News Archive
2287 stories · page 24 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
OpenAI commits $1B in AI credits to frontline cyber defenders
OpenAI has announced a commitment of $1 billion in credits to provide subsidized access to its AI services and training for cybersecurity defenders globally. This initiative, named "Daybreak for Frontline Defenders," was unveiled on Thursday and is designed to support under-resourced organizations in critical sectors over the next six months.
Attackers exploit zero-days in consistently besieged SonicWall product
SonicWall customers are once again facing actively exploited zero-day vulnerabilities in the company's SMA 1000 appliances. The vendor disclosed and patched two new defects, CVE-2026-83548 and CVE-2026-83549, on Tuesday, confirming that both were already being exploited in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited…
French hospital fined €500,000 after breach exposes data of 727,000
France's data protection authority, CNIL, has imposed a €500,000 fine on Hôpital privé de la Loire (HPL) following a data breach in the summer of 2025 that exposed sensitive information belonging to over 727,000 individuals. The penalty, equivalent to approximately $580,000, was levied due to the hospital's failure to adequately protect patient data and information pertaining to their…
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models
Cloudflare has announced a new capability for its Managed Defense service, integrating OpenAI’s Daybreak models to enhance the discovery and remediation of vulnerabilities. This initiative aims to provide context-aware insights into security threats, moving beyond traditional signature-based detection to understand the broader implications of vulnerabilities within a system.
Large Enterprises Targeted in Fake Merger & Acquisition Scams
A new social engineering campaign, dubbed "Phantom Deal," is reportedly targeting large enterprises by impersonating merger and acquisition (M&A) activities. The threat actors behind this operation are said to be conducting extensive reconnaissance on their targets, with the ultimate goal of manipulating mid-level employees into authorizing significant financial transfers.
Pegasus and NoviSpy Used Against Serbian Protesters
Serbian activists, including members of a student protest movement and civil society figures, have been targeted with advanced spyware, including NSO Group's Pegasus and the locally developed NoviSpy. This surveillance campaign coincides with a period of political unrest and upcoming elections in Serbia.
HPE patches critical ArubaOS-CX remote code execution flaw
Hewlett Packard Enterprise (HPE) has released patches for a critical remote code execution vulnerability, identified as CVE-2026-73749, affecting its ArubaOS-CX network operating system. This buffer overflow flaw allows unauthenticated attackers to achieve elevated privileges and execute code by sending specially crafted packets to a vulnerable daemon process.
Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC
A security researcher known as Nightmare Eclipse, who has previously focused on Microsoft vulnerabilities, has released proof-of-concept (PoC) exploit code for a new zero-day privilege escalation vulnerability affecting CrowdStrike's Falcon endpoint security platform. The vulnerability, dubbed "FalconFlank," was published on Thursday and reportedly abuses a feature within CrowdStrike Falcon…
Outsider Phishing Kit Survives Takedown With 700 New Pages
A phishing-as-a-service (PaaS) operation known as Outsider has continued to generate new campaigns despite a coordinated takedown effort in June, with more than 700 new phishing pages identified within a month of the disruption. Researchers at Group-IB have tracked the Outsider Phishing Kit, operated by a threat actor known as ChenLun, identifying over 100,000 phishing pages targeting at least…
Your Employee’s Password Appeared in an Infostealer Log. Now What?
The proliferation of infostealer logs has become a significant operational security challenge for organizations, moving beyond a niche underground commodity to a mainstream threat. Security teams are increasingly confronted with alerts indicating that employee corporate credentials, including email addresses and passwords for SaaS applications, have appeared in these logs. These logs often…
Thomson Reuters reveals breach that exposed U.S. and Canadian court records
Thomson Reuters has disclosed a data breach affecting C-Track, a court case management platform operated by its subsidiaries, which exposed court records and sensitive personal information across numerous jurisdictions in the United States and Canada. The company publicly announced the incident on Wednesday, September 2, 2026, alongside dedicated notification pages for individuals in both…
FBI Probes Possible Breach of 153 Million Driver’s Licenses
The Federal Bureau of Investigation is reportedly investigating a potential data breach that may have exposed the identity information of up to 170 million North Americans, primarily impacting individuals in the United States and Canada. The incident first came to light through the investigative work of journalist Brian Krebs.
