Six of this week’s thirty security stories, checked against the original advisories, each with one clear action: Fortinet’s critical firewall fixes and the still-active FortiBleed campaign, a rented Android banking trojan, a blank PDF invoice that opens a backdoor, a Microsoft Authenticator token flaw, 32 fake AI bots hunting for secrets, and why CISA’s must-patch list is a floor. Patch order for companies, a checklist for users.
The Latest
This Week in Security: Firewall Fixes, a Rented Banking Trojan, a Blank PDF and Stolen Tokens. What to Actually Do
They Came for the Keys, Not the Data: Cisco SD-WAN Malware and Why Network Edge Boxes Are Attackers’ Favorite Door
Cisco Talos found malware called KeyDrift on Cisco Catalyst SD-WAN controllers, built to copy the keys that encrypt traffic between a company’s sites. The door was a 10.0 flaw fixed in February. What is confirmed, what the Volt Typhoon link does and does not mean, why edge devices are attackers’ favorite door, and what companies and users should do now.
Anthropic Bought A One-Person Biotech That Ran A Drug Program With Claude – Forbes
A headline-only report says Anthropic bought a one-person biotech whose drug program used Claude; deal terms and research details remain unclear.
An Updated Model Spec For More Capable And Beneficial AI
OpenAI’s headline announces an updated Model Spec aimed at more capable and beneficial AI, but the available announcement provides no further details.
How Ropes & Gray Is Developing AI For Transactional Diligence
OpenAI’s headline identifies Ropes & Gray’s work developing AI for transactional diligence, but provides no article text or supporting details.
XREAL AURA: Gemini Can Now See What You See. What Google’s First Android XR Glasses Are Good For, and What They Cost in Privacy
XREAL AURA, the first wired glasses running Android XR, puts Gemini in your field of view from $1,099. What the glasses and the puck can do, what Gemini sees when you share your view, how AURA compares with Vision Pro, Galaxy XR and Meta’s glasses, what testers found, and what it means for companies and users, including the privacy settings to change on day one.
How We Detect Frontier Model Misalignment
OpenAI’s article title signals a focus on detecting frontier model misalignment, but its body and methods were unavailable for review.
Who Tests the Most Powerful AI Before It Ships? Britain Pays Far More Than the US, but Not “10 Times” More
Britain just gave its AI Security Institute an extra £120 million, spread over four years. The US testing center at NIST runs on about $15 million a year. Per year, Britain spends roughly 8 to 9 times more, not “10 times” from the top-up alone. What the testers found in 2026, why access matters more than money, how the EU AI Office differs, and what it means for companies and users.
Did China’s Newest AI Models Learn From GPT-6 Astra? What the Distillation Report Shows, and What It Doesn’t
The Information reports that DeepSeek and Moonshot AI relied heavily on GPT-6 Astra outputs to train Kimi K3.1 Pro and DeepSeek V4.1 Flash 1017. One source, no confirmation. What distillation is, what is documented, what is legal, and what it means for companies and users.
The AI Boom Has Reached Your Shopping Basket: SK hynix Sees a Memory Shortage Until 2030. What It Means for Phones, PCs and IT Budgets
SK hynix expects memory demand to exceed supply through 2030 and says fewer PCs and phones will sell. Samsung’s phone business lost money while its chips set records. Why AI data centers absorb the memory, how it reaches device prices and specs, what companies and users should do now, and why the forecast is also a sales pitch.
