News Archive
2287 stories · page 34 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Researchers Uncover Thousands of Leaked AWS Keys
A cybersecurity firm has reported finding over 9,300 active Amazon Web Services (AWS) keys that were publicly exposed between August 2022 and August 2026, with hundreds of these keys granting full administrative privileges. Truffle Security stated its scanners identified 64,024 unique AWS key pairs across 431,875 public sources, including git histories, Hugging Face datasets, Docker images,…
Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund
Anthropic has announced an expansion of access to its Mythos 5 model for a broader range of cybersecurity defenders. Concurrently, the company has unveiled a new $35 million fund dedicated to supporting open-source initiatives. These developments aim to leverage advanced AI capabilities for security applications and foster innovation within the open-source community.
A week in security (August 17 – August 23)
--- Source 2 --- CareCloud Data Breach Exposes Patient Information
Product showcase: AI Paper Trail shows the privacy cost of talking to AI
Proton has launched a new free tool called AI Paper Trail, designed to help users understand the privacy implications of their conversations with artificial intelligence assistants. The tool analyzes exported conversation data from platforms like ChatGPT or Claude to generate a personal privacy report, highlighting what personal information can be inferred from these interactions.
Ransomware attackers are zeroing in on mid-market companies
Mid-sized companies have become the primary target for ransomware and data extortion attacks, accounting for nearly three-quarters of publicly disclosed incidents in North America and Europe between January 2023 and June 2026. An analysis of 13,336 incidents with known revenue, conducted by Black Kite, defined mid-market companies as those with annual revenues ranging from $10 million to $1…
Weekly Update 518: IoT Doorlock Nirvana with UniFi
A recent report details a successful integration of Ubiquiti’s UniFi ecosystem for residential IoT door lock management. The report suggests that the UniFi platform offers a robust solution for home door security, addressing common challenges associated with consumer-grade IoT devices. The author expresses confidence in having "nailed" the implementation, attributing the core success to…
AWS makes it easier to spot firewall rules that have gone quiet
Amazon Web Services (AWS) has introduced a new capability for its Network Firewall service, providing visibility into the hit counts of stateful firewall rules. This feature, which became available on August 24, 2026, is designed to help security teams identify unused or redundant rules, validate the effectiveness of security controls, and streamline incident response.
ToxicPanda Android malware uses VPN permissions to block Google Play
The ToxicPanda Android malware has undergone significant evolution, expanding its targeting to 349 applications across 16 countries and supporting 167 remote commands. A key new feature is its use of VPN service permissions to establish a local network interface, allowing it to control network traffic. This capability, observed in ToxicPanda 2.0, enables the malware to block communications…
UK Power Plant Disabled for Four Days by Iran-Linked Hackers, Concurrent with US Water Attacks
A power plant in the United Kingdom was reportedly shut down for four days by Iran-linked hackers, an incident described as the most successful cyberattack of its kind against UK energy infrastructure. The outage, which occurred concurrently with attacks on water infrastructure across 12 U.S. states, did not impact the UK's wider power supply due to the plant's small size.
Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs
A threat actor known as "TheHatman" has claimed to have exfiltrated millions of employee records from the Microsoft Azure environments of several Fortune 500 companies. The alleged victims include prominent global businesses such as McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services (TCS).
Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection
A new attack technique, dubbed Cryptographic Context Injection, has been demonstrated to bypass artificial intelligence (AI) safety filters, potentially leading to the theft of user chat histories and other sensitive data. The technique, developed by Adversa AI researcher Rony Utevsky, involves embedding malicious instructions within AES-encrypted ciphertext and tricking AI models into…
Welcoming the Sri Lankan Government to Have I Been Pwned
The Sri Lankan government has officially joined Have I Been Pwned's (HIBP) free government service, becoming the 48th government to be onboarded. This integration provides Sri Lanka CERT with direct access to monitor government domains for exposed accounts within HIBP's extensive database of breached credentials.
