AI and IT News Recap: June 23, 2026: OpenAI Turns Its Models Loose on Patching Open Source, an FFmpeg Flaw Weaponizes Media Files, and a Quantum Crypto Deadline Lands

By Noah Smith, Owner & Consultant, KeyChange Technologies · June 23, 2026

A heavier-than-usual security day on the AI and IT news beat, with one big theme running through it: the same models writing your software are now being pointed at fixing it, while a fresh batch of flaws shows why that work matters. Here is the AI and IT news that actually affects how you run your business today.

📌 The AI and IT news at a glance

• 🔝 OpenAI points its models at the patch backlog with GPT-5.5-Cyber, an upgraded Codex Security plugin, and a "Patch the Planet" open-source program.
• 🛡️ A new FFmpeg flaw ("PixelSmash") turns a media file into remote code execution across players, media servers, and NAS boxes.
• 🛡️ An eight-year-old Samsung KNOX bug quietly exposed Galaxy phones from the S9 to the S25 to kernel attacks.
• 🛡️ Trump signed an executive order putting hard deadlines on post-quantum cryptography for federal agencies and contractors.

🔝 Top story: OpenAI stops hunting bugs and starts shipping fixes

OpenAI this week expanded its "Daybreak" cybersecurity initiative, and the framing is the interesting part. The company argues that AI has gotten so good at finding vulnerabilities that defenders are now drowning in findings they cannot patch fast enough. So the new push is aimed squarely at the remediation bottleneck rather than discovery. The centerpiece is an updated Codex Security plugin that scans whole codebases, traces attack paths, builds threat models, validates findings, generates patches, and exports results into existing vulnerability-management pipelines via SARIF files and CodeQL queries. Since the research preview launched in March, OpenAI says Codex Security has processed more than 30 million commits across over 30,000 repositories, with human reviewers confirming more than 70,000 fixes and roughly 500,000 findings resolved automatically.

Alongside the tooling, OpenAI shipped the full version of GPT-5.5-Cyber, which it calls its most capable model for authorized security work; it scored 85.6% on the CyberGym benchmark versus 81.8% for standard GPT-5.5, with access limited to verified defenders. The company also launched "Patch the Planet," an initiative with Trail of Bits, HackerOne, and others that embeds researchers armed with these tools alongside maintainers of widely used open-source projects, handling validation and patch development before anything reaches the maintainers. More than 30 projects have signed on, including cURL, Go, Python, Sigstore, and pyca/cryptography.

In short: OpenAI released GPT-5.5-Cyber and new Codex Security tooling aimed at getting vulnerabilities patched, not just found, and launched a program to help fix critical open-source software.

What it means for your business: Most of the software you depend on sits on top of open-source projects maintained by a handful of overworked volunteers. Efforts like this could meaningfully harden that foundation over time, and the same Codex Security tooling is the kind of thing your own developers or vendors will increasingly use to clear security backlogs.

My take: Finding bugs was never really the hard part; fixing them in code nobody wants to own is. Pointing AI at the patch queue is a more useful direction than another vulnerability-discovery arms race. The thing to watch is patch quality at this volume, because an auto-generated fix that is wrong in a subtle way can be worse than the bug it replaced. Worth cautious optimism, not blind trust.

Source: SecurityWeek: OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery

🛡️ A booby-trapped video file is now a real attack vector ("PixelSmash")

Researchers at JFrog disclosed a serious flaw in FFmpeg, the media-processing framework that quietly sits inside an enormous amount of software, from desktop video players to Linux file managers, self-hosted media servers, and cloud transcoding pipelines. Tracked as CVE-2026-8461 (CVSS 8.8) and nicknamed PixelSmash, it is a heap out-of-bounds write in FFmpeg's libavcodec library, specifically the MagicYUV decoder. A crafted media file can crash an application or, with more effort, achieve remote code execution, and JFrog says no authentication or special privileges are required beyond getting the file in front of the target.

