AI & Security Bulletin (Sep 16, 2026): Siri AI Live, DeepSeek V4.1-Flash Open Source, Record 974 Flaws

Today's Highlights

The compiled AI and cybersecurity agenda as of September 16, 2026 — the 2Run AI Security Desk daily bulletin.

🤖 Artificial Intelligence

Apple Siri AI is live. Apple rolled out its far more capable, personalized Siri AI on September 15, promising deep contextual understanding and in-app action execution. [Apple Newsroom]

DeepSeek V4.1-Flash goes open source. DeepSeek released V4.1-Flash as open source; with 13 model releases across 8 providers in September 2026, the open-weights race is accelerating. [LLMGateway.io]

OpenAI DevDay 2026 registration opens. The September 29 event in San Francisco lands at a moment when GPT-6 Astra has crossed a critical cybersecurity capability threshold. [OpenAI]

Moonshot Kimi debate. The rapid growth of the Kimi series is raising questions about the commercial viability of open-weight models in China. [Fortune]

Anthropic threat intelligence. Anthropic exposed fake resellers offering discounted Claude access under GTG-50021; the operation was silently proxying user traffic to a different model. [anthropic.com]

🔒 Cybersecurity

Microsoft September 2026 Patch Tuesday: 974 vulnerabilities. The record update patched 139 critical flaws and two actively exploited zero-days. [Microsoft / BleepingComputer]

CISA KEV: Cisco SEG SQL injection (CVE-2026-76461). The Cisco Secure Email Gateway flaw was catalogued with a September 17 deadline for federal agencies. [CISA]

VMware ESXi RCE in ransomware hands. CISA confirmed the critical RCE flaw is being actively weaponized by ransomware groups. [BleepingComputer]

Japan Digital Agency: 246,000 staff records leaked. An insecure VPN configuration exposed data belonging to hundreds of thousands of public-sector workers. [BleepingComputer]

CenterPoint Energy data breach. The US utility confirmed customer data was stolen in a cyber attack. [BleepingComputer]

📌 Regulation & Policy

• The EU AI Act entered into force in its main outlines on August 2, 2026; full obligations for high-risk AI systems were pushed to December 2, 2027. [digital-strategy.ec.europa.eu]
• GITEX AI Türkiye (September 9–10, Istanbul) concluded; the Türkiye pavilion showcased AI startups in e-commerce, predictive analytics and weather. [Invest in Türkiye]

The 2Run Perspective

Two takeaways for small and mid-sized teams this week: (1) Patch discipline — even in record updates like 974 flaws, prioritize critical and KEV-listed items; (2) Verify official channels when choosing AI products — fake reseller operations target companies, not just individuals. Keep your infrastructure current with 2Run managed hosting and security monitoring; we do this tracking for you every day.

Sources

apple.com/newsroom · deepseek.com · openai.com · fortune.com · anthropic.com · microsoft.com · cisa.gov · bleepingcomputer.com · thehackernews.com · digital-strategy.ec.europa.eu