Facepalm: GLM-5.3, the large language model from Chinese AI company Z.ai, recently helped uncover more than 1,000 critical vulnerabilities across major open-source projects, including the Linux kernel, adding to the thousands more flagged by other AI systems this year. That torrent of AI-detected bugs is now pushing the number of CVEs fixed per Linux kernel release to nearly 2,000, up from roughly 500 per release for several years running.

Ahead of this month’s Kernel Recipes 2026 event in Paris, Linux kernel maintainer Greg Kroah-Hartman shared a graph charting the steep rise in CVEs found in the kernel over the past several stable releases. The slide shows that between versions 6.9 and 6.19, security researchers spotted around 500 vulnerabilities per release, on average.

From Linux 7.0 onward, that number jumped to around 1,000 CVEs per release, and Linux 7.2 pushed it past 1,500. Most of the bugs in recent releases were caught by AI code review platforms and large language models, and the count could climb above 2,000 with Linux 7.3 as frontier AI systems keep getting more capable.

At first glance, 2,000 CVEs in the Linux kernel sounds alarming, given that the vast majority of consumer, commercial, and industrial IoT devices run on Linux-based platforms, directly or indirectly. Worryingly, the kernel’s source tree runs to around 40 million lines of code, meaning there are likely still thousands more vulnerabilities waiting to be found.

However, the vast majority of documented CVEs are either low-priority or affect obsolete drivers and long-deprecated features.

The rise in AI-driven bug reports has had a silver lining for the kernel codebase too: earlier this year, maintainers cleared out a batch of old drivers, along with the entire ISDN subsystem, that had been harboring dozens of CVEs.

Linus Torvalds flagged the problem in his Linux 7.1-rc4 release post this past May, warning that the kernel’s private security mailing list had become “almost entirely unmanageable.” Kernel maintainers have said report volume has climbed from around 2-3 per week two years ago to 5-10 every day in 2026.

After years of avoiding it, Hobby Lobby has begun rolling out Apple Pay at its checkouts, much to the delight of its increasingly frustrated customers, though it isn’t available everywhere just yet.

You may be able to pick up your assorted crafting bits and bobs at Hobby Lobby sans wallet if you so choose. Customers have discovered that, at least at certain locations, the retail arts and crafts giant has added support for Apple Pay.

Reports have come in across social media, including Facebook, X, and Instagram over the past week. Dmiyah Johnson posted to Facebook that her local Hobby Lobby currently supports tap-to-pay.

Shanyn Nicole also posted a reel to Instagram confirming that her Hobby Lobby supports it as well.

AppleInsider has contacted several Hobby Lobby stores and found that the rollout is gradual and not yet available at all locations. Apple Pay support is tied to the installation of new payment terminals and is expected to arrive at all stores before the end of the year.

Hobby Lobby was another long-time holdout, like Walmart, that had avoided Apple Pay long after its competitors began accepting it. In fact, in 2025, The Sun reported that customers had ramped up efforts to get the retailer to change its ways.

Walmart began accepting Apple Pay on August 24, also in a staggered roll-out.

Sonos has expanded its audio line-up with two new products in the Beam Ultra soundbar and Ace Ultra headphones.

With the introduction of its latest OS, Sonos 27, both new products are designed to show what the new AI-focused platform is capable of, with the Beam Ultra bringing 7.1.2 Dolby Atmos and the Ace Ultra adding a direct connection to Sonos systems.

The Beam Ultra keeps the compact footprint of the Beam Gen 2, but packs in nine custom drivers, including two dedicated up-firing drivers for immersive audio. Sonos says this setup enables 7.1.2 Dolby Atmos while also delivering bigger bass than before.

The soundbar also gets a redesigned centre channel aimed in an attempt to make dialogue clearer, alongside four levels of AI Speech Enhancement for users who want to focus on what’s being said. There’s also a Night Sound mode for reducing the impact of louder sounds when watching TV late at night.

Advertisement

Sonos is also making the Beam Ultra more flexible as part of a wider home theatre setup. Owners can add a Sonos Sub or Mini for deeper bass or rear speakers for surround sound, with compatible portable Sonos speakers (such as the Move 2 and Play) can now serve as rear surrounds.

