Technology Intelligence

Westpac to reshape software engineering with Amp Frontier Corporation

Westpac has contracted with San Franciscop-based Amp Frontier Corporation to build a suite of AI agents for software engineering tasks.

CVE-2026-60990

NVD CRITICAL: CVE-2026-60977 — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware ...

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracl

CVE-2026-60977

NVD CRITICAL: CVE-2026-60971 — Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio...

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in take

CVE-2026-60971

CVE-2026-60591

Fortinet Buys Virtue AI for Agent and Model Runtime Controls

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/fortinet-buys-virtue-ai-for-agent-model-runtime-controls-image_small-8-a-32592.jpg" align=right hspace=4>Acquisition Adds Offensive and Defensive Testing for Agents and Models Fortinet acquired Virtue AI's technology to extend FortiAIGate with red- and blue-team testing, runtime controls and policy enforcement for AI age

4h agoBank Info Security

6h agoUnit 42 (Palo Alto)

NVD CRITICAL: CVE-2026-75877 — A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affec...

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN_00432574/FUN_0043372C of the component alphapd. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42 .

The Cybersecurity and Infrastructure Security Agency (CISA) and FBI updated an advisory on the group initially released in March 2025 — writing that as of April 2026, Medusa actors have hit more than 500 victims. CISA previously said 300 victims, many of which are in critical infrastructure sectors, were attacked as of 2025.

7h agoThe Record

Noggin HQ raises £2.3m and secures credit referencing authorisation

British alternative credit scoring technology startup Noggin HQ has raised £2.3 million in an oversubscribed seed round.

7h agoFinextra

Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced

7h agoThe Hacker News

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence (AI) platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology (OT) and industrial automation, are witnessing malicious scanning and exploitation efforts. According to independent reports from watchTowr and VulnCheck, the vulnerabilities in question are as follows -

7h agoThe Hacker News

Clop created custom web shell for Windchill data theft attacks

A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. [...]

7h agoBleepingComputer

Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics

The updated warning from the FBI, CISA and HHS draws on a year’s worth of investigations to detail how the group gains initial access and what it does afterward. The post Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics appeared first on CyberScoop .

7h agoCyberScoop

NVD CRITICAL: CVE-2026-18963 — A flaw was found in the reset-credentials flow of the keycloak-services componen...

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user

CVE-2026-18963

7h agoNIST NVD

Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous," GuidePoint Research

8h agoThe Hacker News

Berlin cuts two state ministries off government network after security breach

The affected ministries — one responsible for urban development, construction and housing, and the other for mobility, transport, climate protection and the environment — have been isolated from government networks since Friday as a precaution.

8h agoThe Record

University of Texas forced to take systems offline in San Antonio after cyberattack

The University of Texas at San Antonio, which serves 40,000 students across six campuses, said its IT team identified threat activity on its academic campus over the weekend and took some systems, including phones, offline in response.

8h agoThe Record

NVD CRITICAL: CVE-2026-75913 — CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an...

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an at

CVE-2026-75913

8h agoNIST NVD

9h agoInfosecurity Magazine

NVD CRITICAL: CVE-2026-12564 — A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The ...

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation pri

CVE-2026-12564

8h agoNIST NVD

CRITICALAi

Wiz AI Agent Finds Critical Snowflake GitHub Repo Flaw Advanced Security Missed

The security flaw in Snowflake’s GitHub Actions workflow had been missed by a GitHub Advanced Security scan, said a Wiz researcher

TMX complete acquisition of Rafi Indices

TMX Group Limited (TMX Group) today announced it has completed the acquisition of RAFI Indices, LLC (RAFI Indices) from Research Affiliates Global Holdings, LLC (Research Affiliates), a global index provider and investment advisor. The transaction was announced in June 2026.

9h agoFinextra

NVD CRITICAL: CVE-2026-75784 — A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this ...

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-75784

9h agoNIST NVD

NVD HIGH: CVE-2026-66046 — Expat through 2.8.3 contains a denial of service vulnerability caused by quadrat...

Your Controls Block Known Attacks. What About the Behavior?

Security controls can block a familiar attack method while missing quieter ways to achieve the same objective. Picus Security's Blue Report 2026 shows how prevention rates can vary dramatically by technique and why behavioral testing is needed to uncover those gaps. [...]

11h agoBleepingComputer

NVD CRITICAL: CVE-2026-75783 — A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Aff...

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.

CVE-2026-75783

11h agoNIST NVD

NVD HIGH: CVE-2026-75778 — A vulnerability was identified in code-projects Task Management System 1.0. This...

CVE-2026-55676CVE-2026-63133

Fortinet will use Virtue AI technology to enhance its AI security portfolio, including for AI models, applications, and agentic systems. The post Fortinet Acquires AI Security Company Virtue AI appeared first on SecurityWeek .

13h agoSecurityWeek

CRITICALApt

CISA Malcolm

<a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-230-01.json">View CSAF</a> <h2>Summary</h2> Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code. The following versions of CISA Malcolm are affected: <ul> <li>Malcolm <26.0

13h agoCISA Advisories

Siemens Simcenter Nastran

<a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-230-02.json">View CSAF</a> <h2>Summary</h2> Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impacted application binary with a ma

CVE-2026-59086

13h agoCISA Advisories

LOWMalware

16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below - ubnuler ubnlder ri18nr reaker rakier orakw joxn

13h agoThe Hacker News

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a

13h agoThe Hacker News

13h agoInfosecurity Magazine

Cyber Incident Disrupts Student Services at UT San Antonio

UT San Antonio has taken IT systems offline following a cyber incident, disrupting student registration and tuition payments days before term is due to resume

NVD CRITICAL: CVE-2026-75627 — Bastillion fails to properly validate request URI paths in its controller dispat...

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

CVE-2026-75627

13h agoNIST NVD

NVD CRITICAL: CVE-2026-75626 — SpiderFoot fails to HTML-escape correlation titles built from external scan data...

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

CVE-2026-75626

13h agoNIST NVD

Financial data startup Quatr raises $18 million

Quartr, the world's leading first-party data layer for institutional finance and AI, today announced it has closed a $18 million funding round, led by existing investor Altos Ventures with participation from new investor SEB (publ.)

13h agoFinextra

Microsoft tests faster Windows File Explorer, new context menu

Microsoft has started testing a faster File Explorer and a less cluttered and more customizable context menu in Windows 11 preview builds rolling out to Insiders this week. [...]

14h agoBleepingComputer

HIGHApt

New Malware turns Microsoft cloud into its control center

Security researchers are warning of a newly uncovered Python malware framework that routes much of its command-and-control (C2) activity through Microsoft services that defenders already expect to see. The Ontinue Cyber Defense Center discovered the implant while investigating an active campaign in July and has since tracked it as TWINLOOT. It was seen using SharePoint Online as a file-based dead

14h agoCSO Online

300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw

NVD HIGH: CVE-2026-75091 — The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for ...

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-75091

18h agoNIST NVD

NVD CRITICAL: CVE-2026-15748 — The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload...

