The Axe Report.
Official company announcements, tactical service deployments, strategic partnerships, and community action updates from the Grab The Axe team.
Microsoft Shipped 974 Fixes in One Day (09/09/2026)
September's Patch Tuesday broke every previous record at 974 CVEs, Chrome patched a V8 zero-day already under attack, and SAP closed a maximum severity kernel flaw.
The Television Was Watching on Standby (09/08/2026)
LG faces claims of an egregious invasion of privacy over TV data collection, and a secretive DHS predictive policing unit is analyzing Americans' financial habits.
OSHA Machine Guarding and the FCA on Frontier AI (09/08/2026)
Machine guarding under 29 CFR 1910.212 is back in OSHA's Top 10 citations, the FCA published what it found reviewing frontier AI use, and OneTouchPoint settled a 2022 breach.
A Zero-Click Worm That Arrives as a Phone Call (09/08/2026)
Researchers built a WeChat worm that takes an account over through an incoming call nobody answers, and a planted ChatGPT prompt quietly forwarded a victim's Gmail data.
Fake IT Calls and a Fourth Hotfix in Five Weeks (09/07/2026)
Attackers are calling executives while posing as the help desk to reach Microsoft 365, and N-able shipped a fourth N-central hotfix in five weeks for the same class of flaw.
The Travel App That Exposed Soldiers (09/07/2026)
A travel app with 23 million users exposed enough data to track people including soldiers, and an Illinois State Police database published Social Security numbers online.
How to Explain an Unpatched Vulnerability (09/07/2026)
June brought 66 large healthcare breaches, Luminis Health is restoring systems after an attack, and there is finally sane guidance on documenting a deferred patch for your auditor.
Assume Your MikroTik Is Compromised (09/06/2026)
CERT Polska warned of an exploited MikroTik SSH authentication bypass with attackers adding accounts, and Sansec found an unpatched Magento zero-day backdooring stores.
California Draws the Line on Clinical AI (09/05/2026)
California's 2026 session put clinical judgment back on the licensed professional, the SEC published examination findings on adviser conflicts, and Illinois trucking suits reach past the driver.
Breached Through Its Own Unpatched TeamCity (09/05/2026)
JetBrains told Cadence users to rotate every credential after attackers exploited its own unpatched TeamCity, and Trezor found deleted customer data was never deleted.
A Chrome Zero-Day and 440,000 Exploit Attempts (09/04/2026)
Google patched an actively exploited V8 flaw, Wordfence counted 440,000 attempts against two WordPress plugins, and Cisco bundled so many IOS XR bugs it shipped a release for them.
Lawyers Get $147 Million, You Get $5 (09/04/2026)
A judge approved $147 million in fees from Google's $425 million tracking verdict while class members get $5, and attackers watched an ID verification feed for a year.