NIST has changed the vulnerability management social contract – limiting enrichment from newly reported CVEs just as adversaries are weaponizing them in hours. This week: Microsoft's largest Patch Tuesday of 2026, AI coding agents hijacked via GitHub comments, a COPPA compliance deadline in four days, and critical patches for Adobe Acrobat, Apache ActiveMQ, and PHP Composer.