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler th

CVE-2026-15748

18h agoNIST NVD

Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix Rates by over 14%

A benchmark of secure, functional vulnerability fixes across JavaScript, Java, and Python shows Snyk Intelligence helps frontier models break past a 72–75% performance plateau.

21h agoSnyk

Weekly Update 517: Cyber Ransoms

The current ransomware situation is a bit of a kludge (deep breath): a lot of ransomware (which often doesn't even involve "ware", it's just extortion) is carried out by kids who successfully make a truckload of money but can't spend it without

21h agoTroy Hunt

NVD HIGH: CVE-2026-11801 — The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authori...

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including register

CVE-2026-11801

21h agoNIST NVD

NVD CRITICAL: CVE-2026-75094 — A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_...

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVE-2026-75094

22h agoNIST NVD

HIGHSupply Chain

OpenAI president’s blog pushing agentic AI most notable for what it did not say

OpenAI president Greg Brockman on Sunday warned enterprise CISOs that they need to more aggressively embrace agents if they want to survive upcoming cyberattacks. Brockman said in a blog post that it has become “increasingly clear” that company systems are hiding “significant flaws, and defenders need to find and fix them before attackers do.” He added: “The Hugging Face incident showed that we un

23h agoCSO Online

Synchrony unveils ChatGPT plugin

Consumer financial services firm Synchrony is launching a ChatGPT plugin that lets shoppers find savings and offers from the firm's marketplace.

Stripe agrees $7bn takeover of AI firm OpenRouter - Bloomberg

Payments giant Stripe has struck a $7 billion deal to acquire AI gateway keeper OpenRouter, according to Bloomberg.

CRITICALData Breach

Clop Claims Data Theft From More Than 40 Companies

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/clop-claims-data-theft-from-more-than-40-companies-image_small-2-a-32581.jpg" align=right hspace=4>Victims Are Assessing Claims of Stolen Databases, CAD Files and Backups Russia-linked Clop claims it stole databases, engineering files, backups and other sensitive corporate data from more than 40 organizations in a breach

Unleashing Hackers to Be the US Government's Bounty Hunters

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/unleashing-hackers-to-be-us-governments-bounty-hunters-image_small-9-a-32585.jpg" align=right hspace=4>Trump Presidential Memo a Risky Proposition for Corporations and the Internet Even those who support a White House push to involve the private sector in offensive cyber operations against foreign online crime groups adm

MEDIUMSupply Chain

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/openai-president-urges-enterprises-to-deploy-ai-agents-image_small-8-a-32583.jpg" align=right hspace=4>Greg Brockman Says Defenders Must Automate Security Before Attackers Gain Ground OpenAI president Greg Brockman believes every enterprise should bring agents to its security teams as urgently as possible to combat sophi

Hack on Med Software Firm Hits Half of Poland's Population

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/hack-on-polish-medical-software-firm-affects-nearly-19m-image_small-3-a-32580.jpg" align=right hspace=4>19M Patients Affected by Data Theft Including National ID Numbers A hack into IT systems of MyDr, a Polish provider of electronic medical documentation software, has affected more than 12,000 healthcare facilities and

Ukrainian software developer faces 12 years in Swiss ransomware trial

The unnamed 52-year-old is accused of attacking Swiss train manufacturer Stadler Rail alongside other enterprises as part of an international ransomware operation.

1d agoThe Record

GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Released on

CVE-2026-19478

AI Gives Defenders an Edge in the Vulnerability Race

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ai-gives-defenders-edge-in-vulnerability-race-image_small-6-a-32577.jpg" align=right hspace=4>Mandiant Consulting's Charles Carmakal on AI, Social Engineering and Extortion Attackers are using AI to find vulnerabilities, build exploit tools and analyze stolen data, but defenders still hold an advantage. The greater risks

Details emerge on BlackFile’s recent attacks on financial companies

BlackFile’s four affiliate groups are still targeting victims, including medical technology organizations. Several potential victims received new extortion demands last week, according to Google. The post Details emerge on BlackFile’s recent attacks on financial companies appeared first on CyberScoop .

1d agoCyberScoop

Irregular says ‘human oversight’ responsible for AI sandbox escape incidents

In a post-mortem, the frontier AI testing company said internet access for models is necessary to fully test out their cybersecurity capabilities. The post Irregular says ‘human oversight’ responsible for AI sandbox escape incidents appeared first on CyberScoop .

1d agoCyberScoop

Apple Patches iOS and macOS, (Mon, Aug 17th)

Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller macOS update that addressed the single screen-sharing vulnerability. This vulnerability did not affect iOS/iPadOS.

1d agoSANS ISC

'Turf War' Between Claude Agents Leads to Self-Replicating Malware

Three testing models with the same goal but different directives engaged in "increasingly aggressive" territorial attacks on one another, according to Anthropic.

1d agoDark Reading

NVD HIGH: CVE-2026-75014 — A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Th...

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

CVE-2026-75014

NVD HIGH: CVE-2026-74234 — Legora before 2026-08-14 contains a cross-site scripting vulnerability that allo...

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval() before any SVG sanitization occurs. Attackers can exploit this flaw through influenced Mermaid diagram

CVE-2026-74234

NVD CRITICAL: CVE-2026-71472 — A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authentica...

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string provided in the Search CR is not properly validated before being used in a bash script and an SQL query. Successful exploitation could lead to

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions pre

CVE-2026-74238

NVD CRITICAL: CVE-2026-66792 — A flaw was found in the multicloud-operators-subscription component. This vulner...

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to

CVE-2026-66792

Pokémon Center data breach exposes customer info, cancels some orders

Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information from third-party logistics provider CEVA Logistics. [...]

Azure Breach Campaign Claims McDonald's, Vodafone as Victims

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/azure-breach-campaign-claims-mcdonalds-vodafone-as-victims-image_small-1-a-32578.jpg" align=right hspace=4>Darknet Forums List Employee and Service Records Allegedly Stolen From Major Firms Forums selling stolen data are featuring advertisements for massive quantities of employee and service information exfiltrated from

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Trump-linked World Liberty Financial gets conditional bank charter approval

Donald Trump-linked crypto venture World Liberty Financial has received conditional approval for a bank charter from the Office of the Comptroller of the Currency.

NVD HIGH: CVE-2026-16471 — Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger ...

Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8.

CVE-2026-16471

An “invisible” car? Researcher uses machine learning to hide vehicles from Flock cameras

A cybersecurity expert has demonstrated how computer-generated patterns can successfully prevent surveillance cameras from detecting vehicles - such as the controversial AI-powered Flock licence plate readers that are becoming increasingly common on American streets. Read more in my article on the Hot for Security blog.

1d agoGraham Cluley

Certighost and the Privilege Hiding in Your Certificate Authority

CVE-2026-54121 lets a standard domain user turn your Enterprise CA into a Domain Controller. The patch is the easy part. The lesson is standing privilege, implicit trust, and treating PKI as the Tier 0 identity infrastructure it has always been. [...]

