Revolut has received its licence to operate from Colombia’s financial regulator, the Superintendencia Financiera de Colombia (SFC). The company said the licence is the last regulatory step it needs before it launches in the country.

Revolut announced the approval on 15 September. The licence allows it to operate as a regulated bank in Colombia.

Around 200,000 people in Colombia have already joined the waiting list, according to the company. It has not given a launch date.

Six banking licences

Colombia is Revolut’s sixth full banking licence. The company already holds banking licences in the UK, France, Australia, Lithuania, and Mexico.

This year Revolut has obtained bank licences in France, Australia, and the UK. It has also received conditional approval from the US Office of the Comptroller of the Currency for a national bank charter.

In the same period, Revolut won a payments licence in the UAE. It also received an organisation licence from Peru’s banking, insurance and pension regulator, the SBS.

Chief executive and founder Nik Storonsky said in the announcement:

“Securing this licence allows us to bring our cutting-edge technology and financial stability to a dynamic market, offering Colombians a transparent platform that puts power back in their hands. With over 80 million people already trusting Revolut and a balance sheet that reflects our strong and sustained profitability, we are proving that financial control can, and should be, borderless.”

What Revolut plans in Colombia

Revolut says it will launch a full range of financial products in Colombia. It plans to focus on everyday banking and on managing money across borders, including remittances.

The company said it has met the SFC’s capital requirements. Fogafín, Colombia’s deposit insurance scheme, will protect customers’ deposits.

Diego Caicedo, chief executive of Revolut Colombia, said:

“Today we are one step closer to operating in Colombia. We are not going to just launch as a bank; we are connecting Colombia to the global economy, simplifying remittances and access to world-class products in one single place, supported by the infrastructure of one of the world’s most innovative financial platforms. This licence is an important regulatory milestone, and we are excited to demonstrate the value of our proposition in the Colombian market.”

The numbers behind the expansion

Revolut says it has more than 80 million customers worldwide. It aims to reach 100 million by mid-2027.

According to its 2025 annual report, Revolut made $6bn in revenue last year, up 46% on the year before. Pre-tax profit was $2.3bn, its fifth year in a row of net profit. Customer balances reached $67.5bn.

A share sale earlier this year valued the company at $115bn. A new share deal for Storonsky targets a $500bn valuation.

Revolut’s expansion has also drawn regulatory attention. In June, the European Central Bank moved to restrict some of its products. On 13 September, TNW reported that Revolut handed customer passports to scammers who used a real government email domain.

Though preoccupied with vlogging lately, Canon hasn’t forgotten its photography market. The company just unveiled the 24-megapixel EOS R8 II, an entry-level full-frame camera with all new styling that’s strikingly different from the previous R8 model. In fact, the new camera reaches back much further, borrowing design cues from its classic EOS 650 SLR film camera, adding a touch of retro chic to a previously dull design.

A few things you may notice about it are the much more squared-off design compared to the rounded, swoopy R8. With the optional battery grip installed, it has an angled right corner like the 650 and more horizontal shutter button area. That said, it’s significantly larger and more modern-looking than its muse. As for controls, it has a joystick to move the autofocus point that the R8 sadly lacks.

Canon

Canon told Engadget that it addressed issues that myself and other reviewers found wanting in the R8. First off, it’s faster. The R8 II can now shoot at 40 fps in electronic shutter mode with continuous autofocus and auto-exposure, and capture more shots in a burst (58 percent more JPEG and 30 percent more RAW images). And unlike the previous model, it’s equipped with 5-axis in-body stabilization that reduces shake up to 7.5 stops with supported lenses. It’s also the lightest full-frame camera on the market with this feature at 1.2 pounds (546 grams). 

The autofocus has been overhauled as well. Equipped with Canon’s Dual Pixel CMOS AF II, it offers 100 percent coverage and subject tracking of people, animals and vehicles, while delivering more tenacious tracking than the EOS R8, Canon said. It also comes with a feature we’ve only seen on higher-end models like the EOS R6 III: the ability to register specific people for tracking. You also get pre-continuous shooting that allows the capture of up to 20 frames (a half second’s worth) before fully pressing the shutter button.

