5 PM Technology News Recap: OpenAI Subpoena, FortiMail Zero-Day, Copilot Model Retirements, GitHub Advisory Privacy, and Guided Vision (October 2, 2026)

1. California subpoenas OpenAI over cybersecurity risks

California Attorney General Rob Bonta said on October 1 that his office had served OpenAI an investigative subpoena as part of an ongoing inquiry into cybersecurity incidents and risks involving the company and its models.^[1][2] The state linked the move to its broader investigation of incidents arising from AI-model operations, including a previously announced inquiry involving Hugging Face.

A subpoena is an information-gathering step, not a finding that OpenAI violated the law. The California release says the office is asking additional questions and assessing whether developers met legal responsibilities; it does not identify a concluded violation, penalty, or final enforcement action.^[1]

Practical action: organizations using frontier models for security work should keep model versions, tool permissions, test scopes, human approvals, and incident logs. That record helps separate authorized testing from harmful activity and supports a defensible response if regulators ask how safeguards actually worked.

2. FortiMail zero-day is exploited while patches remain pending

Fortinet’s CVE record describes CVE-2026-104286 as a critical path-traversal and null-byte handling flaw in FortiMail that can let an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests.^[3] The record assigns a CVSS 3.1 score of 9.8 and lists affected releases in the 7.2, 7.4, 7.6, and 8.0 branches.

CISA added the issue to its Known Exploited Vulnerabilities catalog on October 1, and Fortinet said exploitation had been reported in the wild.^[4][5] At this cutoff, Fortinet listed fixed 7.4.9, 7.6.7, and 8.0.2 releases as upcoming; its interim guidance was to disable IBE support or remove the management interface from internet exposure and restrict it to trusted sources.^[3][5]

Practical action: FortiMail administrators should identify the exact version, restrict management access immediately, apply Fortinet’s workaround, preserve logs and forensic evidence before remediation, hunt using the vendor’s current indicators, and install the fixed release as soon as Fortinet publishes the appropriate branch update.

3. GitHub retires four Copilot models

GitHub said on October 2 that Gemini 3.5 Flash, Gemini 3.6 Flash, Kimi K2.7 Code, and Claude Opus 4.7 were deprecated across Copilot Chat, inline edits, ask and agent modes, and code completions.^[6] GitHub recommends Gemini 3.8 Flash, Kimi K3, and Claude Opus 5.5 as alternatives.

GitHub says users do not need to remove the deprecated models, but Copilot Enterprise administrators may need to enable replacement models through organization policies before teams can select them.^[6] A suggested replacement is not evidence that prompts, costs, latency, safety behavior, or generated code will remain identical.

Practical action: audit Copilot policies, extensions, automation, and documentation for retired names. Enable only approved alternatives, rerun representative coding and review tasks, and record meaningful regressions before making a replacement the default.

4. GitHub improves private security-advisory coordination

GitHub released confidential comments for repository security advisories on October 2. These comments are visible only to people with write access, are marked in the advisory timeline, are recorded in audit logs, and are not shown or notified to reporters and invited collaborators without write access.^[7]

GitHub also added five read-only fields to the SecurityAdvisory GraphQL object—CVE ID, source-code location, GitHub review time, NVD publication time, and a linked repository-advisory URL—plus severity and withdrawn-status filters.^[8] GitHub says existing queries continue to work because the changes are additive.

Practical action: keep reporter-facing collaboration respectful and complete, use confidential comments only for limited investigation or suspected-abuse details, review write access before posting, and test GraphQL integrations against the new fields without weakening existing disclosure workflows.

5. Google launches Guided Vision for compatible Android devices

Google launched Guided Vision in Gemini Live on October 1 for devices running Android 9 or later in regions and languages where Gemini Live is supported.^[9] The feature uses a shared camera feed for spoken descriptions, follow-up questions, and verbal framing cues such as panning, tilting, or stepping back.

Google says it partnered with Aira on tens of thousands of hours of visually interpreted training data and that more than 1,000 members of Aira’s Trusted Tester network helped test and refine the model.^[9] Those figures and performance descriptions are company-reported; the checked source is not an independent safety evaluation.

Google explicitly warns that Guided Vision can make mistakes and is not a medical device, mobility aid, white-cane replacement, navigation system, safe-travel guide, or obstacle detector.^[9]

Practical action: update the Gemini app and Android system, enable Guided Vision in Gemini Live or through Android accessibility shortcuts, test it first on low-risk household tasks, protect bystanders’ privacy, and continue using established mobility aids and safe-travel practices.