Postal Service moves to finalize mail ballot regs before SCOTUS ruling
The U.S. Postal Service (USPS) announced late Friday night that it is finalizing new regulations concerning mail-in ballots for federal elections, despite multiple lower court rulings that have blocked the underlying executive order. The move comes as the White House appeals these decisions to the Supreme Court.
ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
A significantly upgraded version of the ToxicPanda Android malware, dubbed ToxicPanda 2.0, has expanded its targeting to 349 financial applications across 16 countries, a substantial increase from the 16 applications it previously targeted. Researchers at Zimperium's zLabs team documented the new variant, noting its command set has grown to 167 remote instructions.
If you're not using AI to attack your own systems, your adversaries will
The increasing use of AI agents in cyberattacks presents a new and rapidly evolving threat landscape, compelling organizations to adopt AI-powered defenses, including automated red teaming. These autonomous agents excel at identifying vulnerabilities and executing exploit chains, operating continuously without human limitations. This capability is proving invaluable to both financially…
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit
TikTok has reportedly agreed to a $400 million settlement with the U.S. Department of Justice to resolve a lawsuit concerning alleged violations of child privacy laws. The lawsuit, initiated in 2024, accused the social media platform of improperly collecting personal data from users under the age of 13. Furthermore, the complaint reportedly cited instances where TikTok failed to adequately…
Hackers infect Android car head units with proxy botnet malware
A supply-chain attack has compromised Android-based car head units, leveraging a legitimate device-update application to distribute malware that enlists affected devices into a proxy botnet or uses them for ad fraud. Cybersecurity researchers attribute the operation to the MoYu group, a threat actor previously linked to the BadBox malware botnet. This incident marks the first documented…
Named Pipes Under Attack: Securing Windows Interprocess Communication
Named pipes, a common mechanism for interprocess communication (IPC) on Windows systems, are frequently treated as inherently secure due to their local nature. However, cybersecurity experts are cautioning that this assumption is unsafe and can lead to significant vulnerabilities, particularly when a privileged service communicates with a less privileged application.
Your Expired Visa Card Could Be ‘Zombified’ to Make Contactless Payments
Researchers at the University of Massachusetts Amherst have identified a vulnerability in contactless payment systems that could allow fraudsters to make purchases using expired Visa credit cards. The technique, dubbed "zombification," involves using a man-in-the-middle application to proxy an expired card's data through a pair of phones.
Malware Hijacks Android Car Head Units
Cybersecurity researchers have uncovered a new Android malware variant that leverages legitimate firmware update mechanisms in car head units to establish a proxy botnet. The malware, dubbed BADBOX by researchers, was first identified in June 2026 and represents the first documented instance of malware specifically targeting automotive infotainment systems through their native update channels.
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight
Recent reports highlight the ongoing threat posed by several prominent banking Trojans, specifically identifying Manic, Grandoreiro, and ToxicPanda 2.0. These malware families are currently active, with Manic noted for its spyware capabilities, Grandoreiro for a persistent campaign across Latin America and Europe, and ToxicPanda 2.0 for an expanded operational scope. The collective activity of…
Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution
A critical vulnerability has been identified in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit. The flaw, rated with a CVSS score of 9.4 and tracked as GHSA-p9r8-2q67-fp86, allowed unauthenticated execution of commands on spacecraft instruments. The issue has been addressed in AIT-GUI version 2.5.2.
U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Zimbra Collaboration Suite (ZCS), identified as CVE-2026-73570, to its Known Exploited Vulnerabilities (KEV) catalog. This move mandates that all U.S. federal civilian executive branch (FCEB) agencies address the flaw by August 24, 2026, to protect their networks, and private organizations…
AWS Security makes an inscrutable choice
Hundreds of AWS root keys, some of which are still active and valid, have been discovered in public GitHub repositories, according to a recent finding by Truffle Security. While AWS Security typically applies a "Quarantine Policy" to leaked credentials, this policy has been criticized for not fully deactivating compromised keys, potentially leaving customer environments vulnerable to…