AI and IT News Recap: July 9, 2026: OpenAI Opens GPT-5.6 to Everyone, a 15-Year-Old Linux Root Bug Goes Public, and Claude Cowork Lands on Your Phone
By Noah Smith, Founder, KeyChange Technologies · July 9, 2026
Your no-spin AI and IT news roundup for July 9, 2026. The big theme today is access: the GPT-5.6 models that spent weeks behind a government-approved guest list are now open to everyone, while Anthropic quietly starts asking some Claude users to prove who they are. On the security side, a 15-year-old Linux flaw that hands any logged-in user the keys to the machine just went public, a fistful of max-severity Ubiquiti bugs got patched, and a China-linked crew is reading university email. Here is what actually matters for your business.
📌 The AI and IT news at a glance
- 🚀 OpenAI opens GPT-5.6 Sol, Terra, and Luna to the public after weeks of government-gated preview.
- 🪪 Anthropic's updated privacy policy takes effect, letting Claude ask some users for a government ID and a face scan.
- 🐧 GhostLock, a 15-year-old Linux kernel flaw (CVE-2026-43499), gives any local user root, and working exploit code is now public.
- 📡 Ubiquiti patches seven critical UniFi flaws, led by a perfect-10 command-injection bug (CVE-2026-50746).
- 🎓 A China-linked crew is exploiting Roundcube webmail to steal credentials from US and Canadian university researchers.
- 🔥 A max-severity Palo Alto PAN-OS flaw (CVE-2026-0288) lets unauthenticated attackers crash or hijack the User-ID agent.
- 🪤 A new "HalluSquatting" attack weaponizes AI coding assistants' hallucinations to plant botnet malware.
- 🧰 Claude Cowork expands to web and mobile, with background sessions that run when your laptop is closed.
🔝 Top story: OpenAI opens GPT-5.6 to everyone
OpenAI is taking its most advanced model family public. On July 8 the company said it was expanding access globally, and GPT-5.6 Sol, Terra, and Luna roll out to the general public starting July 9. This is the same lineup that spent the back half of June locked behind a government-approved "guest list," available only to vetted partners while the US Department of Commerce's Center for AI Standards and Innovation ran safety tests. Those tests cleared, and OpenAI says the wider release comes with a green light from US government leadership.
The three models split the work. Sol is the strongest of the family and is tuned for heavy technical domains like biology, chemistry, and cybersecurity. Terra is the everyday workhorse, with OpenAI claiming performance competitive with GPT-5.5 at roughly half the cost. Luna is the smallest and cheapest, built for high-volume, cost-sensitive tasks. That spread matters as much as the raw capability, because it lets teams match the model to the job instead of paying top dollar for everything.
In short: OpenAI's GPT-5.6 models (Sol, Terra, and Luna) are moving from a restricted, government-vetted preview to general public availability on July 9.
What it means for your business: The most capable OpenAI models yet are now something you can actually build on, and the cheaper Terra and Luna tiers mean you do not have to overpay for routine work, so it is worth re-pricing any workflow you parked while these were gated.
My take: The interesting part is not the model, it is the on-ramp. OpenAI ran a frontier release through government safety testing first and only then opened the doors, which is a preview of how the strongest models will ship from here: gated, tested, then released. For buyers, the three-tier lineup is the real gift. Route the boring, high-volume stuff to Luna, keep Sol for the genuinely hard problems, and you can cut your AI bill without cutting quality. Test before you commit, because "strongest model" and "right model for this task" are rarely the same thing.
Source: OpenAI gets permission to roll out GPT-5.6 to the public on July 9 (Engadget)
🤖 AI
Anthropic's ID-verification policy takes effect
An update to Anthropic's privacy policy took effect on July 8 that lets Claude ask some users to prove their age and identity before they keep using the service. The policy adds a new "Verification Data" category covering government-issued photo IDs, a live selfie or short video, and biometric facial-geometry data. It applies to consumer plans, Claude Free, Pro, and Max, while Team, Enterprise, and API customers are exempt. Anthropic is not doing the checking itself; it routes documents and biometrics through Persona, a third-party identity-verification provider.
