OpenAI Models Hide Errors and Hunt API Keys
OpenAI disclosed six misalignment incidents found during model training and evaluation. Cases included GPT-5.6 Sol instances instructing future instances to hide errors, another model using an exposed API key without permission before fabricating requested data, and agents uploading files or communicating through repositories. The cases were individual examples, not evidence that deployed models behave this way broadly.
Under its new reporting framework, OpenAI will track, investigate, and disclose such cases even before every cause or mitigation is settled.
Security teams shouldn’t treat prompts as controls: Enforce least privilege, require human approval or extra authentication for sensitive actions, monitor tool use and outbound data, and maintain circuit breakers.
If your agent can reach the keys, assume it will jiggle the handle.
Google Patches Pixel’s Silent Modem Zero-Day
Google patched CVE-2026-58704, a high-severity Pixel cellular-modem flaw, following evidence of narrow, real-world attacks. A nearby attacker could silently hijack modem controls and gain elevated access to the device without the victim ever tapping a thing.
Google has not revealed who was targeted, how many devices were hit, or what the attackers wanted.
CISA added the bug to its Known Exploited Vulnerabilities catalog and gave federal agencies until tomorrow, Sept. 19, to fix it. Pixel owners should install security patch level 2026-09-05 or later through Settings > Security & privacy > System & updates > Security update, then restart. There is no suspicious link to avoid; the patch is the protection.
WooCommerce Plugin Attacks Top 100,000 Attempts
Threat actors are exploiting CVE-2026-27540 to plant web shells and execute code on vulnerable WooCommerce sites.
More than 100,000 exploit attempts have been blocked since June, despite a patch being available since February.
If the plugin was exposed before it was patched, I would move beyond vulnerability management and start incident response to determine whether attackers established persistence.
Patch the plugin and scan affected sites for web shells or unexpected administrator accounts.
Microsoft Emergency Patch Fixes Windows Update Problems
Microsoft issued emergency updates after September Patch Tuesday disrupted several Windows services and devices.
The original release fixed over 900 vulnerabilities, including two under active exploitation.
When a security update breaks Remote Desktop and virtual machines, the problem is no longer just patching. I would make those dependencies part of post-update validation before approving a wider rollout.
Use update rings to deploy patches to a small group first, monitor for regressions, and verify rollback procedures before organization-wide deployment.
513,000 Gmail Accounts Linked to Criminal Network
Police in India uncovered 513,000 Gmail accounts linked to an alleged criminal network during a bomb threat investigation.
There is no evidence Google’s 2FA was compromised, but the case shows that authentication alone does not establish trust.
This is a good reminder that criminals can secure their own accounts with 2FA, so authentication should never be mistaken for proof that an account or its owner is legitimate.
Verify requests through a separate trusted channel before taking action.
Exploited Pixel Zero-Day Draws CISA Warning
Google says attackers exploited a Pixel modem zero-day that enables privilege escalation without user interaction.
CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to patch it.
I would use this incident to reassess mobile risk and whether existing controls can protect against attacks that require no user interaction.
Verify affected Pixel devices are patched and enforce updates through mobile device management.
Security Flaws Let Attackers Blacklist Legitimate Phones
Researchers found flaws in stolen-device reporting systems that could let attackers blacklist legitimate phones.
They demonstrated the attack against an unreleased phone and found similar weaknesses could disable cellular backup for some home security systems.
I would look at this as a third-party dependency risk, because an organization can secure its devices and still lose connectivity through a carrier process it does not control.
Carriers should require multiple ownership signals before blacklisting an IMEI and flag unusual reporting patterns for additional verification before cellular access is revoked.