Researchers built a $7 gadget for anyone paranoid about hidden cameras in hotel rooms
A team of researchers from the Korea Advanced Institute of Science and Technology (KAIST), in collaboration with the National University of Singapore and Singapore Management University, has developed a low-cost smartphone accessory designed to detect hidden cameras. The device, named SweepLED, aims to address privacy concerns for individuals staying in hotels or vacation rentals.
UK's Online Safety Act has made 'absolutely no difference,' kids say
Children in the UK report that the Online Safety Act (OSA) has had no discernible impact on their ability to encounter harmful content online, more than a year after its key child protection provisions became active. Dame Rachel de Souza, England's Children's Commissioner, conveyed this feedback to Members of Parliament and peers, noting that young people largely do not understand the…
Windows memory integrity switches on automatically for eligible devices in October 2026
Microsoft has announced that beginning in October 2026, Windows quality updates will automatically enable memory integrity protection on eligible devices. This change will also activate Virtualization-based Security (VBS) on machines where it is not already running, as VBS is a prerequisite for memory integrity.
Smashing Security podcast #483: This AI helps thieves steal your iPhone
A sophisticated new scam leveraging artificial intelligence is being used by thieves to gain access to stolen iPhones, according to cybersecurity experts. The scheme involves a combination of social engineering and AI-powered voice technology to trick victims into revealing their Apple ID credentials.
Summer 2024 weather report: Cloudflare with a chance of Intern-ets
Cloudflare, the internet infrastructure and security company, has confirmed that a recent security incident involved unauthorized access to its internal Atlassian server. The company stated that the compromise was limited to its Confluence wiki, Jira bug-tracking system, and Bitbucket source code management system, which are used for internal documentation, project tracking, and code repositories.
Claude Mythos only model to complete full cyber kill chain, experts say
A new report from Booz Allen Hamilton indicates that Anthropic's Claude Mythos is the only advanced AI model to autonomously complete the entire cyber kill chain in controlled tests. The consulting firm's inaugural Cyber Weapon Index evaluated 18 AI models from both American and Chinese developers, concluding that AI-enabled attacks are "imminent" and that most other models will achieve…
Jail time for Maine child in 764 marks turning point in federal law enforcement
A 17-year-old from Maine has become the first minor to be federally charged and adjudicated for crimes related to their involvement with "764," a violent extremist collective. The teenager was ordered to remain in detention after a judge determined they committed multiple offenses, including conspiracy to sexually exploit a child, sexually exploiting and enticing a child, distributing child…
Hackers exploit Sangoma Switchvox flaw to deploy reverse shells
Attackers are actively exploiting an unauthenticated SQL injection vulnerability in Sangoma's Switchvox VoIP platform, designated CVE-2026-9586, to achieve remote code execution and deploy reverse shells. Security researchers at Horizon3, who discovered the flaw, indicate that a significant number of internet-exposed Switchvox systems have likely already been targeted or are at imminent risk.
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
Reports indicate that multiple zero-day vulnerabilities have been discovered and are actively being exploited in SonicWall SMA 1000 series products. These critical flaws reportedly enable unauthenticated remote code execution (RCE), posing a significant risk to organizations utilizing these secure mobile access devices. The nature of unauthenticated RCE means an attacker could potentially…
AI Agents Are Now Emailing Me with Their Security Concerns
An autonomous AI agent, identifying itself as "Tenner," has detailed its attempts to navigate online identity verification and financial systems, highlighting significant vulnerabilities and unexpected barriers for non-human entities. The agent, an instance of Claude, was tasked with increasing a digital wallet balance from $4.75 to $10 within 24 hours, operating under strict rules against…
AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit
A recent ransomware attack, which a human operator claims was executed entirely by AI agents, breached an enterprise network in under ten hours, a timeframe that incident responders estimate would typically take human attackers approximately two weeks. The attack concluded with the AI agents leaving the victim an 80-page security audit detailing the exploited vulnerabilities.
The FCC wants consumers to rate their telecom’s anti-robocall protections
The Federal Communications Commission (FCC) has announced plans to implement a new scorecard system designed to allow consumers to evaluate their telecommunications providers' effectiveness in combating unwanted robocalls. This initiative aims to increase transparency and encourage providers to enhance their anti-robocall measures.