ls ./archive --page 7
Claude Fable 5.1 costs exactly what Fable 5 cost per token: 10 dollars in, 50 dollars out. The change is in the line item nobody quotes — cached input reads dropped from 1.00 to 0.25 per million. On agentic workloads, that is most of the input bill.
The 12.93 billion dollar deal for Hugging Face is confirmed in an SEC filing, not a rumour. The company that already sells the hardware models train and run on now owns the place 3 million of them are distributed from — and a hub is not storage, it is the default resolver.
The A20 Pro is the first 2-nanometre phone chip, which is the headline. The change that actually unlocks it is duller and bigger: for years the iPhone's DRAM sat stacked on top of the processor, directly in the heat path. This year Apple put it beside the die instead.
Apple's hardware chief described a hinge assembled per unit: AI matches each hinge to its best-fit housing, a laser scans that individual body, and photopolymer is printed onto it to cancel that body's measured waviness. EU law puts hinge assemblies on the seven-year spare parts list anyway. Both things are true, and they do not fit together.
The iPhone 17 is the same phone it was on 8 September and it now costs more than it did at launch. Old models get cheaper when a new generation lands, not dearer — and Apple's own storage ladder, which steepened only at the top, says exactly which component did this.
iPhone Duo is Apple's first foldable: 7.6 inches unfolded, 5.2 mm thick, 1,999 dollars. It has Touch ID in the side button and no Face ID anywhere. By Apple's own published figures that is a twenty-fold larger chance a stranger can open it — and the reason is not cost, it is what fits under a folding panel.
Apple's US page gives iPhone 18 Pro Max 45 hours of video playback. Its UK page gives the same phone 43. Same 8.75 mm chassis, same 249 grams — the difference is the SIM tray, and Apple says so in a footnote while marketing the larger number.
McKesson's 8-K describes roughly one terabyte exfiltrated between 21 and 25 August 2026, detected on the last day. The chain was vishing to Okta SSO to Salesforce and Snowflake — no CVE, no exploit, no patch. And the claimed 284 million records are database rows, by the attackers' own account.
Calif disclosed a memory corruption flaw in WeChat's VoIP stack on iOS and Android that runs during the ringing phase, before the victim accepts or declines. The one precondition — the attacker must be in the friend list — is not a limit on spread. It is the mechanism of spread.
CVE-2026-82533 lets any local process turn off DeepSeek Harness's file sandbox and approval prompts with three POST requests. The check in the way read the Host header, which the caller supplies. Browsers will not forge it. A coding agent running inside the sandbox is not a browser.
CVE-2026-67401 affects every supported version of cPanel and WHM, and lets an authenticated account holder with mail privileges reach root. There is no CVSS score, no explanation of how SQL injection becomes file creation becomes root, no detail on which privilege is required, and no workaround.
GitGuardian found a variant of the npm worm checking 469 locations across developer environments for credentials, up from 189. That number counts places it looks, not credentials it found — and what was added is the interesting part: CI/CD tooling, cloud configuration, and AI tool settings.
Sophos documented malware that infects the Apache binary on F5 BIG-IP APM, hooks the runtime as PHP loads, and writes a web shell into memory in front of three real scripts. File integrity checks pass. The entry point, CVE-2025-53521, was published as a DoS in October 2025 and reclassified as unauthenticated RCE five months later.
ShieldBreak was CVE-2026-69414 in Defender's Malware Protection Engine, patched in engine 1.1.26080.3. Chaotic Eclipse has released ShieldCrash, a proof of concept that reaches the same bug through a path the fix did not close, giving arbitrary file read as SYSTEM on every supported Windows desktop.
CVE-2026-44756 is a CVSS 10.0 memory corruption bug in the SAP kernel's Extended Passport handling, reachable with a single malformed header. Onapsis puts the consequence plainly: SAP authorizations and Segregation of Duties will not help, because the vulnerable code runs before any authentication step.
Microsoft patched 974 vulnerabilities in September, a 70% jump over the previous record, with 723 of them in Windows and more than 110 rated critical. Two are being exploited. Both are CVSS 7.8 local privilege escalation, which means the attacker is already on the machine — and that is the whole triage.
Kinryū Labs found an Elasticsearch cluster holding nine years of Advance Passenger Information: names, dates of birth, nationalities, passport numbers and expiry dates, flight and seat details. It was not an open database — the front door returned 401, and a second path answered to default credentials.
The DFIR Report traced a decade-old Bing poisoning operation — fake activation portals, tech support scams, a custom bot and a Monero miner — to two named companies in Rajasthan, using email addresses left in GitHub commit history. That is a far stronger evidentiary chain than most attribution, and it is worth saying so.
Two flaws in FreeIPA and 389 Directory Server are unremarkable on their own. Together they let an unauthenticated client write a token entry with blank ownership, satisfy the check for whether it owns that entry, and attach a Kerberos identity with administrative group membership. Nobody has published how to tell whether it already happened to you.
Wordfence blocked more than 250,000 attempts against Super Forms and more than 190,000 against Elementor Pro. Both flaws are unauthenticated file upload, both are patched, and the Super Forms campaign has been running since 14 July. What nobody has published is how many sites actually fell.
CVE-2026-59346 is an integer overflow reached through the VMXNET3 adapter, rated 9.3. CVE-2026-59347 is a stack buffer overflow in HGFS, rated 8.1. Both let someone with administrator rights inside a virtual machine run code on the host. Broadcom has patched; there are no workarounds.
PrettyPrague, FalconFlank and GreenSection target Avast's sandbox, CrowdStrike Falcon's macro remediation and NVIDIA's display driver. Gen Digital has patched. CrowdStrike's advice is to turn the affected protection off. NVIDIA is still investigating. And the FalconFlank claim this site called single-source last week now has independent confirmation.
JSCeal steals cookies from Chromium browser profiles and reconstructs the session to reach a victim's Google account. That is being written up as bypassing Google authentication. It is not — no authentication mechanism is defeated, and the difference decides whether you go looking for an auth fix that does not exist.
CVE-2026-75650 is rated CVSS 10.0 and Adobe shipped the fix on 8 September, four days into active exploitation. Applying it is only half the remediation — the encryption keys have to be rotated as well. And the first confirmed victim was already running the August patches, which is why patching is not the same as being clear.