Advertisement

Alongside it, Sonos has introduced the Ace Ultra as its new premium over-ear headphone. It features a Sonos-designed 40mm driver, Adaptive ANC powered by 10 microphones and up to 35 hours of battery life with ANC enabled.

The more interesting change is how the Ace Ultra connects to the wider Sonos system. These are the first headphones built on Sonos’ new Headphone Engine 2 hardware, which has been available in its Early Access program. With a press of a button, users can move whatever is playing on their Sonos system directly to the headphones, then press again to return playback to the speakers.

Both products also tie into the newly updated Sonos 27 operating system. The Beam Ultra supports Wi-Fi, Bluetooth and HDMI eARC, while the Ace Ultra adds USB-C and 3.5mm connectivity.

Advertisement

The Sonos Beam Ultra has gone up in price from the previous model, priced at $699 / £699, while the Sonos Ace Ultra depends on where you are, priced at $449 but in the UK it’s £399 (down from Ace’s £449).

Advertisement

Both are available to pre-order now onwards with general availability starting September 29, 2026.

Advertisement

Adobe for Slack lets Slackbot turn conversations and shared files into images, video and documents using Firefly, Photoshop, Premiere, Acrobat and more than 70 other tools. Article 50 of the EU AI Act now requires synthetic content to be marked in a machine-readable format, and the Commission’s own guidance names Adobe’s C2PA standard as a way to do it.

Adobe has put its creative tools inside Slack. Slackbot routes a prompt to Firefly, Photoshop, Premiere or Acrobat and returns the file, Digital Trends reported.

It reads the channel to work out what you mean. It pulls from conversations, canvases and shared files, and can search a Creative Cloud library by subject, style or mood. More than 70 Adobe tools are connected.

It is not included in either subscription. You need a Business+ or Enterprise+ Slack plan and a separate Adobe one on top. Teams can review and iterate on assets inside channels.

This is the third integration of its kind. Adobe did the same for ChatGPT last month, already has a Claude version, and has promised Gemini.

The European question is about what comes out of it. Since 2 August 2026, Article 50 has required synthetic image, video and audio to be marked in a machine-readable format.

Adobe is better placed for that than almost anyone. It founded the Content Authenticity Initiative and co-authored C2PA, the provenance standard behind Content Credentials.

Brussels has effectively endorsed it. The Commission’s transparency code lists C2PA as an example meeting all four criteria, one analysis notes.

Those criteria include robustness. Marking has to survive format conversion and minor edits and be tamper evident, as far as is technically feasible. It must also be interoperable.

Which is where a chat client gets interesting. Manifests survive conversions handled by C2PA-aware tools, and a naive re-save still strips them.

Nobody has said whether they survive this particular pipeline. Generate in Slack, download, drop into a deck, and the credential may or may not still be attached.

The code anticipates that problem. It encourages pairing C2PA with an invisible watermark, which is what OpenAI adopted alongside Google’s SynthID.

Others are solving it at the other end. YouTube now labels AI-generated video whether or not the creator discloses it, which infers rather than marks at source.

Which is the gap worth naming. Adobe wrote the standard, TNW reported Anthropic marking everything as the same rules took effect, and nobody has tested what a chat client does to either.

security

Miscreants use chained zero days to pwn boxen as third-party SOCs say further attacks ‘almost certain’

SonicWall says attackers are actively exploiting two chained zero-days to take over Secure Mobile Access (SMA) Series 1000 boxes.

Aimed at midsize and large enterprises, SMA1000 gateways secure remote access and VPN connections. Compromising one can therefore provide attackers with a valuable route into corporate networks.

So, get to applying those hotfixes, says SonicWall. There are no workarounds.

The first zero-day, CVE-2026-83548, is a pre-authentication server-side request forgery (SSRF) vulnerability with a maximum CVSS v3 score of 10.0. SonicWall attributed it to an unintended alternative access path.

“A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations,” the vendor said.

