Microsoft's September 2026 Patch Tuesday has become its biggest security release on record, with the company issuing fixes for a staggering 974 vulnerabilities across the entire stack.
According to the company's release notes, an overwhelming majority (723) of the vulnerabilities addressed related to Windows, with Office coming in at second place with 111 of its own vulnerabilities being addressed.
While it's clear that the number of vulnerabilities is going up year-over-year, it's likely that the company was also simply able to find more of them that would otherwise have slipped through the net thanks to AI-assisted discovery tools.
Speaking about the September 2026 Patch Tuesday in a blog post, Dustin Childs explains that this could be the start of the "new normal." Childs goes on to reveal that Microsoft has patched 2,760 CVEs this year to date – more than double any other year that precedes it.
Childs' figures show that the company patched 1,139 CVEs in the whole of 2025, and a much lower 492 a decade ago in 2016. According to the post, 114 of the vulnerabilities patched in this latest update were 'Critical' – more than one in 10.
In its own notes, Microsoft described CVE-2026-85880 and CVE-2026-81963 as especially notable because they're both being actively exploited, hence the push to get them fixed and for customers to install the update.
Elsewhere in the industry, Microsoft isn't the only company addressing a higher volume of bugs. Childs also highlighted high activity from Adobe, while a number of browser developers including Google, Mozilla, Brave and Microsoft itself have doubled the release cycle to two weeks in order to get fixes into customer hands more quickly.
Besides fixing exploitable bugs, Microsoft also used the opportunity to issue fixes to known issues – including fixing Teams and Outlook crashes on Arm64 PCs – as well as to upgrade Copilot+ AI components.
You probably assume your web browser is the only app keeping tabs on where you go online. According to new research from Surfshark, that assumption is incorrect.
The cybersecurity firm analyzed 40 of the most popular Android and iOS apps and found that 18 of them, or 45%, report collecting users' browsing history in their app store privacy labels. In other words, nearly half of the apps you open every day may be logging the websites you visit.
Even the best VPN cannot fully stop an app from recording what you do inside its own walls, which makes understanding what you are signing up for more important than ever.
Surfshark – the best cheap VPN
Surfshark is a fast, easy-to-use VPN that seriously beats the competition when it comes to subscription pricing. Its two-year Starter plan works out at $2.49 a month (plus tax), but we think Surfshark One is the best value plan as it adds an antivirus, data breach monitor, and alternative ID tool starting from the equivalent of $2.79 a month. View Deal
Surfshark's team looked at 40 leading apps split evenly across four categories: generative AI, social media, e-commerce, and messaging.
For each one, the researchers checked whether its Apple App Store label reported collecting "Browsing History" and whether its Google Play label reported "Web Browsing History."
Social media came out as the biggest collector by far. Nine of the 10 social apps studied collect browsing history on at least one platform. Facebook, Instagram, TikTok, X, YouTube, and Pinterest do so on both Android and iOS, while Reddit, LinkedIn, and Snapchat collect it on Android only. Discord was the only social app that collected it on neither.
E-commerce came next, with half of the shopping apps analyzed collecting the data on at least one platform.
Messaging was less hungry, with only Rakuten Viber, Messenger, and LINE gathering it, echoing earlier findings on how much data messaging apps collect.
In the generative AI category, Google Gemini was the only app of the 10 to report collecting browsing history.
NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.
Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.
📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.
The logic is straightforward: the more an app knows about where you go online, the more precisely it can target ads and shape the content in your feed.
As Surfshark's lead system engineer Karolis Kaciulis explains, many apps now route external links through their own "embedded browsers," so the moment you tap a link, they can track what you search for and look at.
The important thing to remember here is that most of these social media and shopping apps do not need your browsing history to provide their services. The practice is not related to providing value to users, and simply takes place to benefit the app companies.
Kaciulis argues that consent for this is usually buried in the fine print, and that the apps fighting hardest to keep you inside their own browser tend to be the ones selling ads rather than the ones that need your history to function.
There is no single switch that turns all of this off, but a few habits can go a long way.
The easiest is to sidestep in-app browsers: when you tap a link, use the "Open in default browser" option or paste the URL into your default browser, which stops the host app from watching where you go next.
