Latest cybersecurity reporting from selected sources.

Open-Weight Model Reopens Debate Over US AI Pricing PowerMoonshot AI's Kimi K3 pushed semiconductor stocks into a bear market and revived debate over whether U.S. labs still lead China on AI, even as benchmarks, weights and true costs are still being analyzed.

Labs Use AI to Speed Testing as Experts Explore Broader Public Health PotentialIt's been the most explosive U.S. public health crisis so far this summer: An outbreak of extreme intestinal illness caused by Cyclospora is sickening thousands of people across dozens of states. Experts say AI is playing a role in the investigation could potentially help head off future outbreaks.

Persistent AI Coding Model Prompted Safeguard Changes After Rare File LossOpenAI is tightening safeguards after some GPT-5.6 users reported that Codex accidentally deleted local files while operating in full access mode. The company said the incidents were rare but acknowledged the model's persistence led it to take unintended actions without seeking user confirmation.

Agencies Have Until Sunday to Patch Two Critical Command Injection FlawsCISA added two critical FortiSandbox command injection vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of active attacks. Experts warn that unauthenticated remote code execution could let attackers compromise malware analysis systems and pivot deeper into enterprise networks.

Infosecurity 2026: What Security Leaders Agree on as AI Reshapes Enterprise RiskAI has broken the speed of attack, but not the fundamentals of defense. Drawing on interviews with security leaders at Infosecurity Europe 2026, ISMG's Pulse Report explores the collapse of the vulnerability window, rise of AI agents, erosion of digital trust and disciplines that matter most.

Also: Potential Fallout From HIPAA Rule Delay, AI Identity Governance ChallengesIn this week's panel, four ISMG editors discussed the rise of artificial intelligence-powered phishing toolkits, potential fallout from the U.S. government's decision to delay a major overhaul of the HIPAA Security Rule and what security leaders see as the defining AI security challenges of 2026.

CISA Lauded for Fast Response, Transparency and Detailing Security RecommendationsSecure developers' use of public code repositories, monitor them for secrets and if they get exposed, have a well-tested incident response playbook at the ready. The U.S. Cybersecurity and Infrastructure Security Agency has shared these and other lessons learned after suffering a data leak.

Courts, Audits and Federal Agencies Found No Evidence 2020 Votes Were AlteredU.S. President Donald Trump used a primetime address Thursday night to allege that China carried out a sweeping compromise of American voter data and to revive doubts about the 2020 election, while stopping short of claiming any votes were changed.

Experts Say Clinical Laboratory Improvement Amendments Are Seriously OutdatedThe Department of Health and Human Services is seeking public feedback pertaining to cybersecurity matters and the use of artificial intelligence for potentially updating decades-old, rules-of-the-road regulations for U.S. clinical laboratories that test human specimens for health conditions.

Israeli Startup Maps Enterprise Entitlements Beyond Traditional Identity ProvidersOak emerged with a $60 million seed round to build an AI-native identity governance platform that continuously manages human, machine and AI identities, aiming to automate access decisions, improve visibility into enterprise entitlements and reduce identity-driven security risk.

Courts, Audits and Federal Agencies Found No Evidence 2020 Votes Were AlteredU.S. President Donald Trump is expected to revive claims that the 2020 election was hacked in a primetime address, but federal agencies, courts and statewide audits have repeatedly found no evidence votes were altered - while the architecture of U.S. voting systems makes remote hacking implausible.

Also, US Sanction Cybercrime Enablers, Celine Dion Ticket ScamThis week, ransomware victims paying less, cybercrime sanctions, Celine Dion ticket scams, 23andMe to pay $18 million, a 13-year old Daixin infection, Spiral ransomware, Patch Tuesday, CISA ordered rapid SharePoint patching and Spanish police busted a cybercrime ring. Sore Egyptian World Cup losers.

Also: AscendEX Shuts Down; Ethereum Foundation on AI Bug HuntingThis week, Ostium paused trading, AscendEX shut down, Ethereum said AI hastens bug hunting, not verification, the United States charged an inmate over seized transfer, ex-Sheriff's deputy jailed for extortion, Tangem card security, Iran-linked wallets sanctions and the U.S. may drop BitClub charges.

Police Say Arrests 'Effectively Halted' Scattered Spider Cybercrime CollectiveTwo leaders of the Scattered Spider hacking group received 66-month jail sentences in Britain's biggest cybercrime prosecution to date, after they disrupted London's transport authority, causing $39 million in losses and recovery costs. How to deter young hackers remains an ongoing challenge.

EU Forces Google to Give Rival AI Services Android Access and to Share Search DataGoogle sounded security alarms after the European Commission ordered it to open up deep Android functionality to rival artificial intelligence providers, and also to give third-party search providers access to Google Search data. The orders enforce the Digital Markets Act.

National Risk Assessment Cites CrowdStrike Lessons Learned, Hybrid Warfare RisksThe British government's latest national security risk register sees a rising threat posed by cyberattacks disrupting operational technology in more critical national infrastructure sectors, and cites the CrowdStrike outage in "digital resilience failure" lessons to be learned.

Startup Maps Detections Against MITRE ATT&CK and Recommends Missing ProtectionsCribl acquired Boston-based detection engineering startup CardinalOps to help organizations continuously measure MITRE ATT&CK coverage, automate TTP-based detections across SIEM platforms and move behavioral threat detection closer to the telemetry pipeline.

Strong Data Foundations Give AI Leaders an Edge in Quantum SecurityCompanies leading in AI security are also better prepared for quantum threats. New Thales research shows that data visibility, governance, encryption and crypto agility are helping CIOs build stronger foundations for both AI adoption and post-quantum readiness.

LegacyHive Is a Local Privilege Escalation BugThe vulnerability hunter in a feud with Microsoft released yet another Windows zero-day Tuesday as promised, though the touted "bone-shattering" disclosure was stripped down to prevent public exploitation. LegacyHive, exploits a profile-loading race condition to access another user's registry hive.