Canon

Video hasn’t changed much, but was already pretty powerful with the R8. You can capture 4K 60p video that’s oversampled from the full 6K sensor width, as before, along with uncropped 1080p video at 180 fps. It supports 10-bit 4:2:2 capture with Canon Log3 in HEVC or AVC codecs at bit rates up to 250 Mbps. Video autofocus is much improved, with all the same tracking and subject detection AF features as for photos. 

Other features include new Positive Filmtone, Negative Filmtone  and Night Scene film looks, an A+ Automatic Exposure feature with a blurred background setting for movies, a separate Slow & Fast mode, a single UHS II card slot and enhanced stabilization modes for video. The 3-inch 1.62-million-dot vari-angle rear display and 2.36-million-dot EVF are basic, as is the LP-E17 battery that allows for just 340 shots in power saving mode.

The Canon EOS R8 II is now on pre-order for $1,899, with shipping set to start in late October. You may find that price a bit shocking for an “entry level” model, but it appears to be the new normal for cameras in a world of inflation and tariffs. You can also get it in a kit with Canon’s RF24-50mm F/4.5-6.3 IS STM lens for $2,099. The optional EG-E2 Extension Grip is $100, and Canon’s new Speedlite EL-5 Ver.2 flash will set you back $379. 

Apple has addressed more than 260 CVEs across all of its operating systems, browsers, and other software products, marking the largest single patch cycle in Cupertino’s history. 

While this CVE count is hardly notable compared to some vendors – hello, Microsoft’s record-breaking 974 bugs disclosed earlier this month – it does set a company record for Apple. It also reflects the new reality of AI-driven bug hunting, as models become exponentially better and faster at finding security vulnerabilities.

However, the flip side of the AI coin we were promised – that models would also excel at writing patches and automatically fixing software and systems – yeah, that hasn’t happened yet.

The silver lining for everyone updating their Apple products right now (including this humble vulture): none of the vulnerabilities are listed as being under active exploitation. Of course, that may change very quickly as attackers are, at this very moment, looking to exploit the newly disclosed bugs, too. And we promise you that they are using AI.

Apple’s latest mobile and operating system versions, iOS 27 and macOS 27 Golden Gate, released on Monday, also address a record 122 and 204 security vulnerabilities, respectively, across phone, iPad, and computer operating systems.

Of these hundreds of CVEs, however, there are only ten (by our count) that AI is directly credited with finding.

iOS 27 fixes 122 flaws

Just two of the iPhone and iPad CVEs fixed with iOS 27 credit a coding agent or AI assistant with finding them. These include CVE-2026-65410, a vuln that exists in iPhone and iPad AVE video encoders, that can cause unexpected system termination. Apple credited AI-bug-finding firm Calif, along with Claude and Anthropic Research, with finding and reporting this security flaw.

Then there’s CVE-2026-65409, a type-confusion issue in iOS’ Foundation framework that can be abused to cause a denial of service, also found by Calif – specifically human researcher Bruce Dang – in collaboration with Claude and Anthropic Research.

Some of the more interesting and serious iOS bugs fixed with the newest update aren’t listed as found by AI.

These include CVE-2026-43689, a privilege-escalation flaw that could allow an app to gain root access. Apple credited Nosebeard Labs’ Andreas Jaegersberger and Ro Achterberg with reporting this bug.

Additionally, CVE-2026-65406, a logic-issue flaw due to improper validation in Background Assets, could be abused to access sensitive user data. Background Assets is an Apple framework that lets you download large files and content in the background before a user opens the app for the first time. Baidu Security researcher Ye Zhang spotted this one.

macOS 27 patches 204 vulns

Meanwhile, the new macOS 27 update that addresses 204 vulns also fixes both the AI hunted bugs: CVE-2026-65410 and CVE-2026-65409. Plus, it credits AI helpers with discovering eight others, including one especially nasty flaw that could lead to remote code execution through the CUPS printer interface. Let’s start with that one.

CVE-2026-43692 is a validation issue in CUPS that can be exploited by a remote user to either terminate the app or execute malicious code. Aaron Grattafiori and the Nvidia AI Red Team receive credit for disclosing this flaw.