Pair this with switching to a privacy-focused browser, and you'll be able to avoid a lot of the worst data-collecting practices without much effort.
Chinese AI companies’ core development strategy is to steal proprietary functionalities and capabilities from their US counterparts, law enforcement agencies have warned.
The US Cybersecurity and Infrastructure Security Agency (CISA) has published a new security advisory, drafted jointly with the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI), warning American AI companies about an ongoing “aggressive, malicious, and targeted distillation activities at an industrial scale,” and sharing recommended mitigation steps.
IBM defines knowledge distillation as a “machine learning technique that aims to transfer the learnings of a large pre-trained model, the ‘teacher model,’ to a smaller ‘student model’.” It is used in deep learning as a form of model compression and knowledge transfer, it added, particularly for massive deep neural networks.
So, knowledge distillation is not illegal or malicious, per se. Its goal is to train a more compact model to mimic a larger, more complex one. In the security advisory, the agencies stress it is “recognized as a legitimate and useful technique in AI research,” but add that China-based AI companies are using it in ill will.
In other words, the agencies claim that instead of spending months and millions developing new capabilities for their models, the Chinese are simply sending huge numbers of carefully designed questions to US models and extracting the answers.
Apparently, all companies worth anything. DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI all allegedly “extracted billions of tokens across millions of exchanges/requests from US frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024.” CISA also stressed that this was likely done with the awareness of the Chinese government. It hasn’t outright said, “with its blessing”, although it could be read between the lines.
The advisory shares a thorough list of all the models that were being trained, as well as all the models being taken advantage of.
On the Chinese side, they include DeepSeek R1 and V3 models, Moonshot’s Kimi-K2 and Kimi-K3 models, and MiniMax’s M2 model. On the US side, they start with earlier models such as GPT-4, Claude 3.7, and Gemini 2.5 Flash Preview, all the way to Claude Fable 5, GPT-5, and similar.
When done in good faith, knowledge distillation is not illegal. However, the report says the companies routed the requests through multiple accounts, different API access points, multiple cloud providers, third-party AI aggregators, proxy services and “transfer stations”, as well as premium subscriptions shared between developers, all in an attempt to work around defenders trying to disrupt the process.
“This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership. Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. Government, private industry, and allied nations,” the agencies concluded.
To defend their intellectual property (and thus remain ahead of Chinese competing models) US AI companies should implement comprehensive detection and mitigation, the agencies said. That means hunting for anomalous and malicious prompts, accounts, networks, and behaviors. Furthermore, they should monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns.
The second step is to “deploy targeted response changes”: “Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.” In other words, AI companies should make sure their products lie when they spot they were being distilled for knowledge.
Finally, US AI firms should set up cross-organization intelligence sharing, correlating activity across model providers, cloud platforms, and API aggregators.
Late-breaking reports suggest Apple has built a new Siri AI ‘Recaps’ feature that summarizes your day for you. The idea sounds great until you recognize that this summary will also include overheard conversations.
Suspending the huge red flag of concern over privacy and data protection for a moment or two, why would this be useful and who is it for?
First, it is being described as an Apple Watch feature that will only be available on the latest models: Apple Watch Series 12 and Apple Watch Ultra 4, as these allegedly include secure audio processing hardware. Reading between the lines, that suggests the devices will be able to listen to and process audio on device, which implies that the information won’t need to leave your smartwatch, not even to your iPhone.
The report also says the feature doesn’t make a transcript, nor does it store the audio; it instead gathers key datapoints from what is said to include in the summary, deleting all the remaining information in the process. You can have the feature working all day, on-demand, or only in specific locations. The idea seems to be to provide some kind of actionable summary of events and key conversations that take place during the day. I imagine the subtext is to digitize as much as possible of your daily existence as Apple thinks you will be comfortable with to create the kind of datapoints contextual AI requires if it is going to help with your life.
That sounds fine, up to a point — the idea that a digital assistant will be able to recognize key events, moments, and requirements to remind us of them, act on them, or suggest next steps concerning them is certainly a notion that’s gained currency in tech circles. They see it as augmenting human achievement, enabling people to become more productive, more efficient, and capable of doing more with less effort. At least, that’s part of the argument.
