CVE-2026-81963, CVE-2026-85880
Get tomorrow's brief in your inbox
Today: The DOJ filed a significant amicus brief supporting fair use in AI training cases. VSL Pharmaceuticals agreed to a $20 million settlement over probiotic advertising claims. Justice Kavanaugh blocked Missouri's new congressional redistricting map from the November 2026 elections.
DOJ Amicus Brief Supports Fair Use in OpenAI Copyright Case
Summary: The Department of Justice filed an amicus brief in the New York Times v. OpenAI case arguing that AI training on copyrighted material constitutes fair use under copyright law. The brief warns that requiring licensing fees would create an oligopoly favoring only the largest technology companies and legacy media outlets with capital to pay those fees, while hampering competition and innovation in the AI market.
$20M VSL Pharmaceuticals Probiotic Settlement
Summary: VSL Pharmaceuticals agreed to a $20 million class action settlement resolving claims that it falsely advertised the VSL#3 probiotic as clinically proven when the supporting evidence was inadequate or misleading.
$1.2M Tift Regional Health System Data Breach Settlement
Summary: Tift Regional Health System reached a $1.2 million class action settlement with individuals affected by its 2022 data breach. Eligible class members may qualify for cash payments and credit monitoring services.
Lennar Data Breach Lawsuit Filed
Summary: A new class action lawsuit alleges Lennar Corp. and Lennar Mortgage failed to implement adequate data security measures to protect customers' and employees' sensitive personal information during a data breach. The complaint alleges the companies' lax security practices enabled unauthorized access to personal data.
XTO Energy Preserves Arbitration Rights Against Unnamed Class Members
Summary: The Third Circuit held in Salvatora v. XTO Energy, Inc. that class certification does not strip a defendant of its right to compel arbitration against unnamed class members whose agreements contain arbitration clauses, unless the defendant has waived that right through express or implied intentional relinquishment. The court ruled that XTO Energy did not waive arbitration by litigating for 55 months before moving to compel, because putative Rule 23(b)(3) class members are not parties until after certification.
Justice Kavanaugh Blocks Missouri Redistricting Map
Summary: Justice Brett Kavanaugh blocked Missouri from using a new congressional redistricting map intended to give Republicans an additional House seat in the November 2026 elections. The order restores the map adopted in 2022 following the 2020 census. Missouri Secretary of State Denny Hoskins had rejected a referendum petition challenging the new map on the last day before the primary, triggering litigation in state court.
Trump Administration Seeks Supreme Court Intervention on SAVE Voter Database
Summary: The Trump administration asked the Supreme Court to pause a federal judge's order blocking the government from using a modified version of the Department of Homeland Security's SAVE database to verify voter citizenship. U.S. District Judge Sparkle Sooknanan ruled that the modified system violates federal privacy laws, the Social Security Act, and administrative procedure laws. The modified system included records of U.S.-born citizens, access to Social Security numbers, and bulk search capabilities.
Tech Companies Privately Challenge ICE Subpoenas Targeting Anonymous Users
Summary: Meta and Reddit have privately pushed back against Immigration and Customs Enforcement administrative subpoenas seeking to unmask anonymous users who tracked immigration activities or criticized the government. Meta challenged ICE's statutory authorization and notified users about subpoenas, while Reddit objected to subpoenas targeting users who posted content critical of ICE. EFF argues companies should publicly challenge these subpoenas in court rather than relying on private resistance.
Italian Tech Collective Shuts Down After U.S. Terrorist Designation
Summary: The Italian technology collective Autistici/Inventati announced it will shut down operations after the State Department designated it as a terrorist organization on August 26, 2026. The designation alleged the collective provided encrypted communications and web hosting infrastructure to far-left militant groups. The .org domain operator suspended the collective's domain on August 28, and its Italian bank suspended its account due to sanctions risks.
Microsoft Patches Nearly 1,000 Vulnerabilities, Two Under Active Exploitation
Summary: Microsoft's September 2026 Patch Tuesday release disclosed 973 vulnerabilities, surpassing 900 for the first time and pushing the year's total over 2,600. CISA confirmed two vulnerabilities (CVE-2026-81963 and CVE-2026-85880) are being actively exploited. CVE-2026-81963 affects the Windows update component, and CVE-2026-85880 affects Windows messaging systems.
Singaporean National Pleads Guilty to $245M Crypto Heist RICO Charges
Summary: Malone Lam, 22, pleaded guilty to RICO conspiracy charges for leading a social engineering scheme that stole more than $245 million in cryptocurrency. The "Social Engineering Enterprise" used impersonation tactics to trick victims into providing account credentials, database access to identify high-value targets, and residential burglaries to steal hardware wallets. Lam faces 7 to 20 years in prison and will be sentenced on December 8, 2026.
Russian Suspect Extradited for Multimillion-Dollar Bank Account Takeover Scheme
Summary: Sergei Anatolyevich Filimonov, 36, was extradited from Georgia to face federal charges of conspiracy to commit bank and wire fraud, access device fraud, and aggravated identity theft. Filimonov allegedly used spoofed domains and fraudulent login pages to steal bank customer credentials, resulting in $14.6 million in confirmed losses and $28 million in attempted losses across at least 19 victims. He faces a minimum of two years and maximum of 175 years in prison.