CVE-2026-64790 in CUPS can be exploited to gain elevated privileges. Grattafiori and the Nvidia AI Red Team again get credit for the win.

CVE-2026-43791, a validation issue in StorageKit, can be abused to read files. Grattafiori, the Nvidia AI Red Team, Meridian Miftari, and Amy from amys.website disclosed this flaw to Apple.

CVE-2026-43690 is a race-condition bug in the Server Message Block (SMB) network communication protocol. A local user can exploit the flaw to read kernel memory. Calif’s Bruce Dang, with Claude and Anthropic Research, found this one.

CVE-2026-43719 is another SMB use-after-free bug, discovered by Calif’s Dang and Jakob Pammer, Claude, and Anthropic. “Mounting a maliciously crafted SMB network share may lead to system termination,” Apple warned. 

CVE-2026-65376 is yet another SMB issue – this one an out-of-bounds-read flaw reported by Dang, Claude, Anthropic, and 재영 정.

CVE-2026-65374 is a memory-corruption issue in the WebDAV protocol that can lead to code execution. Dang, Claude, Anthropic, and He Wei (ギカク) receive credit for finding this bug.

CVE-2026-65375, also in WebDAV, can cause unexpected system termination. Apple credited Dang, Claude, Anthropic, and Devcore Research Team’s YingMuo.

CVE-2026-43677 is an out-of-bounds write issue in WebDAV with a slew of researchers receiving credit for finding it. In addition to the usual trio (Dang, Claude, and Anthropic), bubu, Omar Cerrito, HE WEI（ギカク), Roman Zabicki, Richard Zana, Chris Bailey – Short Circuit, Aswin Kumar Gokulakannan, and Surya Narayan Kushwaha are on the list.®

By Sila Ozeren Hacioglu, Security Research Engineer at Picus Security.

If you run PaperCut NG or MF, the last week of August showed what vulnerability response looks like when AI speeds up vulnerability discovery.

On August 27, PaperCut’s urgent advisory said attackers were already exploiting servers. No CVE, no exploit, no patch. The first emergency patch came a day later and was bypassed the same day. The third one landed on September 1. Six days without a patch that held or an exploit to test with, while attackers were already exploiting in the wild.

And the window is closing. Disclosure-to-exploitation averaged 21.5 days last year. It is measured in hours now. PaperCut isn’t the outlier. It’s the template.

Below is one day in the life of a security team, told through a hypothetical CVE.

The CVE is made up. The day is not: it is what PaperCut’s customers lived through in August. Let’s walk through it hour by hour. 

08:00 – A CVE drops. No patch.

You wake up and CVE-2026-1001 is in your feed: unauthenticated RCE, no patch. You run a version check. Twenty assets match. Before you can finish reading the list, your phone rings. It’s management. They’ve already seen it, they’ve already been asked about it, and they want an answer in the next fifteen minutes: are we exposed, and what are we doing about it?

Strip the panic away and there are exactly two questions to answer:

1. Are these 20 assets actually exploitable, in my environment?

2. Would my security controls stop it, right now?

Version data says “affected.” Version data is not an answer. Both questions start the day at Unknown.

Patching is off the table, because there is no patch. 

Shutting the services down would settle the question, but the business runs on them. Nobody is going to negotiate that. You need a verdict, not a shutdown.

08:05 – Your first instinct cannot act

The natural move is to reach for your automated pentesting tool. Take the exploit, fire it at the 20 assets, see what falls. So you go looking for the exploit.

There isn’t one. No public PoC, nothing to run. The tool that would give you the answer is waiting for ammunition, and so are you.

The attacker is not. Weaponization used to take weeks; now it takes hours, and the clock started at 08:00. If you wait for a public exploit, the first working one you see may be the one that hits you.

08:15 – The exploit is a chain, not a payload

Here is the shift. An exploit is not just a payload. It is a chain: the payload has to be delivered, it has to execute, and then the attacker has to escalate privileges, inject into a process and pull credentials to make the foothold worth anything. Each step is a known technique, and techniques can be simulated safely against your controls before anyone has written the payload itself.