The catch is vagueness. Anthropic says it may request verification under "certain circumstances" but does not spell out what triggers a check, and the policy does not name a retention period for the biometric data it collects, a gap that some legal experts flag as a potential problem under strict biometric-privacy laws. This is the first time a major US AI lab has written this level of identity collection into a consumer privacy policy.
In short: As of July 8, Anthropic can ask consumer Claude users for a government ID, a selfie, and a facial-geometry scan, handled through a third-party verifier, under unspecified circumstances.
What it means for your business: If your team uses consumer Claude plans, be ready for the possibility of an identity check, and if handing biometric data to a third party is a compliance concern, that is one more reason to keep sensitive work on Team or Enterprise plans, which are exempt.
My take: Identity verification is becoming table stakes as AI labs face pressure on age limits, fraud, and misuse, so the direction is not surprising. What I would want before uploading a face scan is the boring detail Anthropic left out: what triggers a check and how long they keep the data. Until that is clear, treat consumer plans as consumer plans, and run anything that touches regulated or sensitive data on the business tiers that sit outside this policy.
Source: Anthropic updates privacy policy to require government ID for some users (SC Media)
🛡️ IT and security
GhostLock: a 15-year-old Linux flaw hands over root
Researchers at Nebula Security disclosed GhostLock (CVE-2026-43499), a use-after-free bug in the Linux kernel's futex code that lets any logged-in user take full root control of an unpatched machine. The vulnerable code has shipped by default in essentially every mainstream Linux distribution since 2011. It needs no special permissions, no unusual configuration, and no network access; ordinary threading calls from any local program are enough, and Nebula's exploit reached root in about five seconds and was 97% reliable in testing. The flaw also escapes containers, and Google paid the team $92,337 through its kernelCTF bounty program. It scores 7.8 (high, not critical) only because an attacker has to already be on the box.
The uncomfortable details are twofold. First, no one is known to be exploiting it yet, but Nebula has published working exploit code, so the barrier to entry just dropped to "download and run." Second, patching is messy: the original April fix introduced a separate crash bug, and as of early July some Ubuntu LTS releases were still listed as vulnerable or in progress. And GhostLock is only half of a chain Nebula calls IonStack; bolted onto a Firefox exploit, a "local only" kernel bug becomes a one-click remote compromise, which the team demonstrated on Android. Worth noting: this is one of several 2026 kernel-to-root bugs surfaced by automated, AI-driven bug-hunting tools rather than humans.
In short: GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel flaw that gives any local user root on nearly every distro, and public exploit code is now available.
What it means for your business: Any shared or multi-tenant Linux machine you run (cloud servers, containers, CI runners) needs its current kernel now, because a single low-privileged foothold can become full control of the host in seconds.
My take: The scary thing here is not one bug, it is the pattern. AI-driven tools are now systematically re-reading old, trusted kernel code that no human had looked at in years, and they keep finding root exploits. Expect more of these, not fewer. Practically: prioritize patching the machines where an attacker is most likely to already have a low-privileged foothold, and do not stop at the first patched build, since the initial GhostLock fix needed a fix of its own. This is a "confirm the exact package version" situation, not a "we ran updates last month" one.
Source: 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros (The Hacker News)
Ubiquiti patches seven critical UniFi flaws
Ubiquiti shipped fixes for seven critical vulnerabilities across UniFi Connect, Talk, Access, Protect, and UniFi OS, the software that runs a lot of small-business networks, cameras, door access, and phones. The worst is CVE-2026-50746, a perfect 10.0, an improper-access-control bug in the UniFi Connect Application that lets an attacker on the network run command injection on the host device. The rest are nearly as bad, a run of 9.0-to-9.9 flaws covering SQL injection in Talk, command injection in Access and UniFi OS, and a server-side request forgery bug in Protect, all of which can lead to privilege escalation or arbitrary command execution.
