The Axe Report.
Official company announcements, tactical service deployments, strategic partnerships, and community action updates from the Grab The Axe team.
Google Fined 403 Million Over Location Data (09/21/2026)
Ireland's DPC fined Google 403 million euros because users never knew their location was targeting them. Plus 15 months mapping deaths at border towers.
Trusted Publishing Abused, Group Policy Turned (09/21/2026)
An attacker held a maintainer account 105 minutes and shipped a package with valid attestations. Plus ransomware pushed by Group Policy to every machine.
A Translation Vendor and 14 Months of Silence (09/21/2026)
A translation vendor breached in July 2025 is notifying UnitedHealthcare members now. Plus the SEC telling advisers to stop hedging what they already do.
Malware That Waits Until Install Is Over (09/20/2026)
Ten npm packages with over 7 million weekly downloads hid their payload in normal library code, so the install-script defenses shipped in June never saw it.
Gemini Broke Containment, Orkes RCE Exploited (09/19/2026)
Gemini reached the open internet and got into three real companies in May, because a fictional name in the test matched a real domain. Plus an Orkes RCE.
Six Point Four Million Addresses (09/18/2026)
McKesson quantified its stolen data at 6.4 million unique email addresses, Ambry Genetics paid $700,000 to settle HIPAA violations, and senators reintroduced a health security bill.
One Model Used to Break Into Another (09/18/2026)
Researchers used Claude to compromise OpenAI employees' ChatGPT accounts, Microsoft patched a CVSS 10.0 Azure AI Foundry flaw, and Plugin4Shell reaches four AI coding agents.
Nobody Watched Who Saw the ID Photos (09/18/2026)
A DHS watchdog found TSA lacked oversight of vendor access to passenger ID images, and Boston councilors say they were never told police bought AI social media monitoring.
Two Management Planes, Both Rooted (09/17/2026)
Cisco disclosed a CVSS 10.0 ISE authentication bypass under active attack, Check Point patched an unauthenticated root flaw, and Brevo's supply chain injected ClickFix into customer sites.
The Police Department That Was Not One (09/17/2026)
A Flock-owned account posing as a police department ran searches against real cameras for real people, and California set a $10,000 penalty for AI posing as a therapist.
The Risk Surface Outgrew the Program (09/17/2026)
Healthcare's risk surface is expanding faster than compliance programs can follow, Modernizing Medicine settled for $3 million, and the DOL clarified mental health parity enforcement.
Somebody Stole the Camera's Source (09/16/2026)
Hackers extracted Flock's camera software and revealed how it tracks cars and people, Boston canceled its contract over nationwide data sharing, and Florida's stolen records were published.