#cybersecurity Tech News.

OpenAI is spending $1 billion to subsidize access to its Daybreak security platform after unveiling Astra, an AI that can independently find previously unknown software flaws and turn them into working attacks.

Major publicly traded cybersecurity firms lost roughly $80 billion, about 10% of combined value, after the Hugging Face/OpenAI incident. By early September, they recovered about $58 billion, roughly 90% of the drawdown, depending on the baseline date used.

OpenAI pledged $1 billion in subsidized access, training, and technical support for cyber defenders through its Daybreak for Frontline Defenders initiative. The program initially targets U.S. operators of essential services, including water utilities, electric grid operators, and community banks, with plans to expand to partner countries.

Cloudflare opened early access to Vulnerability Discovery and Remediation, using OpenAI's GPT-5.6-Cyber model to find and block code flaws. The service runs in Cloudflare Managed Defense, requires human approval for fixes, and addresses a record 60,475 vulnerabilities logged by September.

Zscaler beat Q4 estimates with $1.19 adjusted EPS on $898.2M revenue, up 25% year-over-year, but shares sagged after-hours. The Red Canary acquisition added $141M ARR. Fiscal 2027 guidance topped analyst expectations.

Cloudflare announced early access to Vulnerability Discovery and Remediation, part of Cloudflare Managed Defense. The invitation-only service uses OpenAI Daybreak models, including GPT-5.6 Cyber, through the OpenAI Daybreak Defense Network to detect, prioritize, and propose fixes for code vulnerabilities, with no changes taking effect without human approval.

Astra Security tops a proof-based ranking of autonomous pentesting tools, using dual agents and a walled-off validator that re-exploits findings. NodeZero, XBOW, Pentera, Aikido, Hadrian, Ridge Security, Ethiack, Picus, and Cymulate follow. Astra's report logged a critical vulnerability every 48 seconds through 2025.

OpenAI is launching an initiative providing subsidized model access to water systems, electricity providers, local governments, and other critical services. President Greg Brockman announced the program at a summit hosting 300 security leaders at company headquarters Thursday, addressing anticipated AI-enabled cyberattacks.

Zscaler beat fiscal fourth-quarter estimates with revenue jumping 25% to $898 million. Annual recurring revenue rose 25% to $3.77 billion. CEO Jay Chaudhry said the AI agent security platform is gaining momentum. Shares had dropped 20% this year before the surge.

Researcher Nightmare Eclipse released FalconFlank, a privilege escalation zero-day exploiting CrowdStrike Falcon's Microsoft Office macro remediation. The PoC works on fully updated Windows 11 25H2 and Windows Server 2025. CrowdStrike advises disabling the suspicious macro removal policy. Other exploits target Kaspersky, Avast, and Nvidia.

Microsoft detailed a Teams-based intrusion campaign impersonating IT staff. Palo Alto Networks exposed Spring Ring, targeting 150+ employees across 10 companies. Sophos reported The Gentlemen ransomware claimed 683 victims. Group-IB found 700+ Outsider phishing pages post-lawsuit. ZeroBEC disclosed BlueKit targeting financial CEOs. FBI probes Nexus ID theft service with 153M driver's licenses.

OpenAI, Anthropic, Google, Microsoft, Amazon, Oracle, and over 100 other companies signed a letter urging a global surge in cyber defense, warning that AI-enabled attacks will become more widespread and sophisticated in coming months, putting hospitals, water plants, and internet infrastructure at risk.