What is wrong with that (other than concerns over privacy or a desire not to have one’s entire waking life transformed into a series of datapoints that can be measured, tested, or surveyed by entities outside of our control), right? If you have nothing to hide, you have nothing to fear, at least, not until times change and what didn’t need to be hidden in the past becomes something that must be shrouded in future.
Apple, of course, has its strong privacy story to lean into as it introduces this surveillance-as-a-service solution; it’s an argument that says it recognizes how this tech can be abused, and wants to deploy it correctly. It will point to that record as it promises its system doesn’t gather data, doesn’t collect it, and doesn’t keep any form of transcript on or off the device. The company should be commended for building a system that works this way, recognizing as it does that the best way to protect confidential information is not to gather it in the first place.
But what Apple has also done with this new speculated upon — and as-yet-unconfirmed product — is to show us what these tools can already do. Much of this is already visible; take recent news that LG smart TVs constantly collect and upload user data as an illustration of the seemingly egregious ways in which such tech is used. (LG denies the claim.) What Apple shows us is that with AI in the picture, all your waking moments can be collated, curated, analyzed, digitized and rendered into actionable data. Apple may not be doing that, but others will not be equally cautious, so we owe Apple a debt for warning us of what’s at stake.
Though we don’t know whether Apple will actually introduce this new service, the source of the claims is one of the strongest in the industry. What we do know is that the technology required to build systems like this exists, along with AI systems capable of sourcing, sharing, and sifting through that information. What we don’t yet know is how to remove ourselves from the data stack.
Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.
ChatGPT’s AI agents were allowed to pull sensitive data from one account shared with an entirely different account because, colloquially speaking, all agents used to walk down the same hallways, experts have warned.
A new report from security experts Check Point Research (CPR) dubbed the flaw “coerced insider”, since it revolves around persuading the agent instead of abusing a vulnerability.
When an AI agent is given a task that needs code execution, it handles that task in an isolated container which also sometimes needs to install software. To enable that, without giving containers direct internet access (which would be too risky), OpenAI routes those packages through an internal JFrog Artifactory instance. As a separate security contingency, containers from different accounts cannot talk between themselves.
However - they can reach the same internal service (our proverbial hallways), which exposes an item management feature that lets the containers attach text or binary properties to a repository item. As a result, any container can read back the properties written by any other container.
“Check Point Research confirmed the isolation gap directly: a property written from one account’s container was fully readable from a different account’s container moments later, with data too large for one property simply split into chunks and reassembled on the other end,” the researchers explained.
“The package delivery metadata effectively became a shared clipboard between containers that were supposed to be walled off from one another.”
From there, the exploit turns into your usual, off-the-shelf prompt injection. The only difference is that the malicious prompt is not delivered directly to the victim, but rather left in the hallways, and the results are not shared with the attackers directly, but rather left in those same proverbial hallways, too.
The attacker then delivers a prompt or a shared conversation that instructs the agent to check the same storage during its next ordinary reply. The agent checks, sees the malicious instructions, executes them, all the while replying to the victim’s question in the usual manner. The victim is oblivious to the fact that data theft is taking place in the background.
But this is just half of the equation. How destructive this attack ends up being still depends on the amount of data being shared with the victim agent.
The bare minimum is the information shared while chatting to the agent. It then grows with every connected app: Gmail, Google Drive, Microsoft Teams, GitHub, and similar. “In Check Point Research’s demonstration, ChatGPT retrieved the victim’s email data through their connected Gmail account and delivered it to the attacker’s session, all within a single ordinary turn,” CPR stressed.
The good news is that you’ll likely never be exposed this way, at least not via ChatGPT. CPR says it disclosed the findings to OpenAI, who then confirmed that the specific internal Artifactory instance identified in the research has been commissioned. In other words, the hallways attack path has been closed.
The bad news is that this doesn’t automatically mean everyone’s safe. This particular path might be closed, but the architectural pattern behind the flaw could be present in other platforms, CPR warns.
“Any AI assistant that operates inside an organization’s trust boundary, holding credentials, running code, and reaching connected services, can become what Check Point Research calls a coerced insider,” the report states. “The model itself does not need to be malicious. It only needs to be persuaded, through text it was never meant to trust, to use access that was granted for entirely legitimate reasons.”