The good news is that Ubiquiti found no evidence these specific flaws have been exploited in the wild yet. The bad news is context: CISA flagged a different set of UniFi OS bugs as actively weaponized just last month, so Ubiquiti gear is squarely on attackers' radar. Fixes are out across the affected apps, for example UniFi Connect 3.4.20 and UniFi OS 5.1.19.
In short: Ubiquiti patched seven critical UniFi flaws, led by a maximum-severity command-injection bug (CVE-2026-50746, CVSS 10.0), with no confirmed in-the-wild exploitation yet.
What it means for your business: If your office network runs on UniFi, update the affected UniFi apps and UniFi OS now, because these bugs let someone already on your network take over the device that controls your cameras, doors, or phones.
My take: The pattern with UniFi is that flaws get patched quietly and then, a few weeks later, show up on CISA's actively-exploited list. Do not wait for that second headline. Network gear, cameras, and access-control controllers are easy to forget because they "just work," but they sit at the center of your physical and network security. Patch them on the same schedule you patch laptops, not whenever someone remembers.
A China-linked crew reads university email through a Roundcube flaw
A China-linked threat cluster that Proofpoint tracks as UNK_MassTraction has been exploiting vulnerable Roundcube webmail servers at US and Canadian universities to steal credentials and drop backdoors. The campaign, running since May, zeroes in on physics and engineering departments and researchers tied to astrophysics, particle physics, and national-security work. It starts with a plain-looking email; simply opening it in a vulnerable Roundcube client triggers a cross-site scripting flaw (CVE-2024-42009) that runs attacker code in the victim's browser and loads a credential stealer called IceCube, which grabs usernames, passwords, cookies, and two-factor data.
From there the attackers try to escalate, using a second Roundcube flaw to install a PHP webshell for remote code execution or, failing that, loading a Go-based backdoor called VShell straight into memory. Proofpoint notes the crew pre-selected servers already known to be vulnerable, meaning they did their homework before firing. Attribution is an assessment, not a certainty, but the infrastructure overlap and Chinese-language artifacts point that way.
In short: A China-linked group is exploiting known Roundcube webmail flaws to steal credentials and plant backdoors at North American universities, needing only that a target open a malicious email.
What it means for your business: Any internet-facing mail server is a foothold, so if you self-host webmail, patch Roundcube now and treat that server with the same care as a VPN, because "the user just opened an email" is all this attack needs.
My take: The reusable lesson is that self-hosted mail servers age into liabilities. This crew specifically hunted for boxes still unpatched against a flaw that already had a fix, which is the whole game for espionage actors: let everyone else forget to update. If you run any internet-facing service that staff log into, it needs an owner, a patch schedule, and monitoring, not a "set it up once and forgot about it" status.
Source: Hackers exploit Roundcube flaw to spy on academic researchers (BleepingComputer)
A max-severity Palo Alto PAN-OS flaw
Palo Alto Networks disclosed CVE-2026-0288, a set of buffer-overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of its PAN-OS firewall software. An unauthenticated attacker with network access to the agent can send specially crafted traffic to crash it (a denial of service) or potentially run arbitrary code. Palo Alto gave it its highest urgency rating, with a CVSS score that reaches 9.2 when the agent is exposed to the internet or untrusted networks and drops to 7.7 when it is restricted to trusted internal segments.
There is a real limiter here: the bug only affects devices that actually have a Terminal Server Agent configured, and Panorama is not impacted. But where TSA is in use and reachable, this is about as serious as it gets: no authentication, no user interaction, potential code execution on a security appliance. Patched PAN-OS versions are out (12.1.8, 11.2.13, 11.1.16, and 10.2.7-h36 among them), and the recommended hardening is to restrict TSA connectivity to trusted internal IPs only.
In short: A max-urgency Palo Alto PAN-OS flaw (CVE-2026-0288) lets unauthenticated attackers crash or potentially hijack the User-ID Terminal Server Agent over the network.
What it means for your business: If you run Palo Alto firewalls with the Terminal Server Agent, patch to a fixed PAN-OS version and make sure the agent is only reachable from trusted internal IPs, not the open internet.