What makes this one worth your attention is the delivery. The payload can be a roughly 50 KB AVI, MKV, or MOV file, and it can fire with little or no user interaction: opening it in a vulnerable player, browsing a folder where a file manager auto-generates a thumbnail, uploading it to a media server, or even letting a torrent client drop it into a monitored library folder. JFrog confirmed successful exploitation against widely used apps including Kodi, mpv, Jellyfin, Emby, Nextcloud, Immich, PhotoPrism, and OBS Studio. The fix is in FFmpeg version 8.1.2.

In short: A high-severity FFmpeg flaw lets a single crafted media file run code on machines and servers that process it, often with no clicks required, and a patched version (8.1.2) is available.

What it means for your business: If you run a media server, a NAS, a self-hosted file platform like Nextcloud, or anything that auto-generates video thumbnails, this is a patch-now item. Anything that automatically processes uploaded media is the exact attack surface this targets.

My take: "Just opening a file" attacks are the ones that bite normal organizations, because they sail right past the assumption that you have to click something sketchy to get hurt. The 50 KB zero-click torrent scenario is nasty. Update FFmpeg wherever it hides, and remember it hides in a lot of places you would not think to check.

Source: SecurityWeek: FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances

🛡️ An eight-year-old Samsung KNOX flaw sat in millions of Galaxy phones

A high-severity vulnerability (CVE-2026-20971, CVSS 7.8) lived for roughly eight years inside KNOX, Samsung's own security framework, affecting Galaxy devices from the S9 all the way to the S25. Researchers at LucidBit Labs found a use-after-free condition created by a race between two KNOX kernel subsystems (PROCA, the process authenticator, and FIVE, the integrity checker) that could lead to kernel memory corruption and, potentially, deeper control of the device. The irony noted by the researchers is hard to miss: the bug was hiding in the security layer that is supposed to protect the phone. Samsung fixed it in its January 2026 update across affected Android 13, 14, 15, and 16 versions.

The flaw required local access and some user interaction, which sounds reassuring until you remember how often a phone leaves its owner's hands. The researchers' broader point is the one worth keeping: your own security stack is itself an attack surface, and defenders should treat it that way rather than assuming protective tooling is automatically safe.

In short: An eight-year-old use-after-free bug in Samsung's KNOX security framework exposed Galaxy S9 through S25 phones to kernel attacks, and Samsung patched it in its January 2026 update.

What it means for your business: If your team uses Samsung Galaxy devices, confirm they are on the January 2026 (or later) security update. The bigger lesson for any business is that "we have a security product" is not the same as "we are secure."

My take: The interesting bit is not that a vulnerability existed; it is that it sat in the trust layer for eight years. It is already patched, so the action item is mundane (keep devices updated), but the principle is the keeper: the tools you trust most deserve scrutiny too.

Source: SecurityWeek: Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks

🛡️ Trump's executive order puts a clock on post-quantum crypto

President Trump signed Executive Order 14409 to accelerate the federal government's move to post-quantum cryptography (PQC), the next generation of encryption designed to withstand future quantum computers. The order leans on the "harvest now, decrypt later" threat, where attackers steal encrypted data today intending to crack it once quantum hardware can. It tasks OMB, NIST, NSA, DHS, and CISA with producing technical guidance, and sets real deadlines: federal agencies must move high-value assets and high-impact systems to PQC for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. The Department of Commerce will run a pilot migration through the end of 2027.

The part that reaches beyond Washington: federal contractors will also be required to comply with NIST PQC standards by the end of 2030. As one cited expert put it, organizations that have not even started a cryptographic inventory are already behind.

In short: A new executive order sets 2030 and 2031 deadlines for federal agencies, and a 2030 deadline for federal contractors, to migrate to quantum-resistant encryption.

What it means for your business: If you sell to the federal government, this is now a compliance clock, not a someday problem. Even if you do not, "harvest now, decrypt later" makes a cryptographic inventory a reasonable thing to start thinking about, because migrations like this take years.

My take: Quantum decryption still feels abstract, and the deadlines are years out, which is exactly why most organizations will do nothing until it is a fire drill. The smart move is unglamorous: know what encryption you use and where, so that when you have to move you are editing a map instead of drawing one.

Source: SecurityWeek: Trump Signs Executive Order Accelerating Post-Quantum Cryptography Migration

Catch up on yesterday's stories in our June 22, 2026 AI and IT News Recap.