The Axe Report.
Official company announcements, tactical service deployments, strategic partnerships, and community action updates from the Grab The Axe team.
Six Point Four Million Addresses (09/18/2026)
McKesson quantified its stolen data at 6.4 million unique email addresses, Ambry Genetics paid $700,000 to settle HIPAA violations, and senators reintroduced a health security bill.
One Model Used to Break Into Another (09/18/2026)
Researchers used Claude to compromise OpenAI employees' ChatGPT accounts, Microsoft patched a CVSS 10.0 Azure AI Foundry flaw, and Plugin4Shell reaches four AI coding agents.
Nobody Watched Who Saw the ID Photos (09/18/2026)
A DHS watchdog found TSA lacked oversight of vendor access to passenger ID images, and Boston councilors say they were never told police bought AI social media monitoring.
Two Management Planes, Both Rooted (09/17/2026)
Cisco disclosed a CVSS 10.0 ISE authentication bypass under active attack, Check Point patched an unauthenticated root flaw, and Brevo's supply chain injected ClickFix into customer sites.
The Police Department That Was Not One (09/17/2026)
A Flock-owned account posing as a police department ran searches against real cameras for real people, and California set a $10,000 penalty for AI posing as a therapist.
The Risk Surface Outgrew the Program (09/17/2026)
Healthcare's risk surface is expanding faster than compliance programs can follow, Modernizing Medicine settled for $3 million, and the DOL clarified mental health parity enforcement.
Somebody Stole the Camera's Source (09/16/2026)
Hackers extracted Flock's camera software and revealed how it tracks cars and people, Boston canceled its contract over nationwide data sharing, and Florida's stolen records were published.
A Reporting Mandate Is Almost Finished (09/16/2026)
A federal cyber incident reporting law covering critical infrastructure is nearing completion, a House subcommittee examined healthcare cybersecurity proposals, and FCPA cases are down.
One Extension, Five AI Assistants (09/16/2026)
A single browser extension can hijack AI assistants across Chrome, Comet, Edge, Opera Neon and Claude, and CISA warned the critical ScreenConnect flaw is now under attack.
The Agents Are Sending Mail Now (09/15/2026)
An AI agent platform is flooding inboxes worldwide with useless work, and the EU is moving toward a minimum social media age of 15 across the bloc.
The Email Gateway Was Rooted by an Email (09/15/2026)
Cisco patched a Secure Email Gateway zero-day already being exploited for root command execution, and CISA confirmed ransomware crews are hitting a critical VMware flaw.
Your AI Notes May Not Be Privileged (09/15/2026)
Courts are working out when AI-assisted investigation work loses attorney-client privilege, the PCI Council published AI security guidance, and the SEC issued a compliance review alert.