IT recruitment campaigns to trick system administrators into installing a modified WireGuard VPN client. The malware targets both Windows and Linux, decrypts hidden code, and downloads additional payloads after the victim connects to the supposed corporate VPN.

Source

OpenAI has released a preview of its official ChatGPT desktop app for Linux, ending the platform’s reliance on browser access. Native `.deb` and `.rpm` packages support x64 and ARM64 systems running Ubuntu, Debian, or Fedora.

Source

Microsoft has released MAI-Code-1.1-Flash, a faster and cheaper coding model for GitHub Copilot. It improves Terminal-Bench 2.1 performance by 22%, uses 25% fewer tokens, and costs one-quarter as much as the original MAI-Code-1-Flash.

Source

PentestGPT is now available as an open-source agentic penetration-testing framework that can run reconnaissance, exploitation, and reporting without a human directing each command. It uses Claude Code or Codex to select tools, execute commands, interpret results, and decide what to try next.

Source

SharePoint Online now supports Microsoft Purview sensitivity labels for OneNote sections and MP4 video files, extending protection beyond traditional Office documents and PDFs. Administrators must enable the new file types separately, and OneNote requires an updated SharePoint Online Management Shell.

Source

A new ShieldBreak proof of concept claims to bypass Microsoft’s fix for the RoguePlanet vulnerability in Microsoft Defender, restoring a path to SYSTEM-level privileges. Testing reportedly succeeded on fully updated Windows 11 25H2 and Windows Server 2025 systems, while Windows 10 is also considered vulnerable.

Source

SpaceXAI has launched Grok Bot, an OpenClaw-style AI agent that runs from a dedicated cloud PC and operates websites and applications like a human user. The service extends the persistent-assistant concept with managed infrastructure, multiple specialized bots, and workflows that can continue even when the user’s own computer is turned off.

Source

Microsoft’s August 2026 Exchange Server security update permanently disables the legacy OWA Light client on every server that installs it. The release also leaves a known hybrid-deployment problem affecting messages sent from shared mailboxes, giving administrators two important post-update checks.

Source

SQL Server Management Studio 22.9.0 tightens GitHub Copilot Ask Mode so it cannot execute queries, while delivering a substantial redesign of the Modern Connection Dialog. The update also improves Azure and Fabric resource discovery, connection portability, SQL formatting, and Database DevOps workflows.

Source

Matthew Berman supports Mark Zuckerberg’s vision, outlined in “The Future Is for Everyone,” of widely available superintelligence, open-source AI, and AI-driven invention. However, Berman identifies a major weakness: equal access to models does not mean equal access to intelligence. Unfortunately, at the end of the podcast, Berman projects his own U.S. tribalistic views onto Zuck.

Source

Clint Sharp, co-founder and CEO of Cribble, tells host Alex Kantrowitz that autonomous AI agents are creating a new telemetry crisis for businesses. Companies must monitor agent actions, control security risks, and process far more data without simply multiplying storage and analysis costs.

Source

Three new passkey attacks show that phishing-resistant MFA can still fail when Windows, browsers, or cloud identity services mishandle authentication data. Microsoft has patched the Windows logging flaw behind one attack, but other research shows that malware on a signed-in endpoint can still abuse Windows Hello for Business or recover synced passkey keys.

Source

Gemini has reached 1 billion monthly active users, just weeks after ChatGPT crossed the same broad milestone. The numbers show how quickly AI assistants are becoming mass-market services—but Google and OpenAI are measuring different things.

Source

Cisco warns that attackers are actively exploiting CVE-2026-20349 to remotely crash Cisco Secure Firewall ASA and FTD devices through their Remote Access SSL VPN services. The unauthenticated denial-of-service flaw carries a CVSS score of 8.6, and Cisco says no workaround is available.

Source

Microsoft Entra Tenant Governance is now generally available for organizations that operate more than one Microsoft Entra tenant. It combines tenant discovery, cross-tenant delegated administration, configuration monitoring, and controlled creation of add-on tenants. For administrators, it is primarily a way to inventory tenants that central IT may not manage, grant narrowly scoped administration from one tenant to another, and compare settings with an approved configuration baseline. It is not a replacement for reviewing privileged roles, change processes, or the configuration of the services it monitors.

Source

Researchers say a flaw in major AI-provider APIs can expose encrypted reasoning tokens that models generate internally. A scan of roughly 7,000 publicly shared sessions recovered passwords, API keys, email addresses, and reasoning that was missing from the summaries shown to users.

Source

Microsoft’s August 2026 Patch Tuesday fixes about 400 vulnerabilities, including 42 critical flaws and three zero-days. One Windows privilege-escalation bug is already being exploited by the Lazarus group, making the cumulative updates an immediate priority for administrators.

Source

Microsoft’s August 2026 Patch Tuesday update, KB5120249, is now mandatory for Windows 10 22H2 and 21H2 devices covered by the Extended Security Updates program. It fixes failed File History backups to SMB shares and broadens automatic Secure Boot certificate deployment.

Source