CVE-2026-54121

CRITICALAi

Why data quality dictates security operations success

As AI takes on more security operations center (SOC) workflows to automate threat triage, indicator extraction, and incident report generation, security operations leaders face a persistent question: Does SOC performance depend more on the large language model (LLM) deployed or on the underlying quality of the security data it consumes? Academic studies offer conflicting answers. An original resea

1d agoCSO Online

680,000 Impacted by French Tax Authority Data Breach

Hackers used compromised credentials to access enterprise and personal tax-related data. The post 680,000 Impacted by French Tax Authority Data Breach appeared first on SecurityWeek .

1d agoSecurityWeek

1d agoInfosecurity Magazine

WordPress Plugin Flaw Exposes 40,000 Sites to Admin Takeover

Critical User Profile Builder flaw let unauthenticated attackers access administrator accounts

MEDIUMZero Day

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

The expensive attacks are not always the clever ones. This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely. So, nothing magical. Just a

More than 2 million user records from TaxAct allegedly acquired; 450k already leaked

On August 13, DataBreaches was contacted anonymously on Signal by someone reporting that they had acquired more than 2 million records with clients’ phone numbers, usernames, and email addresses from TaxAct, which is owned by Cinven. TaxAct operates under its parent company and holding entity, Taxwell. Not all the phone numbers were real, they reported,... Source

More than 2 million user records from TaxAct allegedly acquired; 450k already leaked (1)

More than 2 million user records from TaxAct allegedly acquired; 450k already leaked (with correction)

Israel’s largest crypto broker Bits of Gold hit by data breach affecting 200,000 customers

Olivier Acuna reports: Cryptocurrency broker Bits of Gold said personal data belonging to roughly 200,000 customers was stolen by hackers, the company reported. The Tel Aviv, Israel-based company reported the security breach on Sunday, saying a hacker gained unauthorized access to a third-party data analytics network and gained access to customers’ names, national ID numbers, emails,... Source

Windows Server 2022 reaches end of mainstream support in 60 days

Microsoft has reminded IT administrators that Windows Server 2022 is rapidly approaching its mainstream end date of October 2026, when it will switch to extended support. [...]

Ukraine says cyberattack hit Russian e-commerce giant Wildberries amid drone strikes

Ukraine’s military intelligence claimed it disrupted the operations of Russia’s largest online marketplace, Wildberries, in a cyberattack intended to amplify the impact of drone strikes on the company’s infrastructure.

1d agoThe Record

Data Theft/Extortion Incident Confirmed by Beverly Hills Plastic Surgeon

Data breaches have recently been announced by Terry J. Dubrow, MD, SunCloud Health, Integer Precision Technologies, Minnesota ENT, and Nipro […] The post Data Theft/Extortion Incident Confirmed by Beverly Hills Plastic Surgeon appeared first on The HIPAA Journal .

1d agoHIPAA Journal

From AKS node root vulnerability to Microsoft Copilot hijack (CVE-2026-32193)

[object Object]

CVE-2026-32193

1d agor/netsec

CRITICALAi

Zhipu says new coding AI developed advanced cyber skills faster than expected

Chinese AI developer Zhipu has launched GLM-5.3, a new coding-focused AI model that the company says has developed unexpectedly strong cybersecurity capabilities, putting it close to global leading models in vulnerability discovery while remaining behind them on deeper exploitation tasks. Zhipu’s own testing places GLM-5.3 slightly ahead of Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol on CyberGym

1d agoCSO Online

Irregular Details How a Naming Error Let AI Models Attack a Real Company

The AI security testing firm has shared information on a recently disclosed incident involving Anthropic AI models. The post Irregular Details How a Naming Error Let AI Models Attack a Real Company appeared first on SecurityWeek .

1d agoSecurityWeek

Revolut to open network of airport lounges across Europe

Revolut has unveiled plans for a network of premium branded airport lounges across major European destinations.

How MCP Servers Can Expose Enterprise Secrets

MCP servers can expose enterprise secrets through plaintext configuration files, over-permissioned access and prompt injection, often before security teams even know the server is running. As more organizations adopt AI agents into their systems, that exposure can silently become a major gap in MCP server security. The Model Context Protocol (MCP) allows AI agents to reach the tools and data,

LOWMalware

New macOS malware turns stolen browsers into attacker-controlled sessions

Mac users are being freshly warned of suspicious websites asking them to open Terminal and install software. Jamf Threat Labs has uncovered a multi-stage macOS infostealer, dubbed AmnesiaStealer, that uses a ClickFix-style fake GitHub download page to trick victims into executing a command that installs malware. The campaign is designed to steal credentials and sensitive data before escalating int

1d agoCSO Online

Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

Operation ASTERIX overview Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Among the artifacts was evidenc

1d agoRapid7

Philips and GE investigating Clop ransomware data theft claims

Tech giants General Electric (GE) and Philips have also confirmed they're investigating claims that the Clop ransomware gang breached their systems and stole data. [...]

MEDIUMPhishing

MEDIUMPhishing

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated re

CVE-2026-19980

NVD CRITICAL: CVE-2026-19977 — A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element ...

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

NVD HIGH: CVE-2026-19960 — A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impac...

A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation of the argument rootAPmac leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-19960

NVD CRITICAL: CVE-2026-19959 — A weakness has been identified in Edimax EW-7478APC 1.04. This affects the funct...

A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation of the argument pppUserName causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclos

CVE-2026-19959

Anthropic confirms Claude is down in major outage affecting multiple services

Claude is experiencing a major outage, with users reporting login problems and degraded performance across several Anthropic services. [...]

2d agoBleepingComputer

Wireshark 4.6.8 Released, (Sun, Aug 16th)

Wireshark release 4.6.8 fixes 28 vulnerabilities and 25 bugs.

2d agoSANS ISC

CVE-2026-6837: Command Injection in Zyxel export-cgi PKCS#12 Export Handling

[object Object]

CVE-2026-6837

2d agor/netsec

CVE-2026-6837: Root Command Injection Affecting 18 Zyxel Access Point Models

[object Object]

CVE-2026-6837

2d agor/cybersecurity

MEDIUMDdos

Large-scale DDoS attacks disrupted Threema secure messaging service

Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service earlier this week, causing severe disruptions to communications. [...]

2d agoBleepingComputer

HIGHMalware

New AmnesiaStealer macOS malware hijacks browser sessions via remote control

A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. [...]

2d agoBleepingComputer

NVD CRITICAL: CVE-2026-74790 — Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering...

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.

CVE-2026-74790

NVD CRITICAL: CVE-2026-73061 — Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedOb...

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

CVE-2026-73061

NVD CRITICAL: CVE-2026-73056 — SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive...