The second, CVE-2026-83549, is a post-authentication OS command injection vulnerability in the SMA1000 Appliance Management Console (AMC), rated 7.8 on CVSS v3. Under certain conditions, an attacker authenticated as an administrator could execute arbitrary commands on the appliance.

The flaws affect the SMA 6210, 7210, and 8200v appliances, for which SonicWall has released hotfixes.

SonicWall advised customers to contact its technical support team for help identifying indicators of compromise.

If an appliance appears to have been compromised, SonicWall recommends reimaging or redeploying it, changing all passwords, and resetting TOTP tokens.

NHS England, which published its own advisory, warned about the growing risk of attacks against internet-facing gateways.

“Firewalls and other edge devices are internet-facing by design and are highly attractive targets to attackers, and there is an increasing number of edge device vulnerabilities disclosed each year that are rapidly exploited by attackers,” it stated.

“The NHS England National CSOC assesses future exploitation of these vulnerabilities as almost certain.”

The disclosures continue a difficult run for SonicWall and its SMA1000 product line stretching back through 2025.

In July, the vendor disclosed an eerily similar pair of vulnerabilities. That pair also comprised a pre-authentication SSRF vulnerability, this time in the SMA1000 Appliance WorkPlace interface, and a post-authentication OS command injection flaw in the AMC. The SSRF received a maximum CVSS v3 score of 10.0, while the command injection bug was rated in the sevens.

CISA later added CVE-2026-15409 to its Known Exploited Vulnerabilities catalog and marked it as known to have been used in ransomware campaigns.

Throughout 2025, SonicWall patched a succession of SMA1000 vulnerabilities, including OS command injection and privilege escalation flaws, while investigating zero-days linked to ransomware attacks. ®

This article is crossposted from IEEE Spectrum’s careers newsletter. Sign up now to get insider tips, expert advice, and practical strategies, written in partnership with tech career development company Parsity and delivered to your inbox for free!

Asking someone to be your mentor is weird.

Walking up to someone and asking, “Will you be my mentor?” has always seemed to me like the adult version of a kid walking up to another kid at a party and asking, “Will you be my friend?”

What you’re really asking is: “Will you commit some amount of unpaid time to guiding my career for an indefinite period?”

Framed that way, of course some people hesitate to say yes.

But formal mentorship isn’t the only way to benefit from the wisdom of those who came before. I’ve never formally asked anyone to mentor me. And yet I’ve had dozens of unofficial mentors.

The Copy-Paste Method

One way to learn from others is by copying what you observe.

Sometimes this means reading books or blogs from engineers you respect and directly applying their ideas to your work.

I’ve also been fortunate to work alongside some extremely talented engineers, and I shamelessly copied the things they did well.

When I meet one of these engineers, I try to figure out what they’re doing differently: How do they approach a problem? What do they read? How do they communicate in meetings? What do they know that I don’t?

Then I steal whatever seems useful and apply it to my own career.

Great artists steal. Engineers should too.

Curiosity Compounds

Still, just observing has its limits. Asking questions can get you even farther.

I’ve asked managers how they approached difficult conversations, and I’ve asked engineers what their process was for solving problems I thought were impossible.

If someone seems unusually knowledgeable: “What are you reading right now?” If I respect someone’s work: “What’s something you think I could do better?”

These aren’t profound questions. They don’t need to be. You get one useful piece of information, apply it, and move on.

And if you don’t work around exceptional engineers, you can still do this. The only real requirement is curiosity. When you encounter something you don’t understand, make it a rule to investigate instead of moving past it.

You don’t need one person willing to guide your career. You need a collection of people who know things you don’t.

Pay attention to them. Ask questions. And shamelessly copy the good parts.

Ask me!

If you have a career question you’re struggling with, like an upcoming decision, a problem at work, an interview, whatever—submit it here: https://docs.google.com/forms/d/e/1FAIpQLSdj_2BZIhrGF__7BCLH33zJ9NMv8C7Vsg9NNusASrYj7-9Idw/viewform. You can include your name or remain anonymous.

I’ll be reading through them and answering some in future articles. Consider it mentorship without the awkward “will you be my mentor?” conversation.