Going forward, businesses are advised to learn which AI tools their employees are using, and what those tools are connected to. Then, they should govern what AI tools and agents are allowed to do, treating all of their actions (not just output) as something that needs to be monitored.
AI note-taking applications are increasingly used by workers to record meetings, generate conversation summaries and suggest post-meeting action items.
Along with the promised productivity benefits — enabling users to focus on meetings rather than actively taking notes — the emergence of these AI tools has raised privacy questions, particularly around obtaining prior consent by meeting participants for their use. Those concerns, in turn, have prompted a spate of lawsuits against software vendors that sell AI notetaking tools.
In some ways, the underlying questions are not new: It’s long been possible to record a phone call with a dictaphone, and laws around surreptitious recording have been around for decades. Yet widespread access to AI notetakers via desktop or smartphone apps means that it’s easier than ever to record a conversation for future reference.
Among the thorny questions arising from the technology’s use: what happens to conversation data sent to a software vendor’s servers for processing? Are the recording and transcript used to train those vendors’ AI models, for example, or create biometric voiceprints? Those practices are among the issues being considered in US courts.
Otter, which claims to have 35 million users, was subject to a class-action complaint in a federal court in California last year. That complaint accused Otter of recording individuals without consent and using their voices to train its speech recognition AI tools. Last month, a judge rejected Otter’s attempt to dismiss the main claims, though the scope of the case was narrowed.
A lawsuit filed against another vendor, Fireflies, in an Illinois court late last year, alleges the company collects and stores biometric voiceprints without user consent, in violation of the Illinois Biometric Information Privacy Act (BIPA). Fireflies claims to have more than 20 million individuals and 1 million organizations as customers.
Earlier this year, a class-action complaint in a Washington court claimed that a live transcription feature in Microsoft’s Teams collaboration application also violates BIPA by collecting biometric data without consent.
And most recently, a complaint alleged that Granola, a well-funded startup, designed its product to be used without the knowledge of all meeting participants, in violation of the Electronic Communications Privacy Act (ECPA). That complaint also claims Granola trains its AI models on conversation data without consent.
None of these cases has yet been resolved, and it’s unclear whether any of the vendors broke the law in the design and delivery of their products and services. But the lawsuits highlight considerations for businesses that allow the use of AI notetakers, both in terms of prior consent for recordings and understanding how conversation data is handled.
More broadly, the lawsuits raise questions about how existing privacy and consent rules apply to new technologies that make it easier to record others, whether through AI note-taking apps, smartglasses, or other recording devices.
Computerworld spoke with Brian McGinnis, partner at law firm Barnes & Thornburg and a founding member and co-chair of the firm’s Data Security and Privacy Law practice group, about the focus of the lawsuits, potential outcomes, and how businesses can deploy AI notetaking apps safely.
Several cases have already been brought against popular AI note-taking apps. What are some of the main commonalities between these? Which laws are the vendors accused of breaching? “The common allegation is that these companies capture communications of people who did not agree to the recording or receive adequate notice. Some of the lawsuits also allege that meeting data is used to train AI models and that consent cannot meaningfully be withdrawn once the data has been processed.
“There are various federal and state claims. You’ve got the Electronic Communications Privacy Act, a federal wiretapping statute. As a general matter, the Electronic Communications Privacy Act permits an interception when one party consents, subject to statutory exceptions and questions about whether the technology constitutes an unlawful interception or third-party eavesdropping. In other words, if you, as the user, provide consent, you can be on a meeting with 20 other people and it’s deemed to be sufficient; you don’t necessarily need to get the consent of other people.
“But California and a minority of other states are what we call ‘two-party consent’ states, meaning each individual on the call has to give consent; it’s not sufficient for you as the person who turns the notetaker on to provide the consent — you also have to get the consent of others that are being recorded. There are state laws around that.
“There’s a law called CIPA, the California Invasion of Privacy Act, that’s being utilized in this context. We see a lot of suits being brought under that law — it’s a wiretapping statute designed for telephone wiretapping that’s now being applied to the internet.”
What about the use of biometric data? “A growing number of states regulate biometric data, with Illinois’ BIPA being particularly prominent because it provides a private right of action. This means an individual can sue a company for violation of the law.