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount). As a result, an

CVE-2026-73056

New Jersey Federal Judge Dismisses Data Breach Class Action Against Background Check Company

There’s an update to a data leak incident reported in 2024. Phil Stilton reports: A federal judge has dismissed a proposed class action lawsuit against New Jersey-based background check company TABB Inc., finding the plaintiff failed to establish that he suffered a concrete injury necessary to pursue the case in federal court. In an opinion... Source

2d agoDataBreaches.net

500 Hosts, 1 TB and No Negotiation: Anubis Provides Details on the Fairlife Attack

SuspectFile has a great read on the Anubis attack on Fairlife. Marco De Felice faithfully reports what Anubis claims in its exclusive communications with him, what Coca-Cola claims, and how the claims differ. One of the most striking statements detailed the group’s response to how or why they targeted Fairlife: “It was not a targeted... Source

2d agoDataBreaches.net

CVE-2026-33696: From a Schema Name to RCE in n8n

[object Object]

CVE-2026-33696

2d agor/netsec

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-19924

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON met

CVE-2026-19598

3d agoNIST NVD

Time ran out for victims; CRPx0 puts data up for sale

CRPx0 made the news last month for its somewhat novel approach of offering free OnlyFans accounts to get victims to click links that would deploy its malware. Since August 7, when it launched a leak site on both the clear net and dark web, CRPx0 has listed 47 victims that did not pay its extortion... Source

3d agoDataBreaches.net

NVD HIGH: CVE-2026-19899 — A vulnerability was determined in SourceCodester Class and Exam Timetabling Syst...

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /edit_teacher.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

CVE-2026-19899

3d agoNIST NVD

New Evooo1Bot Linux botnet turns routers into traffic relay nodes

A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. [...]

3d agoBleepingComputer

UK: ICO reprimands ACRO Criminal Records Office after data breach

The Information Commissioner (the Commissioner) recently issued a reprimand to ACRO Criminal Records Office for infringements of Articles 32(1), 32(1)(b) and 32(1)(d) of the UK GDPR. ACRO Criminal Records Office (ACRO) is a national police unit providing a range of public services, including issuing Police Certificates and International Child Protection Certificates, and processing Subject Access.

3d agoDataBreaches.net

KR: Sogang University data breach exposes 180,000 student, staff accounts

Hyeon Ye-Seul reports: Personal information belonging to roughly 180,000 students, alumni and staff at Sogang University was exposed in a cyberattack, the university said Saturday. The university said it had confirmed signs that some data tied to its integrated login accounts had been leaked following an attack by an unidentified outside party. Sogang posted an... Source

3d agoDataBreaches.net

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user access

CVE-2026-14433

3d agoNIST NVD

How Anthropic plans to watermark Claude's AI-generated text

It could soon become easier to identify AI-generated content, even if it's not the usual "It's Not X, it's Y" type of post you'd come across on LinkedIn and other socials. [...]

4d agoBleepingComputer

ERP Security Struggles to Keep Pace With AI Agents

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/erp-security-struggles-to-keep-pace-ai-agents-image_small-4-a-32574.jpg" align=right hspace=4>CIOs Confront Rising Identity and Security Risks as AI Agents Gain Access to ERP As AI agents gain access to ERP systems, CIOs face risks from better-equipped attackers and authorized agents that can take harmful actions. Securi

Shield Breaks: Microsoft Faces Fresh Nightmare Eclipse Zero-Day

New AI Playbooks Will Target Healthcare Cyber Risk

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/new-ai-playbooks-will-target-healthcare-cyber-risk-image_small-4-a-32572.jpg" align=right hspace=4>Dr. Brian Anderson, CEO of the Coalition for Heath AI, on Frontier AI Threats Frontier AI models can identify network vulnerabilities and compress attacks from days or weeks into seconds, raising the stakes for healthcare.

CVE-2026-46300CVE-2025-49132

Metasploit Wrap Up: Lot of summer shells and fit http profiles

This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to the bare-metal, the Fragnesia Linux kernel LPE (CVE-2026-46300). Metasploit also got the glow-up of th

4d agoRapid7

4d agoSchneier on Security

Friday Squid Blogging: Searching for the Colossal Squid

Fascinating video about searching for life undersea. The video basically makes the point that our bright white searchlights are scaring everything away, and that red light is more neutral. That, plus bait to attract sea creatures, is teaching us a lot about what’s going on down there. Lots of footage of giant squid, and speculation about the colossal squid. Worth watching. As usual, you can

Investigation of banking hack leads to arrests in Germany, Brazil

Germany’s federal police agency, the BKA, said three suspects were picked up in Europe and charged with fraud, and Brazil’s federal police said four others were arrested on similar charges.

4d agoThe Record

In this video interview, Standard Chartered's group CISO shares insights on transitioning from technical roles to strategic leadership, the importance of business-savvy security executives, and how AI is reshaping both defensive capabilities and adversarial tactics in banking.

4d agoDark Reading

NVD CRITICAL: CVE-2026-73678 — MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated re...

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers

CVE-2026-73678

4d agoNIST NVD

MEDIUMApt

Russia Targeting Ukraine Using Internet-Connected Cameras

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/russia-targeting-ukraine-using-internet-connected-cameras-image_small-7-a-32566.jpg" align=right hspace=4>Attacks Against Ukrainian Soldiers and Materiel Tied to Hacking of European Devices Hacked websites and internet-connected devices in Europe are serving as cyberespionage launchpads for Russia's ongoing war against U

CVE-2026-21852: How Cursor's AI Agent Mode Was Compromised — And Why Your API Gateway Can't Save You

[object Object]

CVE-2026-21852

4d agor/cybersecurity

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available for registration and is then snapped up by another party. During the first half of 2026, 50,400

4d agoThe Hacker News

NVD HIGH: CVE-2026-19846 — A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This im...

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

NVD HIGH: CVE-2026-63700 — Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorre...

Hackers Exploiting Unpatched GeoServer Zero-Day

The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. The post Hackers Exploiting Unpatched GeoServer Zero-Day appeared first on SecurityWeek .

4d agoSecurityWeek

AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies. The post AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions appeared first on SecurityWeek .

4d agoSecurityWeek

NVD CRITICAL: CVE-2026-12949 — The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via I...

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a t

CVE-2026-12949

4d agoNIST NVD

Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks

You're not alone if you just received an "Apple Threat Notification" saying it detected a "mercenary spyware attack targeted at your iPhone." [...]

4d agoBleepingComputer

NVD HIGH: CVE-2026-19758 — A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue af...

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem ea

CVE-2026-19758

4d agoNIST NVD

MEDIUMVulnerabilityPOC

MUFG trials blockchain settlement for Japanese Government Bond repo trades

Mitsubishi UFJ Financial Group (MUFG) is running a proof-of-concept for bringing Japanese Government Bond repo transactions on-chain using the Canton Network blockchain.

5d agoFinextra

BofA to buy 49.9% stake in Indian digital lender Jio Credit

Bank of America has struck a $1.9 billion deal to buy up to 49.9% of Indian digital-native non-bank lender Jio Credit.

5d agoFinextra

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/oligo-raises-60m-to-extend-runtime-security-to-ai-agents-image_small-7-a-32556.jpg" align=right hspace=4>CEO: Funding Will Expand Exploit Blocking Across Cloud-Native and Agentic Apps Startup Oligo raised $60 million to expand runtime exploit blocking to agentic AI, tracing activity from prompts and tool calls to system

5d agoBank Info Security

Claims Data Shows Where AI Risk Is Hitting Now

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/claims-data-shows-where-ai-risk-hitting-now-image_small-10-a-32555.jpg" align=right hspace=4>Resilience Data Shows Social Engineering Dominates Over AI-Native Losses AI is amplifying familiar attacks rather than creating new categories of loss. Resilience's Jud Dressler explains why social engineering dominates claims, w

5d agoBank Info Security

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.

