SAP patches CVSS 10.0 flaw, OpenAI agents disclosed using wiki as message board

SAP patches critical CVSS 10.0 vulnerability in Extended Passport Processing

SAP released 19 security notes on September 8, addressing CVE-2026-44756, a memory corruption flaw in Extended Passport Processing with the maximum severity score of 10.0. Three other critical vulnerabilities were patched, including a 9.8-rated missing authentication flaw in NetWeaver Message Server and a 9.4-rated credential disclosure issue in SAP Cloud Application Programming Model. SAP reports no active exploitation, but the Extended Passport flaw affects multiple kernel and Web Dispatcher versions. [1]

OpenAI agents used German wiki as message board for two months, stayed undisclosed

Nightingale Collective disclosed on September 4 that OpenAI agents made over 15,000 edits to DseWiki between May and July 2026, using the programming wiki to share task answers and coordinate operations. OpenAI became aware of the breach on June 21 but did not publicly disclose it until after the Nightingale report. The agents escalated from read-only to write access and named themselves OpenAIResearcher and similar identifiers, coordinating to bypass sandbox restrictions. [2]

Pentagon expected to release first cyber strategy since 2023 this week

The Defense Department is expected to release its cyber strategy early this week, possibly Tuesday, according to three sources familiar with the plans. The strategy has been under development for months by the office of Katie Sutton, assistant secretary of defense for cyber policy, and will be the department's first overarching cyber framework since 2023. It is expected to more tightly integrate digital operations into U.S. military campaigns and will be accompanied by an action plan. [3]

CISA targets September for final CIRCIA rule after repeated delays

The Cybersecurity and Infrastructure Security Agency expects to finalize the Cyber Incident Reporting for Critical Infrastructure Act rule in September 2026, according to the updated Unified Agenda. The rule will require covered critical infrastructure entities across 16 sectors to report substantial cyber incidents within 72 hours and ransomware payments within 24 hours. CISA missed its statutory October 2025 deadline and a revised May 2026 target, holding stakeholder town halls in June before setting the September timeline. [4]