—Brian

IEEE members have a wealth of experience and knowledge to draw from. In the most recent issue of The Institute, several members share their career advice for engineers, from engineers. You can also learn about other IEEE programs and courses.

Read more here.

Infostealers replayed stolen Claude session cookies into paid accounts without ever touching the login page two-factor authentication guards.

The accounts Anthropic flagged were card-billed, self-serve accounts, which is the population no corporate identity provider governs, and no admin console can sign out. Session-cookie replay bypasses SSO as thoroughly as it bypasses 2FA. What SSO provides here is revocation and visibility, not prevention. The company disclosed the campaign in notification emails to affected users, named six stealer families, signed the accounts out, stripped the saved payment methods, and refunded the charges it found.

The burned usage is the small loss. What those sessions could reach is the exposure, and none of it sat behind an identity controlled by an enterprise.

Anthropic told affected users that a bad actor was using common infostealer malware to lift Claude login sessions off their computers and then replaying them to burn the accounts’ usage, according to the notification an affected user posted to Reddit and BleepingComputer reported on August 30.

It named Vidar, LummaC2, StealC, RedLine and Acreed on Windows and Atomic Stealer on a small number of Macs, and it described general-purpose malware that copies browser login cookies along with saved passwords. “Your Claude session was likely one of the many things it collected,” the email said.

A session cookie is the proof that a login already happened

The attack chain runs in one direction, from an infected machine through a stolen cookie past a checkpoint that never fires, and into everything the account can reach.

Signing the accounts out worked because a replayed cookie dies with the session it copies.

Two-factor authentication guards the login page. The site then hands the browser a cookie so the user stays signed in, and an attacker who copies that cookie and replays it looks to the server like the person who already passed the check. Help Net Security described the mechanism on August 31 as session theft becoming the new credential theft.

Anthropic spotted the theft in the usage meter. Limits were refilled and drained while the owner was away from Claude, the company wrote.

One Redditor who received the notification traced the infection to a pirated game, per BleepingComputer. That is one machine, and Anthropic has not said what the others ran.

Anthropic’s notification gave no count. The company had not responded by publication to VentureBeat’s questions on how many accounts were affected, whether any Team or Enterprise seats behind SSO were among them, or whether the replayed sessions reached conversation history or connected apps rather than usage alone.

Removing a saved card and refunding charges point to directly billed, self-serve accounts that authenticate through Anthropic’s own login rather than a corporate identity provider. Those include personal subscriptions. Team and self-serve Enterprise organizations can also be card-billed, so the deduction is strong rather than closed.

Bugcrowd CEO Dave Gerry told Axios in early August that his company sent employees nearly a dozen emails saying the OpenClaw agent was not allowed on corporate networks, and employees kept trying to download it anyway. A personal Claude subscription on a managed laptop is the same reflex, and it comes with a card on file. LayerX data in Akamai’s enterprise AI risk report found 47% of enterprise AI conversations run through personal identities, with Claude at 61%.

The pirated game is one vector. In July, attackers hosted a spoofed Claude download page on the claude.ai domain itself through a public Artifact, and a sponsored Bing ad sent employees searching for “Claude Desktop app” straight to it. Huntress documented the campaign, named FakeAgent, after SectopRAT compromised employees at 29 organizations in two days. The artifact collected roughly 7,100 downloads before Anthropic removed it. A separate campaign pushed a fake Claude installer through a spoofed download site earlier in the year, per Malwarebytes. The vector is not piracy. It is enterprise employees searching for the official app on their work machines.

Refunds cover the usage. Nothing covers the connectors

A replayed session inherits everything the legitimate one could reach, and Anthropic has not said whether these did. On a Claude account, that means the conversation history, the files uploaded into projects, and any connectors the owner authorized. Anthropic’s help center states that connectors let Claude retrieve data and take actions inside connected services and that Claude inherits each person’s permissions from the connected service. Read and search operations run without approval. Write actions, including send, reply, forward, share, move, and trash, are approval-gated by default. The exfiltration path is the one that is open. Google Workspace connectors are available to individual Claude accounts, so a personal Pro subscription can hold a live authorization into a Gmail inbox or a Drive folder.

