OpenAI Cuts Funding Target to $20B as Reddit Plans Login Wall

OpenAI has reportedly pared back the target for its latest pre-IPO funding round from $30 billion to $20 billion after securing $11 billion so far, according to a report by Anthony Ha in TechCrunch — Artificial Intelligence, as Reddit announced plans to transition into a "logged-in service" to combat unauthorized content scrapers and security researchers detailed a zero-click Android WAP Push denial-of-service vulnerability tracked as CVE-2026-58882 in BleepingComputer.

OpenAI Lowers Funding Round Target to $20 Billion With $11 Billion Secured

OpenAI was previously reported to be raising $30 billion at a $1.4 trillion valuation — and subsequently at a $1.25 trillion valuation — ahead of a planned initial public offering. Citing reporting from The Financial Times and The Wall Street Journal, TechCrunch reported that OpenAI has lowered the round's target to $20 billion, with an initial close expected below that figure.

According to the reports, the round is being led by a group of investors from the United Arab Emirates, with a subsequent retail offering for wealthy individuals potentially bringing the total to the $20 billion target. The Wall Street Journal reported that OpenAI has secured $11 billion to date amid a cautious response from some large institutional investors as Wall Street scrutinizes heavy artificial intelligence infrastructure spending.

Reddit Plans Login Requirement After 20 Years to Curb Scrapers

In a post by Reddit co-founder Steve Huffman reported by Bill Toulas in BleepingComputer, Reddit announced that after 20 years of allowing logged-out browsing across nearly all of its platform, the company will begin pilot testing a login requirement in selected markets outside the United States in the coming months.

Huffman cited two primary drivers for moving toward a "logged-in service":

• Blocking Unauthorized Scraping: Reddit stated that most unauthorized data harvesting occurs through logged-out pages, while AI companies and search engines that want access to Reddit data will continue to license it through commercial agreements.
• Personalization and Privacy Controls: While the Reddit front page and direct landing pages from search results will remain accessible without an account, logged-in activity will allow Reddit to gather upvote signals and serve targeted advertising. Huffman added that Reddit will not require real names or government identification, will allow users to opt out of personalized ads, and will re-release a read-only incognito mode in its mobile app.

Proof-of-Concept Released for Android WAP Push Flaw CVE-2026-58882

In mobile security news reported by Lawrence Abrams in BleepingComputer, vulnerability researcher Mark Blah published a technical analysis and proof-of-concept exploit for CVE-2026-58882, a zero-click denial-of-service flaw in Android's WapPushOverSms.decodeWapPdu function.

By sending a malformed 8-byte WAP Push data SMS (01 06 88 80 80 80 00 BE) to port 2948, an attacker can trigger an unchecked signed 32-bit integer conversion that evaluates to -2147483648, raising a NegativeArraySizeException that crashes the com.android.phone process before the message ever appears in the user's SMS inbox. In testing, sending 20 malformed messages caused phones to enter repeated reboot loops, forcing one Android 12 device into recovery mode approximately every 90 seconds until a factory reset was performed (though GitHub contributor Sakis documented an Android Debug Bridge removal method for users with computer access).

Google patched CVE-2026-58882 ("Fix remote DoS in decodeWapPdu") in its October 2026 security updates for Android 14 through 17 — catching the exception and deleting the malformed SMS entries from the database — while older Android 12 and 13 devices did not receive the patch and remain vulnerable.