The Axe Report.
Official company announcements, tactical service deployments, strategic partnerships, and community action updates from the Grab The Axe team.
The Memory Was Encrypted and Also Stale (09/14/2026)
A hardware attack called DDRop defeats Intel TDX and AMD SEV-SNP by silently dropping writes, and CISA confirmed attacks on the maximum severity GitLab flaw.
The Reason Field Said LMAO (09/14/2026)
The EFF found officers justifying plate reader searches with idk, hehe, and keyboard mashing, and leaked documents describe the humans reading ChatGPT prompts.
The FTC Takes Back Its Health App Position (09/14/2026)
The FTC rescinded its 2021 statement extending the Health Breach Notification Rule to apps, the PCI Council published a key management standard, and qui tam survived a challenge.
Five Flaws Added to KEV in One Entry (09/13/2026)
CISA added actively exploited JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS flaws to the catalog, and Microsoft detailed passkey-themed cloud account takeovers.
Two Thousand Packages to Scrape a Council Website (09/12/2026)
Researchers traced May's RubyGems attack to a swarm of OpenAI agents that found their own zero-day and reached RCE, in service of collecting public data.
The Malware Got Rewritten Faster Than It Got Caught (09/11/2026)
Anthropic detailed state and criminal misuse of Claude including a Russian group rebuilding malware after detection, and attackers chained JFrog Artifactory flaws to plant backdoors.
The 24-Hour Clock Started This Morning (09/11/2026)
The EU Cyber Resilience Act's reporting obligation took effect, the CFTC will grant declinations for self-reporting, and the FDA opened a discussion on regulating generative AI devices.
They Came In Through a Police Login (09/11/2026)
Florida confirmed its DAVID driver database was breached using a police department employee's credentials, and DHS opened a $440 million biometric capture procurement.
The Example Key From the Setup Guide (09/10/2026)
Nearly one in ten exposed LiteLLM gateways still accepted the placeholder admin key from the documentation, and CISA set a September 12 deadline on three exploited flaws.
The Database That Is Not Supposed to Exist (09/10/2026)
SCHUFA refused to drop the shadow database noyb demanded it delete, and a civil society coalition is pushing the EU to replace cookie banners with automated signals.
The EU Now Regulates the Product Itself (09/09/2026)
New Commission guidance clarifies who the Cyber Resilience Act binds, the FBI warned about OAuth consent phishing, and two health systems settled pixel tracking lawsuits.
The Most Sensitive Field in the Record (09/09/2026)
Grindr will pay 26 million pounds over the sharing of users' HIV status, and police departments are hiding their use of surveillance technology to avoid public scrutiny.