You cannot test the exploit, because there is none. But you can test the chain the exploit would need. Map the CVE to the techniques it has to run, delivery, execution, privilege escalation, injection, credential access, and run those against your live stack: NGFW, WAF, endpoint hardening, EDR, SIEM. Per asset. The output is a verdict: would this chain succeed in your environment?

The question “is it exploitable here?” becomes testable ten minutes after disclosure.

We explained how this works in detail in our post on validating CVEs without a working exploit.

08:30 – Simulated, tested, ticketed

By 08:30 the chain has run. The results are not comfortable, and that is the point. The NGFW missed the delivery step. The WAF detected it but did not block. Endpoint hardening flagged execution. The EDR raised no alert. The SIEM raised no alert.

Now the two Unknowns have answers. The 20 assets are exposed to this chain, and nothing in the stack would stop it. But the gaps have names and owners. An action plan is created: a detection rule for the NGFW, a prevention rule for the WAF, GPO hardening for the endpoints, an IOA rule for the EDR, a detection rule for the SIEM. The EDR and SIEM rules deploy automatically. The rest go out as tickets and get worked through the morning, alongside a patch ticket for every affected asset, parked until a patch exists.

By 08:45 the chain is re-run. This time: detected, blocked, blocked, alerted, alerted.

You have not patched anything. You have broken the chain on every affected asset before a working exploit exists.

12:00 – The threat gets a name

Threat intel arrives. An Iranian threat group is running a campaign weaponizing CVE-2026-1001. There is still no public exploit, but the attacks have started. At 08:00 you had a vulnerability. At 12:00 you have an adversary.

That changes the question. The CVE is now one link in a full kill chain: initial access, lateral movement, persistence, exfiltration. You validated the vulnerability this morning. Would you survive the campaign?

12:30 – The whole campaign, rehearsed

You take the new report, pull the group’s past behavior from earlier reporting, and assemble the full campaign as an attack simulation. Run it end to end against your controls.

• Initial access: blocked. The 08:30 fixes hold, and the morning pays off twice. 

• Lateral movement: detected, alert fired. 

• Persistence: missed. This is a technique the CVE-focused work could never have surfaced, because it has nothing to do with the CVE. 

Advertisement

• Exfiltration: blocked, egress controls holding.

The persistence gap runs the same loop as the morning: rule delivered, deployed, re-proven. Closed before lunch is over. Remember this rehearsal.

16:00 – The exploit goes public

A working exploit is published. Now, and only now, live testing has ammunition. Automated pentesting can fire the real thing.

But two constraints show up immediately. 

First, you may not be allowed to. Policy often forbids firing live exploits at production or critical assets, and print servers, domain controllers, and OT systems are exactly where that policy bites. 

Second, reach: with a real exploit, a pentest can safely touch maybe 5 of the 20 assets. The other 15 were only ever answerable the way you answered them at 08:15.

16:30 – Ground truth, two ways

The five reachable assets get tested with the real exploit. Three are not exploitable: the controls hardened this morning meet the real attack and hold. That is live confirmation the simulated verdicts were correct. 

Two are exploitable. They need the patch, and there still isn’t one, so the patch tickets opened at 08:30 get upgraded to critical, with the working PoC and the exploitation evidence attached. No severity debate. The proof is in the ticket. Until the patch lands, the two go behind the WAF prevention rule with web access restricted to trusted IPs.

18:00 – The attacker arrives. Nothing happens.

The campaign hits your organization. Blocked. Alerted. Gaps already closed. The attack fails against controls validated at 08:15, fixed by 08:30, and proven at 08:45.

Ten hours before the attacker had a working exploit, your environment already did not have this exposure. That is what machine-speed validation buys: you finish before they start.

What this day required

Look at what actually got used. Not one capability, three, and none of them is a silver bullet on its own:

And they had to work together, on signal, in hours. The 12:30 campaign reused the 08:30 fixes. The 16:30 pentest confirmed the 08:15 verdicts. Findings from one fed the next. Run them as three siloed tools on three schedules and this day takes six weeks, not ten hours.

That is what the Picus Platform is built to do: exploitability validation, security control validation, and autonomous pentesting on one platform, sharing one data fabric, triggered by change rather than by calendar.

