Meta’s Muse is more than a chatbot. It is a digital worker that can read email, make purchases across the web, and act after users close the app. Wall Street sees a return on Meta’s vast AI spending. Cybersecurity experts see a more urgent question: should it hold the keys to our digital lives yet?
Dell’s US$95 billion AI-server backlog and US$74 billion revenue outlook show the AI boom moving beyond a few cloud giants into enterprise, sovereign and neocloud infrastructure procurement.
Meta has come back to the consumer, and it has come back armed. Muse reads inboxes, drives a browser, books travel and pays. Meta has not led with intelligence. It has led with containment. A model that says the wrong thing is an embarrassment. An agent that does the wrong thing is now an incident.
Microsoft has issued an emergency patch for a critical zero-day vulnerability (CVE-2026-20805) in its Windows operating system that is being actively exploited by attackers. The flaw affects all supported versions of Windows.
Cyber News Centre's cyber update for 19 January 2026: Microsoft has released an urgent security patch to address a zero-day vulnerability in its Windows operating system that is under active attack.
Update: Microsoft has confirmed that a zero-day vulnerability in its Windows operating system, tracked as CVE-2026-20805, is being actively exploited in the wild. The flaw, an information disclosure vulnerability in the Desktop Window Manager (DWM), was patched on January 13 as part of the company's monthly Patch Tuesday release, which addressed a total of 114 security holes. The vulnerability allows an attacker to bypass a fundamental security control known as Address Space Layout Randomisation (ASLR), which is designed to prevent memory-corruption exploits.
By defeating ASLR, an attacker can more reliably execute malicious code on a target system. The vulnerability affects all supported versions of Windows, including Windows 10, Windows 11, and Windows Server editions, making it a widespread threat. While Microsoft has given the flaw a middling CVSS score of 5.5 and an "Important" severity rating, security researchers are urging organisations to treat it with higher urgency due to the active exploitation. The company has not disclosed how the vulnerability is being used in attacks but has attributed its discovery to its own internal security teams, the Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC).
Why it Matters: The active exploitation of CVE-2026-20805 poses a direct and immediate threat to countless organisations. Given the near-universal adoption of Windows in business and government, the vulnerability exposes a massive attack surface, from small businesses to critical infrastructure operators. While the flaw itself only allows for information disclosure, its true danger lies in its ability to be chained with other vulnerabilities to achieve full system compromise. Attackers can use this zero-day as a reliable first step to disable key protections before launching more destructive code execution attacks.
The fact that it is already being used "in the wild" means this is not a theoretical risk; it is a clear and present danger. The only effective defense is to apply the security updates released by Microsoft immediately. Any delay leaves systems open to attackers who are already leveraging this weakness to bypass core Windows security features and launch more complex, damaging intrusions. The incident underscores the persistent threat of zero-day attacks and the critical importance of rapid, enterprise-wide patch management.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
OpenAI's Astra can develop zero-day exploits, while a US$1 billion defence push seeks to give critical infrastructure teams the same machine-speed advantage.
The AI race is moving beyond model rankings. CrowdStrike’s new cyber superintelligence lab points to a market where proprietary data, trusted workflows and measurable outcomes may matter as much as raw capability.
Washington is building a two-track AI order: confidential security reviews for powerful closed models, regulatory relief for open-weight systems, and a G20 campaign for light-touch rules. The strategy may accelerate US innovation, but leaves a critical security gamble unresolved for global markets.
US authorities have dismantled QTFY’s QScan and QTRouter platforms, exposing a China-linked service model that blended exploit trading, automated scanning and hijacked IoT devices to reach critical infrastructure while concealing where attacks began.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
