IBM and Red Hat are committing five billion dollars and 20,000 engineers to Project Lightwell, a new service that patches open-source software vulnerabilities for enterprise customers who can't risk disrupting production systems. The move comes after Anthropic's AI-powered Mythos model discovered vulnerabilities at an unprecedented rate through Project Glasswing, finding over 1,500 bugs across hundreds of projects but with only 6 percent patched so far, as overwhelmed maintainers struggle to keep up with AI-speed discovery. IBM's service will backport fixes to specific software versions without requiring full upgrades, though the company has notably not confirmed whether its own watsonx AI platform plays any role in the initiative.

Cybersecurity firm Huntress is warning about a massive password spray campaign targeting Microsoft 365 environments through the Azure CLI. Over a nine-day period in June, attackers launched more than 81 million login attempts, successfully compromising 78 user accounts across 64 organizations by exploiting a weakness in the OAuth ROPC authentication flow that can bypass multi-factor authentication if not properly configured. The attacks, which originated from infrastructure linked to a Chinese internet hosting provider, highlight the critical importance of implementing MFA policies that cover all authentication flows and cloud applications.

Amsterdam-based cybersecurity startup Dawnguard has raised a total of six point three million dollars in pre-seed funding and publicly launched its security architecture automation platform. The platform helps organizations design and build secure cloud systems from the ground up, generating production-ready infrastructure-as-code and continuously validating deployments to prevent security drift. The company plans to use the funding to accelerate product development, particularly in AI-driven architecture intelligence, while expanding its international presence.

Apple has released security updates addressing 37 vulnerabilities across iOS, iPadOS, macOS Tahoe, and Safari, with 26 of those flaws specifically affecting WebKit browser components. The WebKit bugs could allow malicious websites to steal data, crash Safari, corrupt memory, and access sensitive information, while interestingly, at least four of the security issues were discovered using AI tools from Anthropic and OpenAI. Although Apple says none of the vulnerabilities are currently being exploited in the wild, users are urged to update immediately since threat actors are known to quickly weaponize newly disclosed bugs in Apple products.

Frontier AI is transforming vulnerability management in cybersecurity, but enterprises need to cut through vendor hype by asking tough questions about their AI capabilities. Security expert Joshua Goldfarb recommends that companies probe vendors on six key areas: which AI model providers and specific models they're actually using, the level of automation they've truly achieved, how they're providing proper context to AI systems, what measurable results they're getting, and how they're vetting findings to avoid false positives. The bottom line is that vendors should be able to back up their Frontier AI claims with concrete details and metrics, or enterprises should be skeptical of their promises.

Citrix has released security updates for NetScaler ADC and NetScaler Gateway that fix six vulnerabilities, including the newly discovered HTTP/2 Bomb denial-of-service flaw. The most concerning issue is CVE-2026-8451, described as the latest in the CitrixBleed series, which could allow attackers to leak sensitive data from vulnerable appliances and potentially achieve full device compromise. Organizations with self-managed NetScaler deployments are strongly urged to apply these patches immediately, particularly those with SAML IDP configurations enabled.

Adobe has released critical security patches for ColdFusion and Campaign Classic, addressing multiple vulnerabilities with maximum severity ratings of ten out of ten. The Campaign Classic update fixes an authorization flaw that could allow arbitrary code execution, while ColdFusion patches resolve eleven security defects including issues with file uploads, input validation, and path traversal that could also lead to code execution. While Adobe says there are no known public exploits yet, the company has given these updates top priority and is urging users to apply the patches immediately.

Cybersecurity researchers have identified a new threat called "phantom squatting," where attackers exploit AI-generated hallucinated domain names to launch phishing campaigns and distribute malware. When AI models like ChatGPT fabricate non-existent websites or resources in their responses, malicious actors can register these hallucinated domains and wait for unsuspecting users who trust the AI's recommendations to visit them. This emerging attack vector highlights a novel intersection between AI's tendency to generate false information and traditional cybersquatting tactics.

Microsoft has announced it's accelerating its transition to post-quantum cryptography, moving up its timeline to 2029. The shift is driven by growing concerns that quantum computers could eventually break current encryption methods, prompting the tech giant to implement quantum-resistant security measures earlier than originally planned. This move signals increasing urgency across the tech industry to protect data against future quantum computing threats.

A new cybersecurity assessment warns of a growing disconnect between organizational awareness of threats and actual resilience capabilities heading into 2026. The report highlights emerging challenges including AI-discovered software vulnerabilities and the need to secure autonomous AI systems, while emphasizing that understanding attacker tools and techniques remains critical to preventing breaches. Organizations are being urged to close this awareness-resilience gap through improved governance, machine-speed response capabilities, and hands-on security training.