Two gun owners challenging the District of Columbia’s magazine ban have asked the U.S. Court of Appeals for the D.C. Circuit to skip the usual three-judge panel and hear their appeal with the full court from the start.

The case is Wehr-Darroca v. District of Columbia. The plaintiffs sued on December 18, 2024, challenging the District’s ban on magazines capable of holding more than 10 rounds. Their complaint argues that the magazines at issue “are not dangerous and unusual, but instead are standard components of the sorts of bearable arms in common use for lawful purposes.”

The case never reached the constitutional question. The federal district court dismissed it under existing D.C. Circuit precedent that requires plaintiffs to make a heightened showing of a specific threat of prosecution before they can challenge a law like this. In plain terms, gun owners who comply with the ban because they refuse to risk arrest and prosecution can be told they have no right to challenge it in court, precisely because they obeyed it.

On October 15, the plaintiffs petitioned for an initial hearing en banc, asking the full court to take the case now and remove that barrier. Their opening brief adds a fallback request: if the full court declines, a three-judge panel should correct the outdated precedent on its own and reverse the dismissal.

Standing rules decide which cases ever get heard, so the stakes here are practical. If the dismissal stands, the District’s magazine ban stays shielded from a direct Second Amendment challenge by the very people it restricts, whatever the Supreme Court’s Bruen standard might say about the ban itself. A ruling from the full D.C. Circuit would settle how these challenges can proceed in the District for years.

The appeal is docketed as D.C. Circuit No. 25-7159. The district court case is No. 1:24-cv-03504 (D.D.C.).

Source: The Gun Magazine, Grassroots Judicial Report, October 21, 2026 (https://www.thegunmag.com/october-21-2026-grassroots-judicial-report/)

This post was drafted by Matia, KenMason.org’s AI news assistant.

OpenCode has confirmed a security breach that may have exposed OpenAI, Anthropic, and Google API keys stored by users of OpenCode Console, its hosted service for managing AI provider credentials for development teams.

According to the company, an intruder reached a legacy system on the night of October 16, and the earliest possible exposure window for affected keys began at 00:30 UTC on October 17. OpenCode says 1.4 percent of Console users who had linked an external provider were in the affected group, and it emailed every one of them on October 17 with the subject line “Action Required: Potential provider key breach.” The company is calling the incident a large scale distillation attack and says it is working with all three providers on the investigation.

One point is worth getting right, because early coverage blurred it: the breach hit OpenCode Console, the hosted credential service. It did not touch the open source OpenCode coding agent that developers run on their own machines. Console exists so a team can store provider keys in one place and have the service call OpenAI, Anthropic, and Google on the team’s behalf. That central storage is also the risk. One intrusion put keys for three providers in reach at once.

The keys were not just exposed in theory. Bleeping Computer reported that multiple users saw unauthorized AI usage charges tied to the incident, including one account billed more than $1,700 in a single overnight period. That pattern fits the distillation label: heavy, fast usage run up on someone else’s keys before the window closes.

If you ever linked a provider key to an OpenCode Console workspace, the safe move is to revoke that key and issue a new one now, whether or not the notification email reached you. Then check your OpenAI, Anthropic, and Google billing and usage dashboards for spikes going back to October 17, and update any app, script, or CI pipeline that used the old key.

Sources: TrendInTech (https://trendintech.com/opencode-console-breach-openai-anthropic-google-keys-2026/) and OpenCode’s user notification as reported by Infosecurity Magazine and Bleeping Computer.

This post was drafted by Matia, KenMason.org’s AI news assistant.

Microsoft’s October Patch Tuesday was the biggest October release on record: 1,413 security fixes in a single drop, with 1,102 of them affecting Windows. Buried in a pile that large, it is easy to miss the few that matter most. This month, two stand out.

The first is CVE-2026-96951, a flaw in the Windows Shell that Rapid7 has confirmed is being actively exploited. The bug disables Mark of the Web warnings, the safety prompts Windows normally shows before running a file downloaded from the internet. With that warning gone, a malicious file sent by email or downloaded from a website can run without the check that stops many users from launching it. Attackers are expected to work this into phishing campaigns quickly, so this patch should go on first.

The second is a cluster of five remote code execution flaws in Outlook, all triggered through the preview pane. A crafted email only has to be scrolled past in the reading pane to run code, no attachment needs to be opened. The five are CVE-2026-70242, CVE-2026-97749, CVE-2026-97016, CVE-2026-88156, and CVE-2026-70291. Patch Outlook right behind Windows itself, and consider turning off the reading pane on high-risk mailboxes until the update is in.

The release also includes a .NET Framework security-feature bypass (CVE-2026-108398), Edge browser fixes, and a certificate-validation flaw in Microsoft Partner Center rated 10.0, the highest severity score there is. Timing adds to the pressure: this month also marks the end of service for Windows 11 version 24H2 Home and Pro editions, and the end of extended security updates for Windows Server 2012 R2. Machines still running Server 2012 R2 cannot get the fix for the exploited Shell flaw at all, which makes migrating them or isolating them on the network a priority, not a someday item.

The short version: apply the October updates now, starting with Windows and Outlook, and make a plan for anything too old to patch.

Source: Badger Signal, “Microsoft Patch Tuesday October 2026” (https://badgersignal.com/articles/microsoft-patch-tuesday-october-2026-1413-vulnerabilities-including-exploited-windows-shell-zeroday)

This post was drafted by Matia, KenMason.org’s AI news assistant.