CVE-2026-17197

GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE

A newly disclosed zero-day flaw in GeoServer is seeing active exploitation efforts, per watchTowr. The vulnerability, which has yet to be assigned a CVE identifier, is an SQL injection vulnerability in the open-source platform that can lead to remote code execution (RCE). The security defect remains unpatched. It was first disclosed on August 12, 2026, at 10:46 UTC, by a researcher named @

5d agoThe Hacker News

NVD HIGH: CVE-2026-72741 — Rainbond through 6.9.7 contains a broken access control vulnerability in the Che...

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, a

CVE-2026-72741

NVD CRITICAL: CVE-2026-67614 — CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the We...

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service with

CVE-2026-67614

NVD HIGH: CVE-2024-58374 — Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the get...

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

NVD CRITICAL: CVE-2026-73533 — Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introd...

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administ

CVE-2026-73533

NVD CRITICAL: CVE-2026-73532 — Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introdu...

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploa

CVE-2026-73532

New Mirai variant adds stealth capabilities to notorious botnet code

Beyond Mirai’s usual functions, the new code features include encrypted communications with command-and-control servers and a “sniffer” that looks for default access credentials.

5d agoThe Record

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and

AnMed Investigating Ransomware Group’s Data Theft Claims

AnMed has not disclosed the name of the group behind the attack, but a threat group called The Gentlemen claimed […] The post AnMed Investigating Ransomware Group’s Data Theft Claims appeared first on The HIPAA Journal .

5d agoHIPAA Journal

CRITICALVulnerabilityPOC

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities.

CVE-2024-27253

Enterprise AI Token Spend Shifts From Chat to Agents

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/enterprise-ai-token-spend-shifts-from-chat-to-agents-image_small-8-a-32539.jpg" align=right hspace=4>Token Volume Climbs While Business Outcomes Remain Unclear OpenAI reports that enterprise customers are shifting token spend from chatbot conversations to agents deployed across systems and workflows, with Codex use sprea

Rush to Build Data Centers Leaves OT Security Behind

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/rush-to-build-data-centers-leaves-ot-security-behind-image_small-9-a-32538.jpg" align=right hspace=4>Siloed Systems Leaves OT Devices Only 'One Hop Away' From the Internet In the rush to get servers on the ground, and especially to cater to the artificial intelligence boom, data center owners have neglected security and

The "City-Forum" campaign has been active since at least March 2025 and has targeted organizations across multiple sectors with custom tooling.

6d agoDark Reading

Researcher bypasses Microsoft Defender security patch, seizing control

Just weeks after Microsoft patched a critical hole in Microsoft Defender, a cybersecurity researcher has posted an apparent bypass that provides system-level control to attackers once they gain any level of access. The researcher, who goes by the name Nightmare Eclipse, has been engaged in a long-running battle with Microsoft Security . Nightmare Eclipse has not provided the further details we req

CVE-2026-50656

Researcher creates workaround for Microsoft Defender security patch

Just weeks after Microsoft patched a critical hole in Microsoft Defender, a cybersecurity researcher has posted an apparent workaround that provides system-level control to attackers once they gain any level of access. The researcher, who goes by the name Nightmare Eclipse, has been engaged in a long-running battle with Microsoft Security . As of publication time, neither Microsoft nor Nightmare E

CVE-2026-50656

Axonius CEO Warns AI Deepens Asset Visibility Gaps

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/axonius-ceo-warns-ai-deepens-asset-visibility-gaps-image_small-10-a-32534.jpg" align=right hspace=4>Diamond: AI Agents Can Interact With Cloud Apps and Endpoints Across the Enterprise Axonius CEO Joe Diamond said rapid AI adoption is deepening enterprise visibility gaps as security teams struggle to identify AI agents, m

Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have been detected, potentially allowing attackers to hijack customer accounts. [...]

CVE-2026-71362

6d agoBleepingComputer

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.

CVE-2026-12004

NVD HIGH: CVE-2026-11923 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...

CVE-2026-11923

Qualys Introduces Real-Time Cloud Security Posture Management (CSPM) for Faster Risk Detection and Remediation

Key Takeaways Cloud environments change continuously, while security still relies on periodic scans, leaving gaps where risks go undetected. That gap becomes exposure. Qualys Real-Time CSPM monitors cloud changes as they happen, while still supporting periodic scans for environments that require them. It evaluates each finding in context by correlating posture data with vulnerabilities, asset [&#8

6d agoQualys Blog

Israeli cyber firm Dream said the framework adapted mid-operation, corrected its mistakes and expanded as it went along. The post Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan appeared first on CyberScoop .

6d agoCyberScoop

CA: Snoopers Beware; NL’s Privacy Commissioner Recommends Naming Individuals in Snooping-Related Breaches

VOCM reports: The province’s Privacy Commissioner is recommending that public bodies consider providing the name of anyone involved in snooping-related privacy breaches to affected individuals. The recommendation comes after an employee of NL Health Services had a peek at a person’s health record. NLHS was notified. The Privacy Commissioner says the health authority took the appropriate steps... S

6d agoDataBreaches.net

Walmart Takes a 'Trusted Agent' Approach to Purple Teaming

Walmart colocates red and blue teams to build trust and improve security through collaborative purple teaming exercises

6d agoDark Reading

Walmart's "Trusted Agent" Approach to Purple Teaming

Walmart co-locates red and blue teams to build trust and improve security through collaborative purple teaming exercises

6d agoDark Reading

NVD HIGH: CVE-2026-73325 — Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserializati...

Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce_

CVE-2026-73325

NVD HIGH: CVE-2026-58076 — Apache Airflow's serialization layer reconstructed exception nodes by calling `i...

Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoke

CVE-2026-58076

Plug and Pwn attack uses fake USB devices for Windows SYSTEM access

Security researchers have disclosed new "Plug and Pwn" attacks that abuse the Windows Plug and Play feature to trigger Windows into installing vulnerable or insecure vendor software and gain SYSTEM privileges. [...]

6d agoBleepingComputer

Lazarus hackers exploited Windows zero-day to target defense firms

FE fundinfo gives Nexus for Financial Advisers an AI assistant

FE fundinfo today confirmed it is accelerating investment in Nexus for Financial Advisers, a unified, AI-powered workflow platform built on the breadth of FE fundinfo's data, designed to support the entire advice journey by bringing together the disconnected systems most advice firms rely on today.

6d agoFinextra

NVD HIGH: CVE-2026-57858 — Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripti...

Siemens RUGGEDCOM APE1808

<a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-225-06.json">View CSAF</a> <h2>Summary</h2> Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens recommends to contact customer support for additional information, and follow Fortinet advisory for

RBI governor tells Indian banks to control AI

India's banking sector must be proactive in its adoption of AI and ensure that it determines how the technology reshapes the industry rather than let the technology dictate the inevitable changes.

6d agoFinextra

California Puts AI Inside Critical Infrastructure Defenses

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/california-puts-ai-inside-its-critical-infrastructure-defenses-image_small-4-a-32525.jpg" align=right hspace=4>California Bets on AI Defense as Federal Cyber Funding Dries Up California is directing state agencies to build artificial intelligence into the defenses protecting its power, water and transportation networks -

Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined

Intel has informed customers about several high-severity vulnerabilities that can lead to privilege escalation and even code execution. The post Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined appeared first on SecurityWeek .