“That law covers biometric information. With an audio recording or recording of ‘dumb’ video that isn’t running any algorithms, you’re not necessarily collecting any biometrics. But when you start identifying people, you’re recording things like faceprints or voiceprints, which are in the definition of biometric information within the statute. Now you’re not only collecting personal information, but also biometric information, which is considered very sensitive and much more highly regulated.
“Then you’ve got the private right of action that goes against it. Part of the argument here is that recordings taken by the AI notetakers can be used to produce some form of biometric information, such as a voiceprint.
“We’ve seen a lot of cases, and a lot of changes in industry as a result of this law. Shutterfly had a famous case about scanning for people’s faces and things like that in Illinois that changed the photo storage and processing industry a little bit.
“A lot of companies stay out of Illinois to avoid this law specifically. But a customer organization might not know exactly who’s in a meeting and where a person is located at the time of the meeting. So, you need to either follow that law and get individual consent, or stay out of states with biometric laws if you want to use some of these tools.
“It’s just a further challenge for these applications if the goal is to be used as much as possible with as little detection as possible.”
What are some of the potential outcomes for these cases? “I think it’d be unlikely to get an outright ban, absent passing some kind of new law that says these tools are per se illegal for use. It’s much more likely the outcome will require some changes and controls over the way that they get used. The clearest case would be some kind of a pop-up notice: ‘Hey, this meeting’s being recorded, here’s who it is, here’s their privacy policy, here’s their terms of service – do you consent to it?’ And getting opt-in consent from anybody who wants to be recorded.
“The notion that only one person in the meeting has to say it’s okay and you can just automatically record everybody else, I think that’s probably at risk, and could potentially be replaced with a standard that requires everybody to consent before it’s considered legal.
“But the newer —and more interesting — wave of these is the Granola case, where part of its marketing is that people aren’t aware that it’s there. The Granola complaint alleges that the product was designed to operate without alerting other participants. It’s possible that kind of activity could result in a decision that would ultimately ban it outright. In other words, that it’s illegal to utilize these tools if you aren’t providing notice to everybody and/or aren’t getting consent from everyone on the call. That’s a possible outcome that we could see.
“To me, that’s interesting when you think beyond AI note-taking and into the broader world, with conversations around, like, Meta Glasses, or any of these kinds of AI wearables. Granola in particular has an Apple Watch app, and there are other wearable or physical devices — there’s one [Plaud Note] that sticks on the back of your phone and is essentially an always-on recording device.
“With these devices, you’re going from an online meeting where you can provide notice and there’s a structure to obtain consent, to walking down the sidewalk and recording people and casual conversations. Maybe it’s somebody you’re having a conversation with, maybe it’s somebody at the table next to you in the coffee shop that you have no relationship with whatsoever — what are the laws around consent and notice in those cases, where there’s no digital interface to put that up in front of people? Do you have to go around with a pad of paper and a pen and get people to sign consent to use these things? Do you have to physically tell them?
“Those are the more interesting conversations that this line of cases is just at the beginning of helping us get some answers on. In other words; how do you get consent? How do you provide notice in a world where we don’t have documents or screens in front of us to easily handle that? Those are interesting questions that the law will have to figure out here.”
These tools are increasingly used in the workplace. How can businesses be sure they deploy the technologies safely? “We’re getting a lot of questions from our clients about this topic, because they’re really unsure and uncertain of how to handle these tools.
“Obviously, there’s a push for broad use of AI within their companies, for productivity increases within their company. People like the tools; they want to be able to use them. But then we also hear a lot of stories about ‘I jumped on a meeting; I didn’t even know it was being recorded, then I got an email afterward with a transcript of it,’ and ‘half of what it recorded wasn’t actually what I said, or it was interpreted incorrectly’ — things like that. So there’s a lot of consternation amongst our clients about the people within their organizations using it.
“I can’t tell clients definitively that they’re legal as they are; there are ways to use this legally and safely that aren’t going to get your organization sued, but you probably have to do some things that are beyond what’s provided ‘out of the box’ by the software providers.
