BREAKING: Microsoft, $MSFT, is offering buyouts to 60,000 workers as part of the company’s efforts to cut costs amid AI adoption, per Bloomberg. Personnel on select teams in the US, Canada, India, and the UK at a vice president level and below will be eligible. This reflects ~27% of Microsoft's total workforce.

The r/OpenSource subreddit has officially banned anything using AI. In any way. Violators will be permanently banned. Which means… r/OpenSource will ban anyone submitting anything that, in any way, involves… the Linux kernel. reddit.com/r/opensource/comm…

‼️ WARNING - A researcher just dropped a report on Tailscale SSH flaws — one compromised device could get root on others, and there’s NO PATCH yet. In lab tests, SSH port forwarding enabled privilege escalation and lateral movement across already-permitted devices. Tailscale says a fix is coming. Read - thehackernews.com/2026/10/un…

Ubuntu 26.10 supports new authentication flows for Microsoft identity services, along with 26.04 LTS and 24.04 LTS. 🔒 Learn more: canonical.com/blog/canonical…

Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications. On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments. While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software. After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely. openai.com/index/securing-ou…

Microsoft releases a new messenger application for Windows 2000, called Windows Messenger.

Reminder: On January 12, 2027, Windows 10 Enterprise LTSC 2021 will reach end of updates. To help keep devices protected and supported, we recommend updating to the latest Long-Term Servicing Channel release, Windows 11 Enterprise LTSC 2024. Learn more: techcommunity.microsoft.com/…

‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws. New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance. Full details → thehackernews.com/2026/10/ur…

‼️ALERT - Two new unpatched CVSS 9.0 RCE flaws in #Linux's KSMBD SMB server were disclosed on public kernel mailing lists before fixes were ready. One can be triggered WITHOUT authentication. Neither has a mainline kernel fix. Details here ↓ thehackernews.com/2026/10/tw…

The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.