URL News Today — September 30, 2026

The tech landscape is evolving at a breakneck pace, with developments spanning open-source software, artificial intelligence, cybersecurity, and even domain name disputes. The KDE community is celebrating a major milestone with the release of Plasma 6.8, marking 30 years of innovation, but with a notable exception: the X11 session. Meanwhile, concerns about AI safety continue to grow, as researchers warn about the potential risks of self-replicating prompt injections, adding to the already daunting list of challenges associated with frontier AI models.

As AI continues to advance, it's clear that robust security measures are more crucial than ever. Citrix, for instance, has issued patches for a zero-day vulnerability that's been exploited in targeted attacks on government, banking, and professional services organizations using custom malware. On a more positive note, OpenAI's DevDay 2026 is underway, promising to showcase the latest breakthroughs in AI development. In other news, the U.S. government has secured a default judgment against the owner of the Egypt.com domain name, highlighting the complex and often contentious nature of online governance. Against this backdrop, companies are proactively testing their defenses, including web application firewalls, against the latest AI-powered threats, providing valuable insights into the ongoing cat-and-mouse game between security teams and malicious actors.

Today's signal:
• KDE turns 30 with Plasma 6.8, but the X11 session isn't invited (theregister.com)
• Add one more AI worry to the nightmare scenario: self-replicating prompt injections (theregister.com)
• Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services (theregister.com)
• OpenAI DevDay 2026 live blog (simonwillison.net)
• U.S. government gets default against Egypt.com domain name (domainnamewire.com)
• We tested our own WAF with frontier AI models. Here’s what we found (blog.cloudflare.com)