If that inbox is the work inbox, the attacker holding the replayed cookie has a read path into it that the corporate identity provider evaluated once, at the moment the employee clicked allow, and rarely again. On a personal plan, the employee owns that grant. No Claude tenant administrator can sign that account out, and the Workspace or Entra administrator who can pull the underlying grant rarely knows it exists.

Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, put numbers to the market in an August 6 Axios interview. Criminals have been buying and reselling stolen ChatGPT, Claude and Gemini credentials since ChatGPT took off in late 2022, fed by infostealer malware. CrowdStrike’s 2026 Threat Hunting Report documents one LLMjacking campaign that pushed nearly 200,000 API requests through a compromised cloud account’s AI model access in two minutes.

Meyers drew the line in a July briefing on the report. LLMjacking, in his framing, is stealing the credentials, and cost harvesting is what the buyer does next, manipulating AI resources that belong to the victim “in order to conduct operations and generate massive bills as a byproduct of that,” he said. “So think of this as LLM coin mining.”

One architect refused to build the same exposure into his product

Tom Kleinpeter, co-founder and chief architect at Common Room, described in written answers to VentureBeat why he held his company’s AI agent integrations back through the summer of 2025.

“We rejected local MCP servers early, full stop. That path meant storing a long-lived API key or token on someone’s machine. Steal that credential, and you can impersonate the user, pull their data, or do anything else the token allows, indefinitely, until someone notices and manually revokes it. We weren’t willing to ship that.”

Common Room shipped its first agent integration in October 2025 with Okta’s Auth0 handling authentication, separate read and write scopes, and writes off by default, per Kleinpeter.

An AI coding agent working on Common Room’s own system proposed caching access tokens in plain text in Redis to cut down on repeated authentication calls, he wrote. It worked, and it would have parked live credentials in shared infrastructure had a human reviewer not caught it before it shipped.

Asked what was acceptable in 2024 and a liability now, he named one thing. “Long-lived, broadly scoped API keys. Those made sense when one human operated one trusted system and stayed in the loop. Agents now run across laptops and multiple clients, often with no human watching in real time.”

Okta gave agents governed identities the same week Claude users lost their cookies

Okta made Agent SSO generally available on August 24, registering AI agents as first-class identities in Universal Directory and issuing short-lived, identity-governed tokens in place of stored credentials, according to the company’s announcement. The release names Claude as its example of an agent a security team can now govern natively.

Six days later, Anthropic was signing users out because six stealer families had copied the humans’ Claude cookies. The agents got governed identities. The people using Claude on their own cards did not.

VentureBeat’s July Pulse Research wave on agent security found 63% of 116 enterprises report credential sharing somewhere among their AI agents, and 3% run Okta for AI Agents.

That 3% has a reason, Kayne McGladrey, author of the forthcoming “Cyber Risk is a Myth” and a senior IEEE member, told VentureBeat during a July interview. “It’s only those well-resourced companies that are above the poverty line that have met all the prerequisites,” he said.

The prerequisites he named are the same controls most enterprises still treat as hygiene, not strategic investment.

“If they don’t have their defenses in order, like attack surface management or blast radius containment or basic MFA, that would not be a useful capability or a meaningful spend.”

Anthropic’s position deserves its hearing. The company told users it has no reason to believe the malware is related to Claude, installed through Claude, or tied to anything they did with Claude, and it warned that signing out stops the stolen sessions while leaving the malware in place to steal the next login.

Both hold, and they are the last thing a provider can do, because the infected device belongs to the customer. On a work laptop, the device belongs to the enterprise, and the control that catches Vidar or LummaC2 before it reads a cookie jar is endpoint detection, the control in this story the security team already runs.

The profession’s gap is rarely a missing control anymore, in McGladrey’s framing. “I think we’ve got technical solutions for nearly all of the things that could go wrong, what we don’t have is a way of prioritizing those,” he argued.

