AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code

SecurityWeek roundup covering an AI-assisted exploit that accessed OpenAI employee accounts, a Gyazo breach affecting 23 million records, Microsoft and other vendor vulnerability patches, disruption of the NightmareStresser DDoS-for-hire service, a Brevo supply-chain attack impacting approximately 100,000 websites, and exploitation of the critical unauthenticated Orkes Conductor RCE vulnerability CVE-2026-58138. It also reports cyber activity involving oil tankers and security concerns related to leaked API keys in AI training data.