See the whole day, live

We are going to run this exact scenario, live in the product, at The Validation Summit ’26 on October 14 at 1 PM ET and October 15 at 11 AM BST.

Mikko Hyppönen opens with what changed after Mythos. Our CTO Volkan Erturk shows how machine-speed validation closes the patch gap and the speed gap. Security leaders from Chanel, Atlassian, and Kraft Heinz talk about how they are actually preparing. Ron Eddings of Hacker Valley hosts.

One question answered: what does Mythos-ready actually look like?

Two hours. Free. See the workflow run live.

Sponsored and written by Picus Security.

Meta One went live today as a paid layer across Instagram, Facebook, WhatsApp, and Meta AI, grouping more than 50 extras that sit on top of the free apps. Plans already collected 15 million subscriptions and trials during earlier tests, and Meta says later waves will reach Edits and AI glasses. Everyday feeds, chats, and basic Meta AI stay free.

WhatsApp Plus costs $2.99 per month, while Instagram and Facebook Plus cost $3.99 each. Core packages those three Plus subscriptions with additional AI capabilities for $7.99. Premium grants you access to the most AI allowance for $19.99. On top of that, you have your Creator and business tiers, which begin at $14.99 for Essential, $49.99 for Advanced, $149 for Expert, and a staggering $499 for Max. Keep in mind that these charges vary by location and account, and if you run a business on Instagram or Facebook, you may receive separate bills for each unique profile.

Meta Glasses, Fury AI Glasses

• Answers, tips and inspiration are a question away. Forgot an ingredient for dinner? Ask Meta AI for a substitute to save a trip back to the store…
• Meta Glasses are meticulously designed to deliver a fit that feels custom to you. Choose from a variety of bold colors and experience a comfortable…
• Travel like a local whether you’re navigating a bustling market in Spain or having a conversation in Japanese. Just say “Hey Meta” to start a live…

Instagram Plus offers a really great deal: you can stretch your Stories to 48 hours (before they disappear), use custom fonts in your DMs and Stories, receive notifications everytime someone views your Story, and even look at someone else’s Story without being added to their viewer list. Facebook Plus, on the other hand, provides personalized app icons, super hearts, additional Reels stats, and larger reactions in both the Feed and Reels. WhatsApp Plus offers exclusive themes and icons, some fancy effect stickers, and the ability to pin up to 20 chats. Backup storage and scheduled Focus Schedules are also on the way.

Core and Premium upgrade the Meta AI with additional functionality and greater limits. You can generate more photographs and videos with the Muse models, experiment with Restyle on more Instagram Stories, and utilize in-app creative tools like voice effects more frequently. People that joined up for testing used both the AI tools and the style extras rather regularly, and it turns out that Restyle and voice effects were the two most common causes.

Advanced is where all of the scheduling and operations magic occurs. You can queue up Stories up to 30 days in advance, schedule posts and Reels even further ahead of time, include clickable links in your organic posts and Reels, access exportable analytics, deeper audience insights, team seats without revealing your password, additional linked WhatsApp devices, and a slew of broadcast credits. Expert and Max push those boundaries even farther for larger teams and more corporate traffic. One thing to look out for is edits. Plus, it will include cloud project storage and an assistant that will read your Instagram analytics and make suggestions.

It’s worth noting that subscription does not remove ads completely, as Meta continues to run the same ad-supported core for its 3.6 billion daily visitors. Instead, they’re positioning these subscription tiers as a method to assist big hitters that use a lot of AI, while also providing power users and organizations with a single location to manage everything rather than having to fragment among a variety of third-party schedulers, link pages, and analytics tabs. To keep track of the rollout, the feature list will vary depending on your location, app, and account, so you’ll need to look inside the applications to see what’s available to you.

Helen Ma, Meta’s VP of subscriptions, told reporters that people who want specialized work out of apps built for billions now have a paid lane, and that free creator tools will not be cut to force a sale. Essential adds an enhanced profile with website and location slots, a bolder follow button on Reels, automatic follow invites to people who already engage, more Meta Business Agent replies on WhatsApp around the clock, a verified badge and WhatsApp Business channel after checks pass, plus impersonation monitoring.