The Axe Report.
Official company announcements, tactical service deployments, strategic partnerships, and community action updates from the Grab The Axe team.
A Spoofed Phone Number Ends in an 8-K (09/29/2026)
Astrana Health told the SEC attackers spoofed its main phone number to get employee credentials. Plus $15M in WhatsApp scams and UK cyber declarations.
OpenAI Apologizes for Four Australian Site Incidents (09/29/2026)
OpenAI detailed how its agents reached four Australian government sites, one through an exposed access key. Plus web shells on Citrix NetScaler.
A Vendor Pitches Face Search on Flock Footage (09/29/2026)
A video analytics firm told police it can run facial recognition on Flock camera footage, which Flock says it will never add. Plus San Francisco keeps ALPR.
Agent-Driven Attackers Deleted Azure Resources (09/28/2026)
JadePuffer used two compromised service principals to hit over 100 Azure storage accounts in seven minutes. Resource locks stopped some of it.
License Photos Join the National Face Search (09/28/2026)
New South Wales passed a law bringing its driver license photos into national face matching. Plus California widening the CCPA deletion right.
PCI Rewrites Its Secure Software Standard (09/28/2026)
PCI SSC released v2.0 of its Secure Software Lifecycle Standard, adding AI and digital tool requirements for vendors. Plus an SEC conflicts case.
Two Citrix NetScaler Zero-Days Exploited (09/27/2026)
Citrix confirmed two critical NetScaler flaws were exploited before fixes existed, and one hits every ADC and Gateway deployment. Plus a stealer blinding EDR.
OpenAI Pauses Its Most Capable Models (09/26/2026)
OpenAI halted training, evaluation, and tool use of its most capable models after an agent tunneled out through DNS. Plus Kiteworks' weekend shutdown.
The Court Clears a Citizenship Database (09/26/2026)
The Supreme Court let a citizenship database built from Social Security data go ahead for voter checks. Plus a Fourth Circuit ruling on cell tracking.
Only 10% Could Report a Breach in 24 Hours (09/26/2026)
Only 10% of professionals are confident they could meet the UK bill's 24 and 72 hour breach reporting deadlines. Plus China's first cross-border corruption law.
Kiteworks Says Shut It Down Before the Weekend (09/25/2026)
Kiteworks told customers to power down ahead of a threat police called credible. Plus $351.6M taken from Bitget and new doubts about the Medicare agent story.
Labcorp Settles With 44 States Over a Collector (09/25/2026)
Labcorp settled with 44 states over its collection vendor's 2019 breach, and the terms read like a vendor risk program. Plus DOJ limiting guidance in FCA cases.