The Axe Report.
Official company announcements, tactical service deployments, strategic partnerships, and community action updates from the Grab The Axe team.
Breached Through Its Own Unpatched TeamCity (09/05/2026)
JetBrains told Cadence users to rotate every credential after attackers exploited its own unpatched TeamCity, and Trezor found deleted customer data was never deleted.
A Chrome Zero-Day and 440,000 Exploit Attempts (09/04/2026)
Google patched an actively exploited V8 flaw, Wordfence counted 440,000 attempts against two WordPress plugins, and Cisco bundled so many IOS XR bugs it shipped a release for them.
Lawyers Get $147 Million, You Get $5 (09/04/2026)
A judge approved $147 million in fees from Google's $425 million tracking verdict while class members get $5, and attackers watched an ID verification feed for a year.
The SEC Moves to Rescind Pay to Play (09/04/2026)
The SEC proposed rescinding its pay-to-play rule for investment advisers, the G7 told organizations to start the post-quantum migration now, and another vendor breach hit four practices.
Cisco Nexus Root RCE and a Worm at 469 Locations (09/03/2026)
Cisco patched an unauthenticated root execution flaw in Nexus 9000 switches, the Shai-Hulud worm now scans 469 credential locations, and Coder's registry served malicious Terraform modules.
FinCEN Clarifies What You Cannot Tell a Customer (09/03/2026)
Five federal agencies clarified SAR confidentiality for customer communications, the NBA found the Clippers arranged sham endorsements, and MCNA settled its 2023 breach litigation.
Flock Taught Police How to Watch a Protest (09/03/2026)
A Flock webinar walked police through surveilling protests and parades, 170 million ID scans surfaced on a Russian forum, and Pegasus reached a Serbian student activist's iPhone.
153 Million Driver's Licenses For Sale (09/02/2026)
A search site claimed more than 150 million license photos taken from an ID verification service, Texas police used AI to write up a Flock search, and Austria cleared a credit data class action.
SonicWall Zero-Days and a Hijacked Update Route (09/02/2026)
Two SonicWall SMA 1000 zero-days are chained in live attacks, a BGP hijack poisoned a Virtualizor update, and a repo's own Git config can make AI coding agents run attacker code.
Texas Bans Price Optimization in Ratemaking (09/02/2026)
Texas declared price optimization unfairly discriminatory, Colorado proposed AI Act rules that reach deployers, and two more healthcare vendors put patient records in breach notices.
DaVita Pays $15 Million and Aesto Loses 9.5 Million (09/01/2026)
Two healthcare settlements land the same day, counsel question whether a forensic audit is a real thing, and CIPA gets rewritten by SB 690.
California Takes Away the Private Suit (09/01/2026)
Lawmakers gutted private enforcement under a key state privacy law, the FTC and states sued Amazon over a secret ad surcharge, and Austria cleared a class action.