30
Mistral X Mozilla: Private, Multilingual AI Browsing
Mistral and Mozilla partnered to power Firefox's Smart Window AI browsing assistant in France and North America, with zero data retention.
Mozilla's Firefox Smart Window (beta) AI browsing assistant is now powered by Mistral models for users in France and North America, with the UK and Germany expected later this year. Conversations are not saved on Mozilla's servers by default, and Mistral agreed to zero data retention. Both companies frame the partnership as advancing open-source, privacy-first, and regionally fine-tuned AI, with models trained on regional languages, dialects, and cultural context.
55
30
Exclusive: Paying for frontier AI models buys 4-month head start at 5x the cost
Mozilla report finds the capability gap between best open-weights (largely Chinese) and closed frontier AI models narrowed to 4.4 months at ~5x lower cost.
Mozilla's State of Open Source AI report (September 15) says the gap between closed frontier models and best open-weights models has closed to 4.4 months. Moonshot AI's Kimi K3 scores three points behind Anthropic's Fable 5 on the Artificial Analysis Intelligence Index at 30% of the cost, and Z.ai's GLM 5.2 scored within a point of Claude Opus 4.7 on Terminal-Bench 2.1. Eight of the top 10 OpenRouter models by August 2026 token volume provide open weights, though a Linux Foundation paper found open models earned only 4% of revenue. The report recommends open models as the default for routine workloads, reserving closed models for 8-12 hour expert tasks.
55
50
30
30
30
ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories
Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.
Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.
25
30
30
30
Chrome is now shipping updates every 2 weeks as AI changes the security landscape
Google switches Chrome to two-week release cycles starting with Chrome 153, shrinking the N-day patch gap as AI-driven threats accelerate.
Chrome officially moved from a four-week to a two-week release schedule with Tuesday's launch of Chrome 153 on desktop, iOS, and Android. Google ties the change to its evolving security strategy, saying faster releases shrink the N-day patch gap as AI tools and community bug reports increase patch volume. Mozilla, Microsoft, and Brave have already adopted the two-week cadence, and Google is also racing AI-native browsers like Brave, Dia, Opera Neon, and Perplexity's Comet while experimenting with AI features in Chrome.
42
New CISO appointments 2026
Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.
CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.
14
Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers
Google announced Android 17 will enforce OS-wide Encrypted Client Hello with ECH GREASE, plus Certificate Transparency by default and carrier 2G disablement.
Google announced Android 17 network security protections headlined by OS-wide support for Encrypted Client Hello (ECH), with ECH GREASE enabled by default so connections to non-ECH servers look identical. Google's Jigsaw noted OkHttp has integrated ECH, letting third-party Android apps adopt the standard. The release also enforces Local Network Protection permission prompts, enables Certificate Transparency by default, and lets carriers turn off 2G by default to prevent downgrade attacks, rogue base stations, and SMS blasters. ECH was previously added to Chrome 117 and Firefox 118 at the browser level only.
35
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall
Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.
US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.
48
30
30
30
30
30
30
30
50
30
30
30
30
30
30
30
30