#AxisOfEasy Weekly Tech Digest

In this issue: Canada Budgets A National Traveler Biometrics Program: Facial Imaging, Expanded Screening, And A “Biometric Passport” Plan York University Investigates A Cybersecurity Incident With Personal And Financial Data Theft Binance Warns Of An iOS “worse_query” Sandbox Escape That Could Leak Crypto Wallet Secrets sshole: A New OpenSSH RCE Lets Attackers SSH Into Linux Devices — 437 Exposures Within Hours OpenAI Ships GPT-6 Cyber After Its AI Models Mine 81 Firefox Flaws And 948 Web CVEs In this issue: Canada Budgets A National Traveler Biometrics Program: Facial Imaging, Expanded Screening, And A “Biometric Passport” Plan York University Investigates A Cybersecurity Incident With Personal And Financial Data Theft Binance Warns Of An iOS “worse_query” Sandbox Escape That Could Leak Crypto Wallet Secrets sshole: A New OpenSSH RCE Lets Attackers SSH Into Linux Devices — 437 Exposures Within Hours OpenAI Ships GPT-6 Cyber After Its AI Models Mine 81 Firefox Flaws And 948 Web CVEs

In this issue: Supermarket Freezers Across Europe Hit Again — Wave 2, Seven Countries Binance Loses $6.43 Billion In A Rigged Interview, AI-Tool Heist — The Biggest Crypto Theft Ever WordPress Core Flaw On CISA’s KEV — Exploited During The Upgrade Window Linux Kernel TCP RCE (CVE-2026-98432) — Red Hat Patches, Ubuntu Still Testing Chinese Hackers Run ARTEX AI Against 200 Organizations In this issue: Supermarket Freezers Across Europe Hit Again — Wave 2, Seven Countries Binance Loses $6.43 Billion In A Rigged Interview, AI-Tool Heist — The Biggest Crypto Theft Ever WordPress Core Flaw On CISA’s KEV — Exploited During The Upgrade Window Linux Kernel TCP RCE (CVE-2026-98432) — Red Hat Patches, Ubuntu Still Testing Chinese Hackers Run ARTEX AI Against 200 Organizations

In this issue: Warhound Raises $200M To Engineer War Dogs And Arm Them With Anduril Gear An MCP That Reads Your Reddits Quietly Runs Hidden Python Stuffed Into An Image Japan’s Onamae Desktop Cloud Hacked, Malware On Up To 27,000 Servers Tailscale Warns of 11 Unpatched SSH Flaws Allowing Root Privilege Escalation Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits In this issue: Warhound Raises $200M To Engineer War Dogs And Arm Them With Anduril Gear An MCP That Reads Your Reddits Quietly Runs Hidden Python Stuffed Into An Image Japan’s Onamae Desktop Cloud Hacked, Malware On Up To 27,000 Servers Tailscale Warns of 11 Unpatched SSH Flaws Allowing Root Privilege Escalation Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits

In this issue: PHP Ships Emergency Security Release For Two Critical RCE Flaws Staples Hacked, Millions In Gift Cards, Goods Shipped Back To China Broadcom Wi-Fi Flaw Lets An Attacker In Range Run Code As Root On Routers Discover Tech Turned Targeted Ads Into A Pipeline For Zero-Click Spyware Feds Suspect Ransom Negotiator Ran ShinyHunters’ Extortion Site In this issue: PHP Ships Emergency Security Release For Two Critical RCE Flaws Staples Hacked, Millions In Gift Cards, Goods Shipped Back To China Broadcom Wi-Fi Flaw Lets An Attacker In Range Run Code As Root On Routers Discover Tech Turned Targeted Ads Into A Pipeline For Zero-Click Spyware Feds Suspect Ransom Negotiator Ran ShinyHunters’ Extortion Site

In this issue: A Flock-Like Camera In Canada, Pointed At The Police Station — Then The Police Visited French Supermarket Freezers Cranked To 50C — Hundreds Of Stores Affected, Fires Reported An OpenAI Engineer Was Arrested For Planting A Listening Device In A Conference Room GitHub Tightens Npm Publishing After Flaw Left 1,500+ Packages Vulnerable To Hijacking Ghostscript Flaw Lets Attackers Hijack Servers Through A Single Crafted PDF In this issue: A Flock-Like Camera In Canada, Pointed At The Police Station — Then The Police Visited French Supermarket Freezers Cranked To 50C — Hundreds Of Stores Affected, Fires Reported An OpenAI Engineer Was Arrested For Planting A Listening Device In A Conference Room GitHub Tightens Npm Publishing After Flaw Left 1,500+ Packages Vulnerable To Hijacking Ghostscript Flaw Lets Attackers Hijack Servers Through A Single Crafted PDF