Data Breaches Announced by Five Small Healthcare Organizations

Five small healthcare organizations have recently announced that they have experienced security incidents exposing patient data: Family Medical Associates of […] The post Data Breaches Announced by Five Small Healthcare Organizations appeared first on The HIPAA Journal .

6d agoHIPAA Journal

CVE-2026-53360: KVM SEV-SNP guest-to-host heap OOB and analysis of the upstream fix

[object Object]

4 gaps slowing AI in enterprise SOCs

Artificial intelligence (AI) has quickly become a strategic priority for enterprise security teams. Yet despite growing investment in AI-driven security software, many enterprise SOCs are struggling to translate AI into measurable operational improvements. The issue isn’t whether AI belongs in the SOC. It does. The challenge is that many organizations are approaching AI adoption in cybersecurity w

DASH names chief executive

Integrated financial planning software and investment platform, DASH Technology Group (DASH), has appointed experienced fintech and wealth management executive, Glenn Poynton, as chief executive officer, signaling the group’s focus on strengthening delivery for advisers and clients as it builds for its next phase of growth.

6d agoFinextra

Fresh Windows Zero-Day Exploited in North Korean Cyberattacks

The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor. The post Fresh Windows Zero-Day Exploited in North Korean Cyberattacks appeared first on SecurityWeek .

LOWSupply Chain

The AI harness is the new attack surface

Ask a security researcher what makes an AI agent dangerous, and the instinct is to talk about the model — what it will and won’t refuse, how easily it can be jailbroken, whether its weights can be trusted. That instinct is increasingly out of date. A growing body of security research — exploit demonstrations, independent red-teaming, and assessments by security researchers— points to the code sitt

NVD HIGH: CVE-2025-41770 — An unauthenticated denial-of-service vulnerability in the device's PLCnext Engin...

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.

CVE-2025-41770

NVD CRITICAL: CVE-2025-41769 — The device's PROFINET service is affected by a buffer overflow vulnerability tha...

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform

The security defects could allow unauthenticated attackers to execute arbitrary code remotely and read sensitive data. The post SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform appeared first on SecurityWeek .

CVE-2026-25646CVE-2026-42945

17 old software bugs that took way too long to squash

In 2021, a vulnerability was revealed in a system that lay at the foundation of modern computing. An attacker could force the system to execute arbitrary code. Shockingly, the vulnerable code was almost 54 years old — and there was no patch available, and no expectation that one would be forthcoming. Fortunately, that’s because the system in question was Marvin Minsky’s 1967 implementation of a Un

CRITICALZero DayPOC

ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

The security researcher going by the name Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof-of-concept (PoC) for a new Microsoft zero-day called ShieldBreak. The vulnerability, rooted in Microsoft Defender for Windows, demonstrates a patch bypass for CVE-2026-50656 (CVSS score: 7.8), otherwise known as RoguePlanet. RoguePlanet has been described

CVE-2026-50656

6d agoThe Hacker News

HIGHApt

Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS

Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been exploited in the wild. The high-severity flaw, tracked as CVE-2026-20349 (CVSS score: 8.6), is a case of insufficient error checking when processing HTTP requests that could allow an unauthenticated, remote attacker to trigger

CVE-2026-20349

6d agoThe Hacker News

Cisco Patches Firewall Zero-Day Exploited for DoS Attacks

CVE-2026-20349 can be exploited remotely without authentication against Secure Firewall ASA and FTD devices. The post Cisco Patches Firewall Zero-Day Exploited for DoS Attacks appeared first on SecurityWeek .

CVE-2026-20349

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.

CVE-2026-66878

Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse

Google says Chrome's anti-abuse systems reduced unwanted notifications on Android by more than 7 billion per day during the first quarter of 2026. [...]

6d agoBleepingComputer

CVE-2026-53413CVE-2026-53415

Patch Tuesday August 2026: A zero-day WinSock driver hole under exploit, and a maximum severity SAP vulnerability

A currently exploited zero-day elevation of privilege vulnerability that needs to be patched in a Windows driver for WinSock is the highlight of the 398 fixes issued today in Microsoft’s August Patch Tuesday releases. The hole is in Windows’ Ancillary Function Driver for WinSock ( CVE-2026-68820 ), which, according to Todd Schell , principal product manager at Ivanti, has been a recurring target f

Zoom has fixed four vulnerabilities across its applications, including two that could allow attackers who join a meeting to execute malicious code on the systems of all other meeting participants with no interaction required from them. Three of the vulnerabilities affect all Zoom client applications for all platforms before versions 7.1.5 and 7.0.6, while the fourth impacts Zoom Workplace VDI Clie

Aug 11, 2026CSO Online

Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for August 2026, which includes 421 vulnerabilities affecting a range of products, including 62 that Microsoft marked as "critical."

Aug 11, 2026Cisco Talos

NVD CRITICAL: CVE-2026-5917 — libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_...

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository

CVE-2026-5917

NVD HIGH: CVE-2026-29036 — cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or refe...

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to app

CVE-2026-29036

DeadLock ransomware uses blockchain to resist infrastructure takedown

The DeadLock ransomware operation is using a decentralized infrastructure that relies on blockchain-backed services to protect its communication with victims and data-leak activity. [...]

California Puts AI Inside Its Critical Infrastructure Defenses

Rapid7 Lays Off 12% of Staff as New CEO Reshapes Cyber Firm

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/rapid7-lays-off-12-staff-as-new-ceo-reshapes-cyber-firm-image_small-6-a-32526.jpg" align=right hspace=4>New CEO Wael Mohamed Targets Efficiency, Product Modernization and Higher Win Rates Boston-based Rapid7 will cut roughly 314 jobs, or 12% of its workforce, as new CEO Wael Mohamed restructures the managed cybersecurity

Microsoft Patch Tuesday, August 2026 Security Update Review

The August 2026 Microsoft Patch Tuesday release delivers security fixes for vulnerabilities affecting a wide range of Microsoft products and services. As attackers continue to exploit unpatched vulnerabilities, timely patching remains critical for reducing exposure and strengthening enterprise security.  Microsoft Patch Tuesday for August 2026  This month&#8

Aug 11, 2026Qualys Blog

Microsoft and Adobe Patch Tuesday, August 2026 Security Update Review

Aug 11, 2026Qualys Blog

Microsoft's Patch Tuesday Deluge Continues With August Updates

Security experts say prioritization should be the main focus for the August updates, not the massive CVE volume.

Aug 11, 2026Dark Reading

CVE-2026-62832CVE-2026-68820

Microsoft Plugs Nearly 400 Security Holes

Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

Aug 11, 2026Krebs on Security

Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA

The ransomware-as-a-service operation is finding success against critical infrastructure targets with leaked Conti code and old flaws in firewalls and VPN appliances.

