CISA directs agencies to “patch smarter, not harder.”

CISA issued BOD 26-04 requiring federal agencies to prioritize vulnerability remediation based on risk and to update policies and timelines; Anthropic disputed reports of a universal jailbreak of Claude Fable 5, saying the incident targeted a classifier and not the underlying model; and Google confirmed that the ShinyHunters group exploited CVE-2026-35273 (an unauthenticated RCE in Oracle PeopleSoft) as a zero-day to breach primarily higher-education targets, steal data, and carry out extortion, with mitigations issued but patches not yet available.