“With Granola, for example, my understanding is that certain notice features may not be enabled by default. You can turn on video or audio watermarking, and you can turn on the notice that pops up in these things, but I think it ships without those features enabled. That puts the responsibility on the individual user to determine and then implement their own legal privacy and legal compliance mechanisms using their settings.
“You really have to play to the most stringent state’s law. I would advise a company that, to decrease your chances of getting in trouble for use of these tools, you need to obtain consent of all parties on the call. You can do that verbally, as well; written is even better.
“Then it’s about having an internal AI note-taking policy. Think of a BYOD policy, which all these companies have, or an AI usage policy — this could be part of that policy, or a standalone policy: ‘Here’s how our organization thinks about these tools: you can only use these approved tools and, if you’re going to use them, you have to turn on these features. You have to get consent from everyone. Here are limits on what you can do with the output of those transcripts or recordings.’
“If you set all that up and do the compliance and governance work, I think you can use these tools and most likely stay on the right side of the law. Certainly, the law doesn’t prevent consenting adults from consenting to the use of these kinds of tools.
“But the further you get away from that written consent standard, the more problematic it becomes. If you just want to go to a notice standard and not obtain actual opt-in consent, or, even worse, if you want to try and do this without anybody knowing, that potentially could get challenged.”
Anyone keeping track of world news in the early 2010s, and reports on tech in particular, has probably heard about Stuxnet. That malware spawned a large number of conspiracy theories — with the kicker that some of them were actually true. The malware targeted Iranian nuclear facilities and is believed to be the first digital worm to cause direct physical damage in meatspace. An unknown security researcher has now published a source code reverse-engineering of Stuxnet in all its glory.
The worm's ultimate target, allegedly a successful one, were industrial controllers from Siemens that were reportedly used in Iranian's Natanz nuclear enrichment plant. Once it reached the target, Stuxnet's payload manipulated the frequency converters in industrial centrifuges, in a bid to subtly damage the rotors — all while keeping the plant staff in the dark by reporting normal operation.
The repository contains build instructions so interested techies can try it out for themselves and learn all about its inner workings. You'll need a Windows XP or Windows 7 virtual machine, and for obvious reasons, you shouldn't configure any network connectivity for it. To witness the full effects of the payload rather than just the spreading mechanisms, you'll need the appropriate Siemens software, and ideally hardware — though we figure that industrial-scale centrifuges aren't exactly common in techies' cable drawers.
In its heyday, Stuxnet spread via three mechanisms. The primary infection vector was USB sticks with Windows shortcuts and autorun.inf files. Upon plugging one of those sticks in, just viewing the drive's contents would immediately trigger infection thanks to a zero-day vulnerability.
Infected systems then autonomously tried to spread the worm further via the network using a zero-day Windows Print Spooler vulnerability that would let an attacker write system files into any machine sharing a printer. It would also copy itself into accessible network shares. To evade Windows driver signature checks, Stuxnet used two digital certificates stolen from Realtek and JMicron.
The worm also had code to inject itself into Siemens software, by way of the WinCC SQL Server database, and embedding its code in Step 7 project files that automatically ran when engineers opened them. Since those files were almost guaranteed to be shared among more than one engineer, it made for an excellent internal infection vector that didn't depend on having network share control.
The final step was taking charge of the DLL that communicated with the actual centrifuges and injecting malicious code into the PLCs (Programmable Logic Controllers) of those machines to stealthily mess with the rotors.
Stuxnet was part of Operation Olympic Games, an alleged coordinated effort between the U.S. and Israel to try and curb Iran's purported progress in creating nuclear weapons at its Natanz facility. The initiative seemingly ran under both the Bush and Obama administrations, and was supposedly a way to dissuade Israel from launching its own preemptive strike against Iran. The software was allegedly developed by both the Pentagon and Israel's Unit 8200, and was reportedly successful in bringing down about 10% of Natanz' centrifuges by ultimately seriously damaging their rotors.
However, the worm had a nasty bug: it didn't have sufficient checks about which environment it was in, and failed to notice it was no longer in a local network environment. When engineers took their laptops home, it escaped out to the internet at large, at which point security researchers worldwide let out a collective "huh, that's odd" and proceeded to investigate. Mercifully, the worm contained a hard-coded self-destruct date set for June 24, 2012.
Login