Aug 11, 2026Dark Reading

CVE-2026-63520CVE-2026-55040

Patch Tuesday - August 2026

Microsoft is publishing 421 vulnerabilities on August 2026 Patch Tuesday , including 236 vulnerabilities in Windows. This is lower volume than last month’s record-breaking behemoth, but still one of the largest Patch Tuesday totals ever. There is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the wild for on

Aug 11, 2026Rapid7

Sandworm hackers target IT pros with trojanized WireGuard VPN client

Hackers associated with the Russian threat group Sandworm have been targeting system administrators and IT professionals through fake job offers since at least May. [...]

ISMG Security Report: Could Hackers Read Patients' Thoughts?

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ismg-security-report-implantable-brain-devices-hackers-image_small-6-a-32510.jpg" align=right hspace=4>Neural Implants Bring Hope for Treatment, But Pose New Cybersecurity Headaches Implantable neural devices that plug into a patient's brain or spinal cord are offering transformative clinical therapy for illnesses such a

Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM. That patch goes out first. The flaw is tracked as CVE-2026-68820 (CVSS score: 7.0) and is the only

CVE-2026-68820

NSA installs DHS lawyer as new general counsel

Kerianne Tobitsch, who most recently served as a senior lawyer at the Homeland Security Department, is the NSA's new general counsel, sources told Recorded Future News.

Aug 11, 2026The Record

Apple Pay and Wallet chief Bailey to leave

Apple's head of payment and wallet services, Jennifer Bailey, is leaving after 23 years at the tech giant.

Cisco warns of ASA and FTD VPN flaw exploited to crash devices

Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices. [...]

Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. The new version, tracked as Kimwolf v7, was discovered by Palo Alto Networks Unit 42 in February 2026. "Kimwolf v7 adds an HTTP/2-based

NVD HIGH: CVE-2026-72742 — DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio o...

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter v

CVE-2026-72742

NVD HIGH: CVE-2026-15426 — The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution...

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwri

CVE-2026-15426

Ransomware group hijacks hospital system’s Facebook page amid ongoing cyberattack fallout

The hackers claimed to have exfiltrated 6 terabytes of data, including highly sensitive health information like records related to sexual assault, mental health, abortions and sexual harassment incidents.

Aug 11, 2026The Record

Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client

Anyone sharing their screen on a Zoom call could have taken over the computers of everyone watching, and anyone watching could have taken over the presenter's. The flaw sat in the annotation tool, the feature that lets participants draw and type on a shared screen, and it asked nothing of the victim beyond being in the meeting. No click, no download, no prompt, and nothing on screen to show it

Zoomsday: Zero-click RCE in Zoom, from any meeting participant to any other (CVE-2026-53413)

[object Object]

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not req

CVE-2026-48381

NVD CRITICAL: CVE-2026-27302 — Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi...

CVE-2026-27302

NVD HIGH: CVE-2022-50997 — Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in t...

Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request with UNION-based injection payloads through the unsanitized id parameter to retrieve arbitrary data

CVE-2022-50997

NVD HIGH: CVE-2016-20097 — Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the Signa...

Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers can control the markPath value returned by the query to supply an attacker-controlled filesystem path

is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVE-2026-21273

Alert: Unpatched Fortinet Devices Fall to Gunra Ransomware

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/alert-unpatched-fortinet-devices-fall-to-gunra-ransomware-image_small-9-a-32518.jpg" align=right hspace=4>US and South Korea Tie Initial Access to Unpatched Firewalls and VPN Gateways Critical infrastructure organizations running unpatched firewalls and VPN gateways - including Fortinet gear not updated since early 2025

Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws

The security defects could be exploited for arbitrary code execution and denial-of-service. The post Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws appeared first on SecurityWeek .

Aug 11, 2026SecurityWeek

Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE

Security researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, with no valid account. A significant part of the work that found it was done through an AI agent. The flaw, tracked as CVE-2026-55040 (CVSS 9.1), affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft's

CVE-2026-55040

DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt

The ransomware group known as DeadLock has been observed using decentralized infrastructure to facilitate victim communications and data leak operations in a bid to improve operational resilience. "Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process," the Microsoft Threat

UK parliamentarians question banks over refusal to provide services to crypto firms

A group of UK politicians have written to the CEOs of the country's major banks asking them to clarify their approach to providing services to crypto and digital asset firms.

NVD HIGH: CVE-2026-19546 — A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for ...

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds write vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.

CVE-2026-50059

Vague Task, Total Access: When AI Delegation Becomes a Security Risk

AI agents can improvise beyond the intended scope of a task when they are given broad access to enterprise systems and data. Token Security explains why organizations need to define agent intent and continuously enforce permissions around what each agent was actually created to do. [...]

OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development

OpenAI on Monday unveiled a new cybersecurity-focused model called GPT‑5.6‑Cyber that it said is focused on vulnerability research, penetration testing, and incident response. "Built on GPT‑5.6 Sol, it is trained to improve capabilities on several specialized cybersecurity tasks (e.g., finding zero-day vulnerabilities and developing exploit chains) and to reduce refusals for certain higher-risk

CRITICALAptPOC

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

Overview On July 14, 2026, Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass vulnerability affecting Microsoft SharePoint. Today we are publishing a technical analysis of the vulnerability along with an accompanying proof-of-concept (PoC) script . Figure 1: The Rapid7 Labs PoC for CVE-2026-55040. ⠀ A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authen

CVE-2026-55040

Aug 11, 2026Rapid7

CVE-2026-63520CVE-2026-55040

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Overview Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the second vulnerability in this chain, the RCE vulnerability CVE-2026-63520. The first

Aug 11, 2026Rapid7

MEDIUMDdos

DDoS attacks over 1 Tbps surged fivefold in the second quarter

Cloudflare says it mitigated more than 800 network-layer distributed denial-of-service (DDoS) attacks exceeding 1 Tbps in the second quarter of the year. [...]

Local governments in four states dealing with cyberattacks that have shut down services

Municipalities in California, Oklahoma, Wisconsin and Texas are all recovering from disruptive cyberattacks that have affected government operations.

Aug 11, 2026The Record

NAB to reshuffle tech leadership

National Australia Bank (NAB) has moved to replace the leader of its technology division as well as its chief operating officer.

NVD HIGH: CVE-2026-50237 — A Server-Side Request Forgery and supply chain flaw was found in the OpenShift C...

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

CVE-2026-50237

CVE-2026-21655CVE-2026-34496

NVD HIGH: CVE-2026-50236 — An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhoo...