In this issue: Bitget Exchange Loses $387.5 Million After Attackers Exploit A Zero-Day In Security Software 18 Months In Prison. Wrong Username. OpenInfra Europe’s JFrog Artifactory Breached — Anyone Who Pulled Packages Between August 28 and September 15 Should Assume Compromise CISA Warns A Single Crafted Request Can Give Root On Exposed MikroTik Routers More Than Half A Million GitHub Credentials Were Still Valid Years After Being Posted — Some From 2009 In this issue: Bitget Exchange Loses $387.5 Million After Attackers Exploit A Zero-Day In Security Software 18 Months In Prison. Wrong Username. OpenInfra Europe’s JFrog Artifactory Breached — Anyone Who Pulled Packages Between August 28 and September 15 Should Assume Compromise CISA Warns A Single Crafted Request Can Give Root On Exposed MikroTik Routers More Than Half A Million GitHub Credentials Were Still Valid Years After Being Posted — Some From 2009

  In this issue: Citrix’s NetScaler Zero-Days Were Exploited For Weeks Before Anyone Patched Apple Patches A Zero-Day Used In An “Extremely Sophisticated” Spyware-Style Attack A Pentagon Personnel Database Was Quietly Open For Nine Months An AI Agent Broke Into A Vulnerability-Disclosure Nonprofit, And Was Bad At It Mark E. Jeftovic: What’s Really Behind The AI Panic   In this issue: Citrix’s NetScaler Zero-Days Were Exploited For Weeks Before Anyone Patched Apple Patches A Zero-Day Used In An “Extremely Sophisticated” Spyware-Style Attack A Pentagon Personnel Database Was Quietly Open For Nine Months An AI Agent Broke Into A Vulnerability-Disclosure Nonprofit, And Was Bad At It Mark E. Jeftovic: What’s Really Behind The AI Panic

https://youtu.be/LhHjgNFWLso In this issue: Google Confirms Gemini Broke Into Three Real Companies During A Security Test Cisco Patches Two Actively Exploited Zero-Days In Two Days Microsoft Takes Down An AI-Powered Phishing Platform That Hit 12,000 Accounts Ireland Fines Google $463 Million Over How It Handled Your Location History A Maximum-Severity D-Link Router Bug Has No Patch And A Public Exploit https://youtu.be/LhHjgNFWLso In this issue: Google Confirms Gemini Broke Into Three Real Companies During A Security Test Cisco Patches Two Actively Exploited Zero-Days In Two Days Microsoft Takes Down An AI-Powered Phishing Platform That Hit 12,000 Accounts Ireland Fines Google $463 Million Over How It Handled Your Location History A Maximum-Severity D-Link Router Bug Has No Patch And A Public Exploit

In This Issue: A Compromised HBO Max Account Became A Malware Storefront Iran’s Spyware Playbook: Befriend You On WhatsApp, Then Own Your Laptop Chinese Spies Turned Google’s Own Bug Fixes Into A Working Exploit Google Patches A Zero-Click Pixel Bug That Was Already Being Used On Real Phones A Fake Government Email Got Revolut To Hand Over Passports And Bitcoin Histories In This Issue: A Compromised HBO Max Account Became A Malware Storefront Iran’s Spyware Playbook: Befriend You On WhatsApp, Then Own Your Laptop Chinese Spies Turned Google’s Own Bug Fixes Into A Working Exploit Google Patches A Zero-Click Pixel Bug That Was Already Being Used On Real Phones A Fake Government Email Got Revolut To Hand Over Passports And Bitcoin Histories

In this issue: Your LG TV Is Listening Even When It’s “Off” A Swarm Of OpenAI Agents Secretly Ran A German Wiki As Their Message Board For Three Months Hackers Drain $320 Million From Liquid Network, Then Give Most Of It Back Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days Trezor’s Address Breach Just Went Analog: Scam Letters With Malicious QR Codes Anthropic Employee (for six weeks) Sounds the Alarm on AI Alignment In this issue: Your LG TV Is Listening Even When It’s “Off” A Swarm Of OpenAI Agents Secretly Ran A German Wiki As Their Message Board For Three Months Hackers Drain $320 Million From Liquid Network, Then Give Most Of It Back Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days Trezor’s Address Breach Just Went Analog: Scam Letters With Malicious QR Codes Anthropic Employee (for six weeks) Sounds the Alarm on AI Alignment