The endpoint team owns the machine. The identity team owns an SSO the account never touched, and the AI governance lead wrote a policy the employee routed around the day the card went on file.

Each of those owners is paid to close a different gap. “Engineering is comped on getting product out the door quickly, your internal audit team is comped on checking boxes to meet your compliance goals, and security is comped and sometimes penalized on a lack of incidents,” he argued. “People aren’t doing the wrong thing either. They’re doing what pays their bills on an ongoing basis.”

What security leaders need to do next

Add AI accounts to the infostealer response playbook. When an endpoint alert names a stealer family, treat every AI service session on that machine as compromised, revoke what the enterprise tenant lets you revoke, and have the employee sign out of personal accounts until the machine is clean.

Warn users that the notification itself is now a phishing template. Help Net Security flagged copycat phishing impersonating Anthropic using this campaign as pretext. If the notification lands in a user’s inbox, the next email that looks like it may not be from Anthropic.

Count the personal subscriptions on managed devices. Browser telemetry, CASB logs, and expense reports surface the sessions and the payments.

Stop personal AI accounts from holding OAuth grants into corporate Google Workspace or Microsoft 365. Both platforms let administrators restrict third-party app authorization. Use that gate so a work inbox can only be attached from a tenant the security team can revoke.

Revoke the OAuth grants Claude already holds, not just the Claude session. Signing out of Claude invalidates the stolen session but does not revoke the Google or Microsoft grant Claude was already authorized to use. Check Google’s third-party app authorizations and Microsoft’s enterprise application consents for live grants the sign-out left behind.

Move the heavy users onto the organization-managed tenant. On Team and Enterprise plans, an owner decides whether connectors can be enabled at all.

Put session binding on the renewal agenda. Google shipped Device Bound Session Credentials in Chrome 146 on Windows in April and turned it on by default for Google accounts and Workspace Individual accounts in May, binding each session to a private key in the device’s TPM so a copied cookie cannot be refreshed anywhere else. It covers Chrome on Windows only so far, so the Mac victims in this campaign sit outside it. Ask Anthropic and OpenAI for parity and Google for a coverage date before the next contract signs.

Anthropic sent its notification to individuals. The laptop the cookie came from belongs to whoever manages it, and Vidar and LummaC2 will be back for the next login on the same machine.

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution.

According to security researchers at Horizon3, most of the internet-exposed Switchvox systems have either already been targeted or will be soon.

Switchvox is an enterprise VoIP management platform used to configure and monitor business phone systems.

CVE-2026-9586 is the most serious of 12 flaws Horizon3 discovered and reported to Sangoma on April 10. The vendor fixed them in Switchvox version 8.4.0.2, released on July 14.

The vulnerability is an unauthenticated SQL injection problem in Sangoma Switchvox’s /pa HTTP endpoint. The researchers explain that the endpoint is exposed and parses an XML message containing specific key-value pairs.

When /pa receives a request to notify another phone system, such as for an incoming or outgoing call event, it extracts the PhoneIP field from the XML message and directly concatenates its value into an unparameterized SQL query.

The researchers demonstrated that this SQL injection can be exploited remotely to execute operating-system commands through a crafted XML request sent using the curl command.

On August 30, Horizon3’s honeypots observed active exploitation on multiple systems in rapid succession from a single source IP address (176.65.148.184), with the attacker attempting to establish a reverse shell.

In these attempts, the attacker executed an initial payload and then collected information about the top processes running on the Swithvox system. The data was then transmitted to a remote server in base64-encoded form.

“Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet-exposed Switchvox instances will be or have already been targeted,” Horizon3 warns.

“Currently Shodan shows that there are approximately 4,000 devices on the internet, with most located within the United States.”

Horizon3 says it has not seen active exploitation of the remaining 11 flaws it discovered earlier.

With CVE-2026-9586 being actively exploited, system administrators are recommended to upgrade to Switchvox version 8.4.0.2 or later as soon as possible, and check for signs of having been targeted in the meantime.

Signs of compromise include suspicious statements in /var/log/switchvox/db-quirks.log and network connections to the observed attacker IP, particularly on port 39323.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report