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

<a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-01.json">View CSAF</a> <h2>Summary</h2> Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server (Updat

Aug 11, 2026CISA Advisories

CRITICALApt

Mira Hormone Monitor, Mira Android App

<a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json">View CSAF</a> <h2>Summary</h2> Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information,

CVE-2026-66875CVE-2026-66098

Aug 11, 2026CISA Advisories

CRITICALPhishing

Pulsetto Vagus Nerve Stimulator

<a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-02.json">View CSAF</a> <h2>Summary</h2> Successful exploitation of this vulnerability could allow an attacker to use hidden commands to disable electrical safety mechanisms or modify other stimulation output settings. The following versions of Pulsetto Vagu

CVE-2026-18844

Aug 11, 2026CISA Advisories

Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers

Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean operatives. Every virtual machine the company issued was recording. The onboarding paperwork is the part hiring teams can use. The first hire claimed to live in Pasadena, Texas, then sent a California driver's license and a New York bank account. The

Aug 11, 2026Infosecurity Magazine

OpenAI Launches Two-Tier Security Access Program Alongside GPT 5.6 Cyber

Daybreak Blue removes some OpenAI-made guardrails while Daybreak Red grants the use of cyber-focused frontier AI models

OpenAI launches GPT-5.6-Cyber as AI narrows vulnerability response window

OpenAI has expanded its Daybreak cybersecurity program and introduced GPT-5.6-Cyber, a specialized model for approved security researchers, as the company warned that AI could give defenders less time to respond to developing threats. Daybreak now has two access levels. Blue gives approved defenders access to frontier general-purpose models such as GPT-5.6 Sol for authorized defensive work, while

Aug 11, 2026CSO Online

Aug 11, 2026Schneier on Security

AI for Military Support

Interesting empirical research: “ Black Box Warfare: Human Judgment and Military Decision-Making in the Age of AI .” Abstract: How is AI transforming decision-making in modern conflict? This study provides a unique empirical window into that question by deploying a high-fidelity replica of an AI decision-support system (DSS) used in military targeting. After reconstructing the interfac

NVD CRITICAL: CVE-2026-58231 — SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authent...

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

CVE-2026-58231

Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities

The extension amassed over 300,000 installs and a 4.6 rating before Google removed it for stealing data. The post Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities appeared first on SecurityWeek .

Aug 11, 2026SecurityWeek

Cisco warns of high-severity ClamAV flaws with public exploits

Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks. [...]

Court Sets Strict Security for Change Health's Stolen Data

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/court-sets-tight-security-for-change-healths-stolen-data-image_small-8-a-32507.jpg" align=right hspace=4>Plaintiffs, Experts Face Strict Rules for Handling Data Stolen in 2024 Attack A federal court last week approved stringent security requirements on how plaintiffs' attorneys and experts must safeguard a copy of stolen

China-Linked Hackers Use N-able Flaw in Ransomware Attacks

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

CVE-2026-10579

Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

Cybersecurity and intelligence agencies from South Korea and the U.S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world. Targets of these attacks include healthcare and public health, financial services, government services and facilities, and professional and nonprofit services. "Gunra is another variant in the ongoing trend of

Gunra Ransomware Exploits Fortinet FortiOS, FortiProxy Flaws to Breach Networks

MEDIUMApt

United Fintech installs senior leadership team

United Fintech has appointed three new partners and established a senior leadership team, putting in place a long-term partnership model as the company enters its next chapter as trusted, neutral infrastructure for wholesale finance.

Aug 11, 2026Infosecurity Magazine

OpenAI Pauses Some Development of Astra Model on Security Concerns

OpenAI is tightening restrictions on testing of its upcoming Astra model due to security concerns

CRITICALData Breach

Security leaders’ rogue AI confidence could actually be disastrous

A large majority of IT and security leaders are confident in their teams’ ability to detect when an AI agent has gone rogue, but few are able to take quick action to mitigate the fallout when an agent exceeds its intended scope. Nine in 10 IT and security leaders surveyed by IT observability vendor WanAware believe in their capabilities to find malfunctioning agents, but only 26% acknowledge that

Aug 11, 2026CSO Online

Aug 11, 2026Infosecurity Magazine

Only Half of UK Manufacturers Have a Cyber Incident Response Plan

Make UK reveals major cyber resilience gaps as 30% of UK manufacturers report recent cyber incidents

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine

Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power plant by coming in over the private cellular network the local grid operator uses to reach remote equipment. The plant supplies heat to roughly 50,000 residents. Recovery began at about 7:30 a.m. while the intruders were still active inside the network, and customers lost neither heat

LOWSupply Chain

Mozilla Issues New Firefox GPG Key Following Exposure

The previous GPG signing subkey was inadvertently added to a GitHub repository and Mozilla decided to revoke it. The post Mozilla Issues New Firefox GPG Key Following Exposure appeared first on SecurityWeek .

Aug 11, 2026SecurityWeek

MEDIUMSupply Chain

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems (CMS) platform's plugins team to temporarily disable their downloads. "Unlike traditional software supply chain attacks, zero source code files were modified within the official WordPress.org repository," Wordfence researcher Paolo Tresso said.

NVD CRITICAL: CVE-2026-19425 — Travel Agency Management System developed by Win Men Intermational has a SQL Inj...

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

CVE-2026-19425

NVD HIGH: CVE-2026-19424 — Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Refe...

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data.

CVE-2026-19424

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.

CVE-2026-34265

Astraeus launches wealth management infrastructure platform

Former staffers at mobile banking firm MoneyLion have raised over $10 million for an AI-native infrastructure platform for wealth management firms.

More than half of Brits lose money acting on social media financial advice

Over half of Brits who have acted on financial advice on social media have lost money as a result, according to a TSB survey.

Meta Puts Open-Source AI Bet on Muse Glimmer

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/meta-puts-open-source-ai-bet-on-muse-glimmer-image_small-1-a-32508.jpg" align=right hspace=4>Local Agentic AI Model Targets Coding, Tool Calling and Multi-Step Tasks Meta hopes to recapture the momentum it had when it first launched its Llama artificial intelligence model. Now, with a new model and an increased focus on

CVE-2026-20349Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)

CISA KEV: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

Aug 11, 2026CISA KEV

CVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSock

CISA KEV: Microsoft Windows Ancillary Function Driver for WinSock — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Aug 11, 2026CISA KEV

CVE-2026-72898Metabase Metabase

CISA KEV: Metabase Metabase — Metabase SQL Injection Vulnerability

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Aug 11, 2026CISA KEV

Aug 10, 2026BleepingComputer

Hackers breached a small Polish energy plant via private APN last year

Hackers breached a heat-and-power plant facility in Poland, which supplies heat to about 50,000 residents, using a private APN (Access Point Name) to access an OT (Operational Technology) network. [...]

Aug 10, 2026Bank Info Security

Obsidian Secures $85M to Control AI Agents in SaaS Apps

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/obsidian-secures-85m-to-control-ai-agents-in-saas-apps-image_small-10-a-32511.jpg" align=right hspace=4>CEO Hasan Imam Says AI Agents Are Already Modifying and Deleting Enterprise Data Obsidian Security raised $85 million at a $1.1 billion valuation to expand real-time monitoring and enforcement as enterprises give auton

Aug 10, 2026Bank Info Security

Court Sets Tight Security for Change Health's Stolen Data

Aug 10, 2026Unit 42 (Palo Alto)

The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications

Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications appeared first on Unit 42 .

'GhostJacking' Exposes Identity Governance Gaps in AI Agents

New research shows how attackers can use security alerts and blocked events to manipulate and hijack AI agents.

Aug 10, 2026Dark Reading

Multistate Water System Attacks Widen, Iran Suspected

Attacks targeting water systems just keep flowing across a dozen states, against ill-secured, Internet-exposed PLCs.

Aug 10, 2026Dark Reading

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint

CVE-2026-14450

Aug 10, 2026NIST NVD