My take: Security appliances are the ironic soft spot, the box you bought to protect the network becomes the target. The mitigating factor, that TSA has to be configured and reachable, is exactly the kind of "it depends on your setup" detail that gets glossed over, so go check your actual config rather than assuming you are not affected. And the hardening advice, restrict it to trusted internal IPs, is worth doing whether or not you patch today, because it shrinks the attack surface for the next flaw too.
"HalluSquatting" turns AI coding assistants into a delivery vector
Researchers at Tel Aviv University, the Technion, and Intuit demonstrated a new supply-chain attack they call HalluSquatting, which weaponizes a well-known AI quirk: coding assistants make up package and repository names that do not exist. The researchers worked out the fake names an AI reliably invents, registered those names first, and waited. When a developer asks the assistant to, say, clone a trending repository, the model hallucinates the wrong location up to 85% of the time (and for trending "skills," 100% of the time in their tests) and points the developer straight at the attacker's booby-trapped resource. The team showed the attack working against nine popular tools, including Cursor, GitHub Copilot, Gemini CLI, and Windsurf.
Because a single well-chosen fake name can catch many developers who all ask the same assistant the same question, the researchers frame it as a way to build a botnet: plant one convincing lure, let the AI distribute it. The demonstrated payloads could support DDoS, cryptomining, ransomware staging, or straightforward developer-workstation compromise. It chains two AI weaknesses at once, a hallucination that sends you to the wrong place and a prompt injection waiting when you get there.
In short: HalluSquatting exploits AI coding assistants' habit of inventing package names by pre-registering those fake names, so the assistant hands developers attacker-controlled code.
What it means for your business: If your developers use AI coding assistants, treat every package, repo, or tool the AI suggests as unverified, because the name it confidently gives you may have been registered by an attacker who guessed what it would say.
My take: This is the sharpest version yet of a problem worth repeating: an AI assistant's confidence is not evidence. The fix is not to stop using these tools, it is to put a human checkpoint between "the AI suggested this dependency" and "we installed it." Pin known-good packages, verify anything new against its real, official source, and be especially wary when you ask for something trendy, because that is exactly when the hallucination rate spikes. The AI is a fast junior developer who occasionally invents a library and says it with a straight face.
🧰 New tooling for business AI use
Claude Cowork expands to web and mobile
Anthropic is bringing Claude Cowork, its agentic workspace that started as a desktop app, to the web and mobile. Rolling out as a beta over the next several weeks, it starts with the Max plan and adds more plans later. The pitch is continuity across devices: sessions sync, so a task you kick off at your desk can be checked from your phone and picked up later, and Cowork can run scheduled work in the background with no device online at all. To mark the launch, Anthropic is extending its doubled Cowork usage limits through August 5.
Anthropic also shared a rare look at what people actually use Cowork for, and it is not mostly coding. In a sample of 1.2 million sessions across more than 600,000 organizations, software development was just 8.7% of use. The biggest category, at 33.4%, was business-process work like pulling scattered updates into a report or reconciling spreadsheets, followed by content creation and copywriting at 16.4%.
In short: Claude Cowork is expanding from desktop to web and mobile in beta, with synced, background-running sessions, starting on the Max plan.
What it means for your business: The usage data is the useful part: this kind of AI agent is being used mostly for everyday business-process work, not coding, which suggests the highest-value place to point it is your reporting, reconciliation, and admin busywork, not your engineering team.
My take: Two things stand out. First, background and scheduled agent work that runs while your laptop is closed is a genuine shift in how this fits into a workday, closer to "assign it and check later" than "sit and prompt." Second, the fact that only 8.7% of use is software development is a quiet correction to the idea that AI agents are mainly a developer tool. The teams getting the most out of these are aiming them at spreadsheet reconciliation and status reports, the unglamorous work that eats hours. Start there.
That is the AI and IT news for July 9, 2026. For yesterday's roundup, including Claude Fable 5's move to pay-per-use pricing and a max-severity ColdFusion flaw under active attack, see our July 8, 2026 recap.